[Filebeat] Allow cisco/asa and cisco/ftd modules to override network directionality based off of zones#23068
Merged
andrewstucki merged 6 commits intoelastic:masterfrom Dec 10, 2020
Conversation
…directionality based off of zones
Contributor
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
Contributor
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. Expand to view the summary
Test stats 🧪
|
leehinman
approved these changes
Dec 10, 2020
Author
|
Since there's no way of overriding the config on a per golden file basis. Here's a diff to demonstrate this working: With the following configuration change diff --git a/x-pack/filebeat/module/cisco/ftd/manifest.yml b/x-pack/filebeat/module/cisco/ftd/manifest.yml
index 31eb9659a..6c07bdf33 100644
--- a/x-pack/filebeat/module/cisco/ftd/manifest.yml
+++ b/x-pack/filebeat/module/cisco/ftd/manifest.yml
@@ -25,7 +25,9 @@ var:
- name: internal_PREFIX
default: FTD
- name: external_zones
+ default: [ "output-zone" ]
- name: internal_zones
+ default: [ "input-zone" ]
ingest_pipeline: ../shared/ingest/asa-ftd-pipeline.yml
input: config/input.ymlWe see the following change: diff --git a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json
index 093665fca..b6a5aa94f 100644
--- a/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json
+++ b/x-pack/filebeat/module/cisco/ftd/test/dns.log-expected.json
@@ -74,6 +74,7 @@
"log.level": "alert",
"log.offset": 0,
"network.application": "dns client",
+ "network.direction": "outbound",
"network.iana_number": 17,
"network.protocol": "dns",
"network.transport": "udp", |
andrewstucki
pushed a commit
to andrewstucki/beats
that referenced
this pull request
Dec 10, 2020
…directionality based off of zones (elastic#23068) * [Filebeat] Allow cisco/asa and cisco/ftd modules to override network directionality based off of zones * Add changelog entry * Don't override categorization if no zone set * regenerate golden files (cherry picked from commit 76b7c8c)
6 tasks
andrewstucki
pushed a commit
that referenced
this pull request
Dec 10, 2020
…odules to override network directionality based off of zones (#23084) * [Filebeat] Allow cisco/asa and cisco/ftd modules to override network directionality based off of zones (#23068) * [Filebeat] Allow cisco/asa and cisco/ftd modules to override network directionality based off of zones * Add changelog entry * Don't override categorization if no zone set * regenerate golden files (cherry picked from commit 76b7c8c) * Fix up changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This adopts the same logic as #22998 by classifying internal/external/inbound/outbound traffic based off of zones. The implementation is similar to #23066 in that the zone-based classification is off by default, since the cisco logs already classify inbound/outbound for you.
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Related issues