[Filebeat] Add network.direction by specifying internal_networks to gcp module#23081
Merged
andrewstucki merged 5 commits intoelastic:masterfrom Dec 10, 2020
Merged
[Filebeat] Add network.direction by specifying internal_networks to gcp module#23081andrewstucki merged 5 commits intoelastic:masterfrom
andrewstucki merged 5 commits intoelastic:masterfrom
Conversation
Contributor
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
Contributor
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
Steps errors
Expand to view the steps failures
|
| Test | Results |
|---|---|
| Failed | 0 |
| Passed | 17405 |
| Skipped | 1379 |
| Total | 18784 |
Author
|
To show this as working. Making this change to the default firewall fileset configuration: diff --git a/x-pack/filebeat/module/gcp/firewall/manifest.yml b/x-pack/filebeat/module/gcp/firewall/manifest.yml
index d5f684c87..00084d649 100644
--- a/x-pack/filebeat/module/gcp/firewall/manifest.yml
+++ b/x-pack/filebeat/module/gcp/firewall/manifest.yml
@@ -18,6 +18,7 @@ var:
- name: tags
default: [forwarded]
- name: internal_networks
+ default: ["10.128.0.0/8"]
ingest_pipeline: ingest/pipeline.yml
input: config/input.ymldiff --git a/x-pack/filebeat/module/gcp/firewall/test/test.log-expected.json b/x-pack/filebeat/module/gcp/firewall/test/test.log-expected.json
index 908b2436b..9b1b1fe50 100644
--- a/x-pack/filebeat/module/gcp/firewall/test/test.log-expected.json
+++ b/x-pack/filebeat/module/gcp/firewall/test/test.log-expected.json
@@ -977,7 +977,7 @@
"log.logger": "projects/test-beats/logs/compute.googleapis.com%2Ffirewall",
"log.offset": 14407,
"network.community_id": "1:DAX43chSGct8LhjTchX9JgmQSEE=",
- "network.direction": "internal",
+ "network.direction": "inbound",
"network.iana_number": 6,
"network.name": "default",
"network.transport": "tcp",And to for the vpcflow fileset (don't worry about the weird CIDRs, it's just to show the override): diff --git a/x-pack/filebeat/module/gcp/vpcflow/manifest.yml b/x-pack/filebeat/module/gcp/vpcflow/manifest.yml
index 1f67548e0..a11478136 100644
--- a/x-pack/filebeat/module/gcp/vpcflow/manifest.yml
+++ b/x-pack/filebeat/module/gcp/vpcflow/manifest.yml
@@ -16,6 +16,7 @@ var:
- name: tags
default: [forwarded]
- name: internal_networks
+ default: [203.0.0.0/8]diff --git a/x-pack/filebeat/module/gcp/vpcflow/test/vpc-flow-log-entries.json.log-expected.json b/x-pack/filebeat/modul
e/gcp/vpcflow/test/vpc-flow-log-entries.json.log-expected.json
index b9d0250b9..813ce69da 100644
--- a/x-pack/filebeat/module/gcp/vpcflow/test/vpc-flow-log-entries.json.log-expected.json
+++ b/x-pack/filebeat/module/gcp/vpcflow/test/vpc-flow-log-entries.json.log-expected.json
@@ -32,7 +32,7 @@
"log.offset": 0,
"network.bytes": 1776,
"network.community_id": "1:Eav+HA4T0zQk7MDzMdHH6Hhsx2A=",
- "network.direction": "outbound",
+ "network.direction": "inbound",
"network.iana_number": "6",
"network.name": "default",
"network.packets": 7, |
leehinman
reviewed
Dec 10, 2020
Contributor
leehinman
left a comment
There was a problem hiding this comment.
for firewall, this would be a breaking change, but should we switch the default inbound/outbound to ingress/egress? the original event uses ingress/egress
Author
|
@leehinman so, I'd stick with inbound/outbound for this one since it seems to be less about data coming into a firewall host as a final destination (i.e. ingress) v. inbound traffic into a network perimeter that the firewall is sitting in front of. |
leehinman
approved these changes
Dec 10, 2020
andrewstucki
pushed a commit
to andrewstucki/beats
that referenced
this pull request
Dec 10, 2020
…cp module (elastic#23081) * [Filebeat] Add network.direction by specifying internal_networks to gcp module * Fix up changelog * Fix pipeline builder * Add forgotten documentation (cherry picked from commit ce73772)
6 tasks
andrewstucki
pushed a commit
that referenced
this pull request
Dec 11, 2020
…ying internal_networks to gcp module (#23086) * [Filebeat] Add network.direction by specifying internal_networks to gcp module (#23081) * [Filebeat] Add network.direction by specifying internal_networks to gcp module * Fix up changelog * Fix pipeline builder * Add forgotten documentation (cherry picked from commit ce73772) * Fix up changelog
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This uses the new
add_network_directionprocessor to override how we calculate the eventnetwork.direction. It allows users to specify what CIDR block ranges/ip address types consist of their "internal" network regardless of how GCP characterizes traffic.Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Related issues