-
Notifications
You must be signed in to change notification settings - Fork 562
[AWS VPC Flow] Support newer VPC log formats #14835
Copy link
Copy link
Closed
Labels
Integration:awsAWSAWSTeam:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]enhancementNew feature or requestNew feature or request
Metadata
Metadata
Assignees
Labels
Integration:awsAWSAWSTeam:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]enhancementNew feature or requestNew feature or request
Type
Fields
Give feedbackNo fields configured for issues without a type.
Our current VPC flow log integration supports version 5, which is now outdated. AWS has since released versions 6 and 7, introducing new metadata fields for Transit Gateway and ECS workloads. To stay current and provide more complete visibility, our integration should be updated to support and normalize these additional fields where applicable.
Version 6
This was introduced to provide enhanced visibility for AWS Transit Gateway (TGW) flows. It adds 18 new fields related to TGW-specific metadata, making it easier to analyze traffic that crosses and connects through Transit Gateway architectures
Version 7
This version was introduced to surface metadata for workloads running on Amazon Elastic Container Service (ECS). It adds 10 new ECS-specific fields, including:
ecs-cluster-arn, ecs-cluster-nameecs-task-id, ecs-task-arnecs-task-definition-arn, ecs-service-nameecs-container-id, ecs-second-container-idCan we please update our integration with VPC flow to ensure we're up to date with the latest formats, and claim support for v6 and v7 log formats.