Skip to content

aws using invalid field values according to ECS #3044

@jsoriano

Description

@jsoriano
[0] parsing field value failed: field "event.category"'s value "network_traffic" is not one of the allowed values (authentication, configuration, database, driver, file, host, iam, intrusion_detection, malware, network, package, process, registry, session, threat, web)
[1] parsing field value failed: field "event.outcome"'s value "allow" is not one of the allowed values (failure, success, unknown)
[2] parsing field value failed: field "event.outcome"'s value "deny" is not one of the allowed values (failure, success, unknown)
[3] parsing field value failed: field "event.type"'s value "flow" is not one of the allowed values (access, admin, allowed, change, connection, creation, deletion, denied, end, error, group, indicator, info, installation, protocol, start, user)

"network_traffic" => "network"
"allow" => "success"
"deny" => "failure"
"flow" => "connection"?

Part of #3016

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions