Skip to content

Commit

Permalink
checkpoint: Make checkpoint.source_object a keyword
Browse files Browse the repository at this point in the history
According to https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144192,
Check Point module field checkpoint.source_object should be mapped as a string type instead of long.

Syncs change from:
elastic/beats@a5e6e5b

Relates: elastic/beats#25124
  • Loading branch information
andrewkroh committed Mar 31, 2022
1 parent 2aee5ee commit 1902d0a
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 5 deletions.
8 changes: 4 additions & 4 deletions packages/checkpoint/data_stream/firewall/fields/fields.yml
Original file line number Diff line number Diff line change
Expand Up @@ -571,7 +571,8 @@
Number of files that were not scanned due to an error.
- name: next_scheduled_scan_date
type: keyword
description: "Next scan scheduled time according to time object. \n"
description: |
Next scan scheduled time according to time object.
- name: dlp_repository_scanned_total_size
type: integer
description: |
Expand Down Expand Up @@ -1257,7 +1258,7 @@
description: |
Reports whether watermark is added to the cleaned file.
- name: source_object
type: integer
type: keyword
description: |
Matched object name on source column.
- name: destination_object
Expand Down Expand Up @@ -1299,9 +1300,8 @@
- name: action_reason_msg
type: keyword
overwrite: true
description: >
description: |
Connection drop reason message.
- name: c_bytes
type: integer
description: |
Expand Down
2 changes: 1 addition & 1 deletion packages/checkpoint/docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -426,7 +426,7 @@ An example event for `firewall` looks as following:
| checkpoint.sip_reason | Explains why 'source_ip' isn't allowed to redirect (handover). | keyword |
| checkpoint.site_name | Site name. | keyword |
| checkpoint.source_interface | External Interface name for source interface or Null if not found. | keyword |
| checkpoint.source_object | Matched object name on source column. | integer |
| checkpoint.source_object | Matched object name on source column. | keyword |
| checkpoint.source_os | OS which generated the attack. | keyword |
| checkpoint.special_properties | If this field is set to '1' the log will not be shown (in use for monitoring scan progress). | integer |
| checkpoint.specific_data_type_name | Compound/Group scenario, data type that was matched. | keyword |
Expand Down

0 comments on commit 1902d0a

Please sign in to comment.