Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] auditd network.direction should use inbound/outbound #12445

Closed
andrewkroh opened this issue Jun 5, 2019 · 2 comments · Fixed by #20695
Closed

[Auditbeat] auditd network.direction should use inbound/outbound #12445

andrewkroh opened this issue Jun 5, 2019 · 2 comments · Fixed by #20695
Assignees
@leehinman
Labels
Auditbeat bug ecs

Comments

@andrewkroh
Copy link
Member

As per ECS the network.direction values should be inbound or outbound or unknown.

https://github.com/elastic/ecs/blob/v1.0.1/schemas/network.yml#L88-L92

But the auditd modules uses incoming and outgoing for audit events that include a socket message.

beats/vendor/github.com/elastic/go-libaudit/aucoalesce/coalesce.go

Lines 112 to 120 in 6c55de4

func (d Direction) String() string {
switch d {
case IncomingDir:
return "incoming"
case OutgoingDir:
return "outgoing"
}
return "unknown"
}

@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@andrewkroh andrewkroh mentioned this issue Feb 11, 2020
Closed
51 tasks
@leehinman leehinman self-assigned this Aug 17, 2020
@leehinman
Copy link
Contributor

elastic/go-libaudit#76

@leehinman leehinman mentioned this issue Aug 19, 2020
Merged
2 tasks
leehinman added a commit to leehinman/beats that referenced this issue Aug 20, 2020
@leehinman
upgrade to go-libaudit 2.0.2
8e39a5f 
- changes network.direction to use ECS recommended values
  of inbound & outbound

Closes elastic#12445
leehinman added a commit that referenced this issue Aug 20, 2020
@leehinman
[Auditbeat] upgrade to go-libaudit 2.0.2 (#20695)
98d3925 
* upgrade to go-libaudit 2.0.2

- changes network.direction to use ECS recommended values
  of inbound & outbound

Closes #12445
@leehinman leehinman mentioned this issue Aug 20, 2020
Merged
2 tasks
leehinman added a commit to leehinman/beats that referenced this issue Aug 20, 2020
@leehinman
[Auditbeat] upgrade to go-libaudit 2.0.2 (elastic#20695)
b115b89 
* upgrade to go-libaudit 2.0.2

- changes network.direction to use ECS recommended values
  of inbound & outbound

Closes elastic#12445

(cherry picked from commit 98d3925)
andrewkroh pushed a commit that referenced this issue Aug 24, 2020
@leehinman
[Auditbeat] upgrade to go-libaudit 2.0.2 (#20695) (#20711)
ea712b7 
* upgrade to go-libaudit 2.0.2

- changes network.direction to use ECS recommended values
  of inbound & outbound

Closes #12445

(cherry picked from commit 98d3925)
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this issue Oct 14, 2020
@leehinman @melchiormoulin
[Auditbeat] upgrade to go-libaudit 2.0.2 (elastic#20695)
c11e716 
* upgrade to go-libaudit 2.0.2

- changes network.direction to use ECS recommended values
  of inbound & outbound

Closes elastic#12445
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@leehinman leehinman

Labels
Auditbeat bug ecs
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Auditbeat] upgrade to go-libaudit 2.0.2 leehinman/beats
4 participants
@andresrc @andrewkroh @elasticmachine @leehinman