[Filebeat] zeek ecs 1.7 updates for network.direction

[leehinman]

What does this PR do?

prevents setting network.direction to external if local_orig and local_resp are both undefined

Why is it important?

data accuracy

Checklist

• My code follows the style guidelines of this project
  - [ ] I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=zeek TESTING_FILEBEAT_FILESETS=connection mage -v pythonIntegTest

Related issues

• Relates [ECS] Upgrade modules to 1.7 #21674

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #22967 updated

• Start Time: 2020-12-10T19:32:08.361+0000

• Duration: 68 min 19 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2422
Skipped	261
Total	2683

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	2422
Skipped	261
Total	2683

[andrewstucki]

So, wondering what these fields equate to in practice? I'm assuming that they're generally about inbound/outbound network connections that are destined for the host that zeek is running on, right? If so, I'd actually switch this to use ingress/egress. The inbound/outbound stuff is when you're modeling around a network perimeter, like if you have a network firewall or something.

[leehinman]

From zeek docs:

local_orig: bool
If the connection is originated locally, this value will be T. If it was originated remotely it will be F. In the case that the Site::local_nets variable is undefined, this field will be left empty at all times.

local_resp: bool
If the connection is responded to locally, this value will be T. If it was responded to remotely it will be F. In the case that the Site::local_nets variable is undefined, this field will be left empty at all times.

So I think inbound/outbound are the right pairs, since you have to define local_nets variable and traffic doesn't have to be to/from the zeek host.