Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] sync checkpoint module with Fleet integration #31076

Merged
merged 5 commits into from
Apr 5, 2022
Merged

[Filebeat] sync checkpoint module with Fleet integration #31076

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
81bbaa2
Sync Check Point module with Fleet integration
andrewkroh Mar 31, 2022
84e9893
Remove duplicated checkpoint.trusted_domain
andrewkroh Mar 31, 2022
0e4c645
Add overwrite: true for checkpoint.update_status
andrewkroh Mar 31, 2022
e383f18
Merge remote-tracking branch 'elastic/main' into feature/filebeat/syn…
andrewkroh Apr 4, 2022
c95a117
Merge branch 'main' into feature/filebeat/sync-check-point
mergify[bot] Apr 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
- threatintel module: Add new Recorded Future integration. {pull}30030[30030]
- Improve recovery from corrupted registries. {issue}25135[25135] {pull}30994[30994]
- Add support in httpjson input for chain calls. {pull}29816[29816]
- checkpoint module: Add `network.transport` derived from IANA number. {pull}31076[31076]

*Auditbeat*

Expand Down
34 changes: 34 additions & 0 deletions filebeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20689,6 +20689,40 @@ type: keyword
In case of phishing event, the domain, which the attacker was impersonating.


type: keyword

--

*`checkpoint.comment`*::
+
--
type: keyword

--

*`checkpoint.conn_direction`*::
+
--
Connection direction

type: keyword

--

*`checkpoint.db_ver`*::
+
--
Database version

type: keyword

--

*`checkpoint.update_status`*::
+
--
Status of database update

type: keyword

--
Expand Down
2 changes: 1 addition & 1 deletion x-pack/filebeat/module/checkpoint/fields.go
View file
Open in desktop

Large diffs are not rendered by default.

16 changes: 16 additions & 0 deletions x-pack/filebeat/module/checkpoint/firewall/_meta/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2421,3 +2421,19 @@
overwrite: true
description: >
In case of phishing event, the domain, which the attacker was impersonating.

- name: comment
type: keyword

- name: conn_direction
type: keyword
description: Connection direction

- name: db_ver
type: keyword
description: Database version

- name: update_status
type: keyword
overwrite: true
description: Status of database update
4 changes: 0 additions & 4 deletions x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,10 +25,6 @@ publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}

processors:
- add_locale: ~
- add_fields:
target: ''
fields:
ecs.version: 1.12.0
Comment on lines -28 to -31
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What was this?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It added ecs.version to the outgoing event. This is now being set as part of the ingest pipeline with a set processor.

{{ if .external_zones }}
- add_fields:
target: _temp_
Expand Down
Loading