Skip to content

Commit

Permalink
Missing changes for Cisco FTD (#13286) (#13379)
Browse files Browse the repository at this point in the history
* Rename docs section to Field Mappings

* Add explanatory comment to the generator
  • Loading branch information
adriansr authored Aug 28, 2019
1 parent 0a065f5 commit ebdc4c2
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 2 deletions.
2 changes: 1 addition & 1 deletion filebeat/docs/modules/cisco.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,7 @@ The Cisco FTD fileset primarily supports parsing IPv4 and IPv6 access list log
messages similar to that of ASA devices as well as Security Event Syslog
Messages for Intrusion, Connection, File and Malware events.

*ECS Field mapping*
*Field mappings*

The `ftd` fileset maps Security Event Syslog Messages to the Elastic Common
Schema (ECS) format. The following table illustrates the mapping from
Expand Down
2 changes: 1 addition & 1 deletion x-pack/filebeat/module/cisco/_meta/docs.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ The Cisco FTD fileset primarily supports parsing IPv4 and IPv6 access list log
messages similar to that of ASA devices as well as Security Event Syslog
Messages for Intrusion, Connection, File and Malware events.

*ECS Field mapping*
*Field mappings*

The `ftd` fileset maps Security Event Syslog Messages to the Elastic Common
Schema (ECS) format. The following table illustrates the mapping from
Expand Down
9 changes: 9 additions & 0 deletions x-pack/filebeat/module/cisco/shared/gen.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,14 @@

package shared

// These generators will output the following files for the FTD:
// - ecs-mapping-processor.yml, an ingest pipeline processor that maps FTD
// security event fields to ECS.
// - ecs-mapping-docs.asciidoc, asciidoc tables to document those mappings.
//
// This files are not picked up by the FTD module. When generated, you need to
// manually update the pipeline in ingest/asa-ftd-pipeline.yml
// and the asciidoc tables into ../_meta/docs.asciidoc.

//go:generate go run gen-ftd-ecs-mapping.go stringset.go -output ecs-mapping-processor.yml security-mappings.csv
//go:generate go run gen-ecs-mapping-docs.go stringset.go -output ecs-mapping-docs.asciidoc security-mappings.csv

0 comments on commit ebdc4c2

Please sign in to comment.