Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] Improve ECS categorization field mappings in misp module. #17344

Merged
merged 2 commits into from
Apr 20, 2020

Conversation

leehinman
Copy link
Contributor

What does this PR do?

Adds following ECS fields to Filebeat misp module.

  • event.id
  • event.kind
  • registry.key if indicator type regkey
  • rule.category
  • rule.description
  • rule.id
  • rule.uuid
  • user.name if indicator type github-username

Why is it important?

Mapping to ECS improves usability in SIEM app and across data sources.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

GENERATE=true TESTING_FILEBEAT_MODULES=misp mage -v pythonIntegTest

Related issues

Closes #16026

@leehinman leehinman added enhancement Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. Team:SIEM ecs labels Mar 30, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

- event.id
- event.kind
- registry.key if indicator type regkey
- rule.category
- rule.description
- rule.id
- rule.uuid
- user.name if indicator type github-username

Closes elastic#16026
@leehinman leehinman force-pushed the 16026_misp_ecs_1.4 branch from 2176023 to 4c66d55 Compare March 30, 2020 21:29
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@leehinman leehinman merged commit fee1f15 into elastic:master Apr 20, 2020
@leehinman leehinman added v7.8.0 and removed needs_backport PR is waiting to be backported to other branches. labels Apr 20, 2020
leehinman added a commit to leehinman/beats that referenced this pull request Apr 20, 2020
)

- event.id
- event.kind
- registry.key if indicator type regkey
- rule.category
- rule.description
- rule.id
- rule.uuid
- user.name if indicator type github-username

Closes elastic#16026

(cherry picked from commit fee1f15)
@leehinman leehinman deleted the 16026_misp_ecs_1.4 branch April 21, 2020 13:18
leehinman added a commit that referenced this pull request Apr 21, 2020
…17845)

- event.id
- event.kind
- registry.key if indicator type regkey
- rule.category
- rule.description
- rule.id
- rule.uuid
- user.name if indicator type github-username

Closes #16026

(cherry picked from commit fee1f15)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Filebeat] Upgrade misp module to ECS 1.4
3 participants