[Security Solution] Source.ip array values cause SIEM - Network - http tab to crash with ip.replace is not a function error #110844
Assignees
Labels
bug
Fixes for quality problems that affect the customer experience
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Team:Threat Hunting:Explore
Team:Threat Hunting
Security Solution Threat Hunting Team
v7.17.0
Comments
TheRiffRafi
added
bug
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
FrankHassanabad
added
the
Team:Threat Hunting
|
Pinging @elastic/security-threat-hunting (Team:Threat Hunting) |
1 task
|
@karanbirsingh-qasource can you please validate the fix of this issue on 7.16 BC4? Thanks :) |
|
we have validated this issue on 7.16.0 BC4 Self Managed and found that issue is still occuring 🔴 on adding the mentioned test index under network data source. Build Details: Screen-Cast: network.mp4 |
|
I believe that error is happening because their mappings are incorrect. |
|
ok, posting the full correct ECS mapping for the source/destination fields corrects this issue: MappingPUT httptest1/_mapping
{
"properties": {
"source": {
"properties": {
"address": {
"type": "keyword",
"ignore_above": 1024
},
"as": {
"properties": {
"number": {
"type": "long"
},
"organization": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
}
}
}
}
},
"bytes": {
"type": "long"
},
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
"type": "keyword",
"ignore_above": 1024
},
"continent_code": {
"type": "keyword",
"ignore_above": 1024
},
"continent_name": {
"type": "keyword",
"ignore_above": 1024
},
"country_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"country_name": {
"type": "keyword",
"ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"postal_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_name": {
"type": "keyword",
"ignore_above": 1024
},
"timezone": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"ip": {
"type": "ip"
},
"mac": {
"type": "keyword",
"ignore_above": 1024
},
"nat": {
"properties": {
"ip": {
"type": "ip"
},
"port": {
"type": "long"
}
}
},
"packets": {
"type": "long"
},
"port": {
"type": "long"
},
"registered_domain": {
"type": "keyword",
"ignore_above": 1024
},
"service": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"subdomain": {
"type": "keyword",
"ignore_above": 1024
},
"top_level_domain": {
"type": "keyword",
"ignore_above": 1024
},
"user": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"email": {
"type": "keyword",
"ignore_above": 1024
},
"full_name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"group": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"hash": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"roles": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"host": {
"properties":{
"name":{
"type": "keyword"
}
}
},
"destination": {
"properties": {
"address": {
"type": "keyword",
"ignore_above": 1024
},
"as": {
"properties": {
"number": {
"type": "long"
},
"organization": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
}
}
}
}
},
"bytes": {
"type": "long"
},
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
"type": "keyword",
"ignore_above": 1024
},
"continent_code": {
"type": "keyword",
"ignore_above": 1024
},
"continent_name": {
"type": "keyword",
"ignore_above": 1024
},
"country_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"country_name": {
"type": "keyword",
"ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"postal_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_name": {
"type": "keyword",
"ignore_above": 1024
},
"timezone": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"ip": {
"type": "ip"
},
"mac": {
"type": "keyword",
"ignore_above": 1024
},
"nat": {
"properties": {
"ip": {
"type": "ip"
},
"port": {
"type": "long"
}
}
},
"packets": {
"type": "long"
},
"port": {
"type": "long"
},
"registered_domain": {
"type": "keyword",
"ignore_above": 1024
},
"service": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"subdomain": {
"type": "keyword",
"ignore_above": 1024
},
"top_level_domain": {
"type": "keyword",
"ignore_above": 1024
},
"user": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"email": {
"type": "keyword",
"ignore_above": 1024
},
"full_name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"group": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"hash": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"roles": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"@timestamp": {
"type": "date",
"store": true
},
"url": {
"properties": {
"path": {
"type": "keyword"
},
"domain": {
"type": "keyword"
}
}
},
"http": {
"properties": {
"request": {
"properties": {
"method": {
"type": "keyword"
}
}
},
"response": {
"properties": {
"status_code": {
"type": "keyword"
}
}
}
}
}
}
} |
|
thanks @stephmilovic for sharing the updated mapping however the issue is still occuring. we are getting below error on setting the test index.
Error Logs: Steps Followed : Created IndexPUT httptest1MappingPUT httptest1/_mapping
{
"properties": {
"source": {
"properties": {
"address": {
"type": "keyword",
"ignore_above": 1024
},
"as": {
"properties": {
"number": {
"type": "long"
},
"organization": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
}
}
}
}
},
"bytes": {
"type": "long"
},
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
"type": "keyword",
"ignore_above": 1024
},
"continent_code": {
"type": "keyword",
"ignore_above": 1024
},
"continent_name": {
"type": "keyword",
"ignore_above": 1024
},
"country_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"country_name": {
"type": "keyword",
"ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"postal_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_name": {
"type": "keyword",
"ignore_above": 1024
},
"timezone": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"ip": {
"type": "ip"
},
"mac": {
"type": "keyword",
"ignore_above": 1024
},
"nat": {
"properties": {
"ip": {
"type": "ip"
},
"port": {
"type": "long"
}
}
},
"packets": {
"type": "long"
},
"port": {
"type": "long"
},
"registered_domain": {
"type": "keyword",
"ignore_above": 1024
},
"service": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"subdomain": {
"type": "keyword",
"ignore_above": 1024
},
"top_level_domain": {
"type": "keyword",
"ignore_above": 1024
},
"user": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"email": {
"type": "keyword",
"ignore_above": 1024
},
"full_name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"group": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"hash": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"roles": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"host": {
"properties":{
"name":{
"type": "keyword"
}
}
},
"destination": {
"properties": {
"address": {
"type": "keyword",
"ignore_above": 1024
},
"as": {
"properties": {
"number": {
"type": "long"
},
"organization": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
}
}
}
}
},
"bytes": {
"type": "long"
},
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
"type": "keyword",
"ignore_above": 1024
},
"continent_code": {
"type": "keyword",
"ignore_above": 1024
},
"continent_name": {
"type": "keyword",
"ignore_above": 1024
},
"country_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"country_name": {
"type": "keyword",
"ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
"type": "keyword",
"ignore_above": 1024
},
"postal_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_iso_code": {
"type": "keyword",
"ignore_above": 1024
},
"region_name": {
"type": "keyword",
"ignore_above": 1024
},
"timezone": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"ip": {
"type": "ip"
},
"mac": {
"type": "keyword",
"ignore_above": 1024
},
"nat": {
"properties": {
"ip": {
"type": "ip"
},
"port": {
"type": "long"
}
}
},
"packets": {
"type": "long"
},
"port": {
"type": "long"
},
"registered_domain": {
"type": "keyword",
"ignore_above": 1024
},
"service": {
"properties": {
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"subdomain": {
"type": "keyword",
"ignore_above": 1024
},
"top_level_domain": {
"type": "keyword",
"ignore_above": 1024
},
"user": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"email": {
"type": "keyword",
"ignore_above": 1024
},
"full_name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"group": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024
}
}
},
"hash": {
"type": "keyword",
"ignore_above": 1024
},
"id": {
"type": "keyword",
"ignore_above": 1024
},
"name": {
"type": "keyword",
"ignore_above": 1024,
"fields": {
"text": {
"type": "match_only_text"
}
}
},
"roles": {
"type": "keyword",
"ignore_above": 1024
}
}
}
}
},
"@timestamp": {
"type": "date",
"store": true
},
"url": {
"properties": {
"path": {
"type": "keyword"
},
"domain": {
"type": "keyword"
}
}
},
"http": {
"properties": {
"request": {
"properties": {
"method": {
"type": "keyword"
}
}
},
"response": {
"properties": {
"status_code": {
"type": "keyword"
}
}
}
}
}
}
}Created DocumentPUT httptest1/_doc/106
{
"destination": {
"geo": {
"continent_name": "North America",
"region_iso_code": "US-FL",
"city_name": "Celebration",
"country_iso_code": "US",
"country_name": "United States",
"region_name": "Florida",
"location": {
"lon": -98.4935,
"lat": 29.4247
}
},
"as": {
"number": 8015,
"organization": {
"name": "Some Org"
}
},
"bytes": 754,
"ip":
"22.222.22.222"
},
"source": {
"bytes": 1666,
"ip": [
"111.11.111.11"
]
},
"host": {
"name": "host.domain.com"
},
"url": {
"original": "web.domain.com/path/to/whatever",
"path": "/path/to/whatever",
"domain": "domain.com"
},
"@timestamp": "2021-09-01T13:09:47.000Z",
"http": {
"request": {
"referrer": "None",
"method":["Allowed","POST"]
},
"response":{
"status_code": 200
}
}
}Screen-Cast: file.mp4please let us known if we are missing something. thanks !! |
|
@karanbirsingh-qasource can you please try to change the |
|
we have validated this issue on 8.0.0-SNAPSHOT with the updated mapping and found it Fixed 🟢 . No Error faced on network page for mentioned custom index. Build Details: Snap-Shoot: status_code.mp4Hence we are closing this issue. thanks !! |
ghost
closed this as
|
we have validated this issue on Build Details: Snap-Shoot: We are pending to validated this issue on cloud , if you think it is not required please feel to close the issue. thanks !! |
This issue was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug:
If the source.ip field in an index being referenced by the "Network" section under SIEM contains an array value, the http tab causes the section to crash:
Kibana/Elasticsearch Stack version: 7.14.0
Functional Area (e.g. Endpoint management, timelines, resolver, etc.): SIEM
Steps to reproduce:
Mapping
Create document
Create index pattern for index.
Navigate to Kibana -> SIEM -> Network.
Modify the "Data Sources" drop down to include the test index pattern.
Click on "Http" tab, and get the ip.replace is not a function error.
Current behavior:
http tab crashes SIEM app.
Expected behavior:
http tab is able to handle array values for source.ip field.
Screenshots (if relevant):
Provide logs and/or server output (if relevant):
full stack
The text was updated successfully, but these errors were encountered: