-
Notifications
You must be signed in to change notification settings - Fork 76
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Meta] Security Analytics Custom Log Types support #459
Labels
Comments
This was referenced Jun 16, 2023
5 tasks
getsaurabh02
changed the title
[Meta] Security Analytics OCSF integration & Custom Log Types support
[Meta] Security Analytics Custom Log Types support
Jul 13, 2023
We already merged the OCSF integration as part of #447 |
Full ECS support would be nice as well. When trying to load the whole ECS schema component templates a couple of weeks ago Opensearch didn't support a couple of field types. |
@getsaurabh02 Should this be marked for 2.11? |
Added support for custom log types in 2.10 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
linked issue #447
Tasks:
1. Define new LogType(JSON) structure which holds log type's name, description and field mappings. For pre-packaged rules there should be set of files(1 file per log type) stored on disk. On Security Analytics startup, load these files into system index:
.opensearch-sap-log-types-config
.2. User-defined(Custom) log types. Provide CRUD API for user to define its own custom log type. Custom log type will be defined by new LogType structure defined in first task and stored in
.opensearch-sap-log-types-config
index. Replace DetectorType enum with class which loads detector types(log types) from.opensearch-sap-log-types-config
.3. Modify existing Mappings APIs to utilize new JSON structure defined in first task, instead of mapping.json files.
4. Implement auto-detection of mapping schema(ECS, OCSF) used in log index.
The text was updated successfully, but these errors were encountered: