Upgrade cef to ecs 1.8.0. (#23832)

Co-authored-by: Adrian Serrano <[email protected]>
elastic · Feb 9, 2021 · 0f50842 · 0f50842
1 parent 3d31953
commit 0f50842
Show file tree

Hide file tree

Showing 4 changed files with 53 additions and 9 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -833,6 +833,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Update Filebeat auditd dataset to ECS 1.8.0. {pull}23723[23723] {issue}23118[23118]
 - Updated microsoft defender_atp and m365_defender to ECS 1.8. {pull}23897[23897] {issue}23118[23118]
 - Updated o365 module to ECS 1.8. {issue}23118[23118] {pull}23896[23896]
+- Upgrade CEF module to ECS 1.8.0. {pull}23832[23832]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/cef/log/config/input.yml b/x-pack/filebeat/module/cef/log/config/input.yml
@@ -28,7 +28,7 @@ processors:
   - add_fields:
       target: ''
       fields:
-        ecs.version: 1.7.0
+        ecs.version: 1.8.0
 
 {{ if .external_zones }}
   - add_fields:

diff --git a/x-pack/filebeat/module/cef/log/ingest/pipeline.yml b/x-pack/filebeat/module/cef/log/ingest/pipeline.yml
@@ -52,35 +52,48 @@ processors:
   - append:
         field: related.hash
         value: "{{cef.extensions.fileHash}}"
-        if: "ctx?.cef?.extensions?.fileHash != null"
+        allow_duplicates: false
+        if: "ctx?.cef?.extensions?.fileHash != null && ctx?.cef?.extensions?.fileHash != ''"
   - append:
         field: related.hash
         value: "{{cef.extensions.oldFileHash}}"
-        if: "ctx?.cef?.extensions?.oldFileHash != null"
+        allow_duplicates: false
+        if: "ctx?.cef?.extensions?.oldFileHash != null && ctx?.cef?.extensions?.oldFileHash != ''"
   - append:
         field: related.ip
         value: "{{destination.ip}}"
-        if: "ctx?.destination?.ip != null"
+        allow_duplicates: false
+        if: "ctx?.destination?.ip != null && ctx?.destination?.ip != ''"
   - append:
         field: related.ip
         value: "{{destination.nat.ip}}"
-        if: "ctx?.destination?.nat?.ip != null"
+        allow_duplicates: false
+        if: "ctx?.destination?.nat?.ip != null && ctx?.destination?.nat?.ip != ''"
   - append:
         field: related.ip
         value: "{{source.ip}}"
-        if: "ctx?.source?.ip != null"
+        allow_duplicates: false
+        if: "ctx?.source?.ip != null && ctx?.source?.ip != ''"
   - append:
         field: related.ip
         value: "{{source.nat.ip}}"
-        if: "ctx?.source?.nat?.ip != null"
+        allow_duplicates: false
+        if: "ctx?.source?.nat?.ip != null && ctx?.source?.nat?.ip != ''"
   - append:
         field: related.user
         value: "{{destination.user.name}}"
-        if: "ctx?.destination?.user?.name != null"
+        allow_duplicates: false
+        if: "ctx?.destination?.user?.name != null && ctx?.destination?.user?.name != ''"
   - append:
         field: related.user
         value: "{{source.user.name}}"
-        if: "ctx?.source?.user?.name != null"
+        allow_duplicates: false
+        if: "ctx?.source?.user?.name != null && ctx?.source?.user?.name != ''"
+  - append:
+        field: related.hosts
+        value: "{{observer.hostname}}"
+        allow_duplicates: false
+        if: "ctx?.observer?.hostname != null && ctx?.observer?.hostname != ''"
   - pipeline:
         name: '{< IngestPipeline "fp-pipeline" >}'
         if: "ctx.cef?.device?.vendor == 'FORCEPOINT'"

diff --git a/x-pack/filebeat/module/cef/log/test/fp-ngfw-smc.log-expected.json b/x-pack/filebeat/module/cef/log/test/fp-ngfw-smc.log-expected.json
@@ -27,6 +27,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "6.6.1",
+        "related.hosts": [
+            "10.1.1.40"
+        ],
         "service.type": "cef",
         "tags": [
             "cef",
@@ -61,6 +64,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "6.6.1",
+        "related.hosts": [
+            "10.1.1.40"
+        ],
         "service.type": "cef",
         "tags": [
             "cef",
@@ -108,6 +114,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "6.6.1",
+        "related.hosts": [
+            "10.1.1.40"
+        ],
         "related.ip": [
             "10.1.1.40",
             "10.37.205.252"
@@ -161,6 +170,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "unknown",
+        "related.hosts": [
+            "10.1.1.10"
+        ],
         "related.ip": [
             "255.255.255.255",
             "172.16.1.1"
@@ -214,6 +226,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "unknown",
+        "related.hosts": [
+            "10.1.1.1"
+        ],
         "related.ip": [
             "192.168.1.1",
             "172.16.1.1"
@@ -264,6 +279,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "unknown",
+        "related.hosts": [
+            "10.1.1.6"
+        ],
         "related.user": [
             "alice"
         ],
@@ -304,6 +322,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "unknown",
+        "related.hosts": [
+            "10.1.1.3"
+        ],
         "related.ip": [
             "192.168.1.1"
         ],
@@ -347,6 +368,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "unknown",
+        "related.hosts": [
+            "10.1.1.10"
+        ],
         "related.ip": [
             "192.168.1.1"
         ],
@@ -390,6 +414,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "unknown",
+        "related.hosts": [
+            "10.1.1.8"
+        ],
         "related.ip": [
             "172.16.2.1"
         ],
@@ -432,6 +459,9 @@
         "observer.product": "Firewall",
         "observer.vendor": "FORCEPOINT",
         "observer.version": "6.6.1",
+        "related.hosts": [
+            "10.1.1.40"
+        ],
         "service.type": "cef",
         "tags": [
             "cef",