Skip to content

Add network.direction classification to rsa2elk modules #23114

@andrewstucki

Description

@andrewstucki

Describe the enhancement:

In order to support network.direction setting in our rsa2elk modules, we can leverage the new add_network_direction processor in any of our modules that use "perimeter"-based network models (i.e. firewalls, etc.). Currently however, all rsa2elk modules have the same module configuration. Since certain modules, such as AV modules, are "host"-based, we should have a way of making each module have the ability to leverage distinct configuration.

This issue is to track adding support for distinct configuration in the generated modules and also leveraging the new procssor for network.direction enrichment in the "perimeter"-based modules.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions