Skip to content

[Filebeat] Add network direction processor to Zeek and Suricata modules #24620

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Jun 29, 2021
Merged

[Filebeat] Add network direction processor to Zeek and Suricata modules #24620

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
72fcec7
Add network direction processor to zeek and suricata module
legoguy1000 Mar 24, 2021
775f39c
Add Snort & Sonicwall
legoguy1000 Mar 28, 2021
3ab6fea
update changelog
legoguy1000 Apr 2, 2021
62c7a6f
use ES network_direction processor
legoguy1000 Apr 28, 2021
0966bf5
Revert "use ES network_direction processor"
legoguy1000 May 13, 2021
7a4381c
update docs with new variable
legoguy1000 May 18, 2021
f39206f
Merge branch 'master' into add-network-directions
P1llus Jun 18, 2021
854d181
Merge branch 'master' into add-network-directions
P1llus Jun 24, 2021
0ae35f0
Removed Snort and Sonicwall
legoguy1000 Jun 25, 2021
6b8ad36
update docs
legoguy1000 Jun 25, 2021
28e08cc
missed one
legoguy1000 Jun 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -809,6 +809,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Add new grok pattern for iptables module for Ubiquiti UDM {issue}25615[25615] {pull}25616[25616]
- Add multiline support to aws-s3 input. {issue}25249[25249] {pull}25710[25710]
- Add monitoring metrics to the `aws-s3` input. {pull}25711[25711]
- Added `network.direction` fields to Zeek and Suricata modules using the `add_network_direction` processor {pull}24620[24620]
- Add Content-Type override to aws-s3 input. {issue}25697[25697] {pull}25772[25772]
- In Cisco Umbrella fileset add users from cisco.umbrella.identities to related.user. {pull}25776[25776]
- Add fingerprint processor to generate fixed ids for `google_workspace` events. {pull}25841[25841]
Expand Down
9 changes: 9 additions & 0 deletions filebeat/docs/modules/suricata.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,15 @@ A list of tags to include in events. Including `forwarded` indicates that the
events did not originate on this host and causes `host.name` to not be added to
events. Defaults to `[suricata]`.

`var.internal_networks`::

A list of CIDR ranges describing the IP addresses that
you consider internal. This is used in determining the value of
`network.direction`. The values
can be either a CIDR value or one of the named ranges supported by the
<<condition-network, `network`>> condition. The default value is `[private]`
which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal.

[float]
=== Example dashboard

Expand Down
Loading