Skip to content

[Filebeat] Threatintel compatibility updates #27323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
P1llus merged 9 commits into from
Sep 7, 2021
Merged

[Filebeat] Threatintel compatibility updates #27323

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
a0fcab1
First pass on updating filebeat threatintel logic for ECS 1.11
rylnd Aug 11, 2021
a65bb59
Move remaining modules from indicator.domain -> indicator.url.domain
rylnd Aug 11, 2021
9c44a14
Update indicator.reference in relevant modules
rylnd Aug 11, 2021
2b82431
Fix missing prefix in target field
rylnd Aug 11, 2021
d36ae86
linting and apply new testfiles
P1llus Sep 2, 2021
221da56
Run `make update` in filebeat
rylnd Sep 3, 2021
b1bbd3e
fixing duplicate fields
P1llus Sep 7, 2021
4e03962
mage fmt update
P1llus Sep 7, 2021
5d7443c
linting
P1llus Sep 7, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions filebeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152067,23 +152067,23 @@ type: keyword

--

*`threatintel.indicator.ip`*::
*`threatintel.indicator.reference`*::
+
--
Identifies a threat indicator as an IP address (irrespective of direction).
Reference URL linking to additional information about this indicator.


type: ip
type: keyword

--

*`threatintel.indicator.domain`*::
*`threatintel.indicator.ip`*::
+
--
Identifies a threat indicator as a domain (irrespective of direction).
Identifies a threat indicator as an IP address (irrespective of direction).


type: keyword
type: ip

--

Expand Down
4 changes: 2 additions & 2 deletions filebeat/docs/modules/threatintel.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ Abuse.ch URL Threat Intel is mapped to the following ECS fields.
[options="header"]
|==============================================================
| URL Threat Intel Fields | ECS Fields
| url | threat.indicator.url.full
| url | threatintel.indicator.url.full
| date_added | @timestamp
| host | threatintel.indicator.ip/domain
|==============================================================
Expand Down Expand Up @@ -473,7 +473,7 @@ Anomali ThreatStream fields are mapped to the following ECS fields:
| date_first | threatintel.indicator.first_seen
| date_last | threatintel.indicator.last_seen
| detail | tags
| domain | threatintel.indicator.domain
| domain | threatintel.indicator.url.domain
| email | threatintel.indicator.email.address
| itype<<a,[1]>> | threatintel.indicator.type
| lat | threatintel.indicator.geo.location.lat
Expand Down
4 changes: 2 additions & 2 deletions x-pack/filebeat/module/threatintel/_meta/docs.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ Abuse.ch URL Threat Intel is mapped to the following ECS fields.
[options="header"]
|==============================================================
| URL Threat Intel Fields | ECS Fields
| url | threat.indicator.url.full
| url | threatintel.indicator.url.full
| date_added | @timestamp
| host | threatintel.indicator.ip/domain
|==============================================================
Expand Down Expand Up @@ -468,7 +468,7 @@ Anomali ThreatStream fields are mapped to the following ECS fields:
| date_first | threatintel.indicator.first_seen
| date_last | threatintel.indicator.last_seen
| detail | tags
| domain | threatintel.indicator.domain
| domain | threatintel.indicator.url.domain
| email | threatintel.indicator.email.address
| itype<<a,[1]>> | threatintel.indicator.type
| lat | threatintel.indicator.geo.location.lat
Expand Down
Loading