[network_traffic] Add missing field mappings in DNS and TLS

packages/network_traffic/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.8.2"
+  changes:
+    - description: Add missing field mappings to DNS and TLS data streams.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/3078
 - version: "0.8.1"
   changes:
     - description: Add documentation for multi-fields

packages/network_traffic/data_stream/amqp/fields/ecs.yml

@@ -12,6 +12,8 @@
   name: destination.port
 - external: ecs
   name: ecs.version
+- external: ecs
+  name: event.action
 - external: ecs
   name: event.category
 - external: ecs

packages/network_traffic/data_stream/dns/fields/ecs.yml

@@ -10,6 +10,42 @@
   name: destination.ip
 - external: ecs
   name: destination.port
+- external: ecs
+  name: dns.answers
+- external: ecs
+  name: dns.answers.class
+- external: ecs
+  name: dns.answers.data
+- external: ecs
+  name: dns.answers.name
+- external: ecs
+  name: dns.answers.ttl
+- external: ecs
+  name: dns.answers.type
+- external: ecs
+  name: dns.header_flags
+- external: ecs
+  name: dns.id
+- external: ecs
+  name: dns.op_code
+- external: ecs
+  name: dns.question.class
+- external: ecs
+  name: dns.question.name
+- external: ecs
+  name: dns.question.registered_domain
+- external: ecs
+  name: dns.question.subdomain
+- external: ecs
+  name: dns.question.top_level_domain
+- external: ecs
+  name: dns.question.type
+- external: ecs
+  name: dns.resolved_ip
+- external: ecs
+  name: dns.response_code
+- external: ecs
+  name: dns.type
 - external: ecs
   name: ecs.version
 - external: ecs
@@ -54,29 +90,3 @@
   name: source.ip
 - external: ecs
   name: source.port
-- external: ecs
-  name: dns.answers
-- external: ecs
-  name: dns.header_flags
-- external: ecs
-  name: dns.id
-- external: ecs
-  name: dns.op_code
-- external: ecs
-  name: dns.question.class
-- external: ecs
-  name: dns.question.name
-- external: ecs
-  name: dns.question.registered_domain
-- external: ecs
-  name: dns.question.top_level_domain
-- external: ecs
-  name: dns.question.type
-- external: ecs
-  name: dns.resolved_ip
-- external: ecs
-  name: dns.response_code
-- external: ecs
-  name: dns.question.subdomain
-- external: ecs
-  name: dns.type

packages/network_traffic/data_stream/http/fields/ecs.yml

@@ -6,6 +6,8 @@
   name: client.port
 - external: ecs
   name: destination.bytes
+- external: ecs
+  name: destination.domain
 - external: ecs
   name: destination.ip
 - external: ecs
@@ -26,6 +28,22 @@
   name: event.start
 - external: ecs
   name: event.type
+- external: ecs
+  name: http.request.body.bytes
+- external: ecs
+  name: http.request.bytes
+- external: ecs
+  name: http.request.method
+- external: ecs
+  name: http.request.referrer
+- external: ecs
+  name: http.response.body.bytes
+- external: ecs
+  name: http.response.bytes
+- external: ecs
+  name: http.response.status_code
+- external: ecs
+  name: http.version
 - external: ecs
   name: network.bytes
 - external: ecs
@@ -40,10 +58,14 @@
   name: network.transport
 - external: ecs
   name: network.type
+- external: ecs
+  name: related.hosts
 - external: ecs
   name: related.ip
 - external: ecs
   name: server.bytes
+- external: ecs
+  name: server.domain
 - external: ecs
   name: server.ip
 - external: ecs
@@ -54,26 +76,6 @@
   name: source.ip
 - external: ecs
   name: source.port
-- external: ecs
-  name: url.query
-- external: ecs
-  name: http.response.status_code
-- external: ecs
-  name: destination.domain
-- external: ecs
-  name: http.request.bytes
-- external: ecs
-  name: http.request.method
-- external: ecs
-  name: http.response.body.bytes
-- external: ecs
-  name: http.response.bytes
-- external: ecs
-  name: http.version
-- external: ecs
-  name: related.hosts
-- external: ecs
-  name: server.domain
 - external: ecs
   name: url.domain
 - external: ecs
@@ -84,11 +86,9 @@
   name: url.path
 - external: ecs
   name: url.port
+- external: ecs
+  name: url.query
 - external: ecs
   name: url.scheme
 - external: ecs
   name: user_agent.original
-- external: ecs
-  name: http.request.body.bytes
-- external: ecs
-  name: http.request.referrer

packages/network_traffic/data_stream/memcached/fields/ecs.yml

@@ -12,6 +12,8 @@
   name: destination.port
 - external: ecs
   name: ecs.version
+- external: ecs
+  name: event.action
 - external: ecs
   name: event.category
 - external: ecs
@@ -22,6 +24,8 @@
   name: event.end
 - external: ecs
   name: event.kind
+- external: ecs
+  name: event.outcome
 - external: ecs
   name: event.start
 - external: ecs

packages/network_traffic/data_stream/nfs/fields/ecs.yml

@@ -1,5 +1,7 @@
 - external: ecs
   name: client.bytes
+- external: ecs
+  name: client.domain
 - external: ecs
   name: client.ip
 - external: ecs
@@ -12,6 +14,8 @@
   name: destination.port
 - external: ecs
   name: ecs.version
+- external: ecs
+  name: event.action
 - external: ecs
   name: event.category
 - external: ecs
@@ -26,6 +30,8 @@
   name: event.start
 - external: ecs
   name: event.type
+- external: ecs
+  name: group.id
 - external: ecs
   name: network.bytes
 - external: ecs
@@ -50,15 +56,11 @@
   name: server.port
 - external: ecs
   name: source.bytes
+- external: ecs
+  name: source.domain
 - external: ecs
   name: source.ip
 - external: ecs
   name: source.port
-- external: ecs
-  name: client.domain
-- external: ecs
-  name: group.id
-- external: ecs
-  name: source.domain
 - external: ecs
   name: user.id

packages/network_traffic/data_stream/redis/fields/ecs.yml

@@ -12,6 +12,8 @@
   name: destination.port
 - external: ecs
   name: ecs.version
+- external: ecs
+  name: event.action
 - external: ecs
   name: event.category
 - external: ecs
@@ -22,6 +24,8 @@
   name: event.end
 - external: ecs
   name: event.kind
+- external: ecs
+  name: event.outcome
 - external: ecs
   name: event.start
 - external: ecs

packages/network_traffic/data_stream/sip/fields/ecs.yml

@@ -12,6 +12,8 @@
   name: destination.port
 - external: ecs
   name: ecs.version
+- external: ecs
+  name: event.action
 - external: ecs
   name: event.category
 - external: ecs
@@ -22,10 +24,20 @@
   name: event.end
 - external: ecs
   name: event.kind
+- external: ecs
+  name: event.original
+- external: ecs
+  name: event.outcome
+- external: ecs
+  name: event.reason
+- external: ecs
+  name: event.sequence
 - external: ecs
   name: event.start
 - external: ecs
   name: event.type
+- external: ecs
+  name: network.application
 - external: ecs
   name: network.bytes
 - external: ecs
@@ -34,14 +46,20 @@
   name: network.direction
 - external: ecs
   name: network.forwarded_ip
+- external: ecs
+  name: network.iana_number
 - external: ecs
   name: network.protocol
 - external: ecs
   name: network.transport
 - external: ecs
   name: network.type
+- external: ecs
+  name: related.hosts
 - external: ecs
   name: related.ip
+- external: ecs
+  name: related.user
 - external: ecs
   name: server.bytes
 - external: ecs
@@ -54,13 +72,5 @@
   name: source.ip
 - external: ecs
   name: source.port
-- external: ecs
-  name: network.iana_number
-- external: ecs
-  name: related.hosts
-- external: ecs
-  name: related.user
-- external: ecs
-  name: network.application
 - external: ecs
   name: user.name

packages/network_traffic/data_stream/tls/_dev/test/system/test-tls-sample2-config.yml

@@ -0,0 +1,5 @@
+vars:
+  interface: "{{SERVICE_LOGS_DIR}}/tls-sample2.pcap"
+input: packet
+data_stream:
+  vars: ~

packages/network_traffic/data_stream/tls/elasticsearch/ingest_pipeline/default.yml

@@ -21,6 +21,34 @@ processors:
 - uppercase:
     field: host.mac
     ignore_missing: true
+
+##
+# Make tls.{client,server}.x509.version_number a string as per ECS.
+##
+- convert:
+    field: tls.client.x509.version_number
+    type: string
+    ignore_missing: true
+- convert:
+    field: tls.server.x509.version_number
+    type: string
+    ignore_missing: true
+
+##
+# This handles legacy TLS fields from Packetbeat 7.17.
+##
+- remove:
+    description: Remove legacy fields from Packetbeat 7.17 that are duplicated.
+    field:
+      - tls.client.x509.issuer.province  # Duplicated as tls.client.x509.issuer.state_or_province.
+      - tls.client.x509.subject.province # Duplicated as tls.client.x509.subject.state_or_province.
+      - tls.client.x509.version          # Duplicated as tls.client.x509.version_number.
+      - tls.detailed.client_certificate  # Duplicated as tls.client.x509.
+      - tls.detailed.server_certificate  # Duplicated as tls.server.x509.
+      - tls.server.x509.issuer.province  # Duplicated as tls.server.x509.issuer.state_or_province.
+      - tls.server.x509.subject.province # Duplicated as tls.server.x509.subject.state_or_province.
+      - tls.server.x509.version          # Duplicated as tls.server.x509.version_number.
+    ignore_missing: true
 on_failure:
 - set:
     field: error.message