elastic · efd6 · Jun 6, 2022 · Jun 1, 2022
@@ -53,6 +53,13 @@ filter, very little CPU is required to discard the packet. Network Packet Captur
 also uses the ports specified here to determine which parser to use for
 each packet.
 
+#### `monitor_processes`
+
+If this option is enabled then network traffic events will be enriched
+with information about the process associated with the events.
+
+The default value is false.
+
 #### `send_request`
 
 If this option is enabled, the raw message of the request (`request`

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.2.0"
+  changes:
+    - description: Add option to monitor processes.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3456
 - version: "1.1.0"
   changes:
     - description: Add configuration documentation.

@@ -39,6 +39,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [5672]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: max_body_length
         type: integer
         title: Max Body Length

@@ -39,6 +39,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [9042]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: send_request
         type: bool
         title: Send Request

@@ -18,6 +18,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [67, 68]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: keep_null
         type: bool
         title: Keep Null

@@ -33,6 +33,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [53]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: include_authorities
         type: bool
         title: Include Authorities

@@ -5,6 +5,10 @@ flows.timeout: '{{timeout}}'
 {{#if period}}
 flows.period: '{{period}}'
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -7,6 +7,15 @@ streams:
     description: Track Network Flows
     template_path: flow.yml.hbs
     vars:
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: period
         type: text
         title: Period

@@ -75,6 +75,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [80, 8080, 8000, 5000, 8002]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: hide_keywords
         type: text
         title: Hide Keywords

@@ -12,6 +12,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -7,6 +7,15 @@ streams:
     description: Capture ICMP Traffic
     template_path: icmp.yml.hbs
     vars:
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: keep_null
         type: bool
         title: Keep Null

@@ -39,6 +39,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [11211]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: parseunknown
         type: bool
         title: Parseunknown

@@ -33,6 +33,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [27017]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: max_docs
         type: integer
         title: Max Docs

@@ -27,6 +27,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [3306, 3307]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: send_request
         type: bool
         title: Send Request

@@ -27,6 +27,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [2049]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: send_request
         type: bool
         title: Send Request

@@ -27,6 +27,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [5432]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: send_request
         type: bool
         title: Send Request

@@ -33,6 +33,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}

@@ -14,6 +14,15 @@ streams:
         required: true
         show_user: true
         default: [6379]
+      - name: monitor_processes
+        type: bool
+        title: Monitor Processes
+        description: |-
+          If this option is enabled then network traffic events will be enriched
+          with information about the process associated with the events.
+        show_user: true
+        multi: false
+        required: false
       - name: send_request
         type: bool
         title: Send Request

@@ -24,6 +24,10 @@ tags:
   - {{tag}}
 {{/each}}
 {{/if}}
+{{#if monitor_processes}}
+procs:
+  enabled: true
+{{/if}}
 {{#if interface}}
 interface:
 {{#if (contains ".pcap" interface)}}