From b16c4ddcc6147b77957888a1c4f5209a20d25357 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:32:26 -0500 Subject: [PATCH 01/10] Update ECS version for zeek ECS version updated to 8.4.0 --- packages/zeek/_dev/build/build.yml | 2 +- .../capture_loss/elasticsearch/ingest_pipeline/default.yml | 2 +- .../connection/elasticsearch/ingest_pipeline/default.yml | 2 +- .../dce_rpc/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/dns/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/dpd/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/files/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/ftp/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/http/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/intel/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/irc/elasticsearch/ingest_pipeline/default.yml | 2 +- .../kerberos/elasticsearch/ingest_pipeline/default.yml | 2 +- .../known_certs/elasticsearch/ingest_pipeline/default.yml | 2 +- .../known_hosts/elasticsearch/ingest_pipeline/default.yml | 2 +- .../known_services/elasticsearch/ingest_pipeline/default.yml | 2 +- .../modbus/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/mysql/elasticsearch/ingest_pipeline/default.yml | 2 +- .../notice/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/ntp/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/pe/elasticsearch/ingest_pipeline/default.yml | 2 +- .../radius/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/rdp/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/rfb/elasticsearch/ingest_pipeline/default.yml | 2 +- .../signature/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/sip/elasticsearch/ingest_pipeline/default.yml | 2 +- .../smb_cmd/elasticsearch/ingest_pipeline/default.yml | 2 +- .../smb_files/elasticsearch/ingest_pipeline/default.yml | 2 +- .../smb_mapping/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/smtp/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/snmp/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/socks/elasticsearch/ingest_pipeline/default.yml | 2 +- .../software/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/ssh/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/ssl/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/stats/elasticsearch/ingest_pipeline/default.yml | 2 +- .../syslog/elasticsearch/ingest_pipeline/default.yml | 2 +- .../traceroute/elasticsearch/ingest_pipeline/default.yml | 2 +- .../tunnel/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/weird/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/x509/elasticsearch/ingest_pipeline/default.yml | 2 +- 44 files changed, 44 insertions(+), 44 deletions(-) diff --git a/packages/zeek/_dev/build/build.yml b/packages/zeek/_dev/build/build.yml index 5661d603a89..2254d90483c 100644 --- a/packages/zeek/_dev/build/build.yml +++ b/packages/zeek/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.3.0 + reference: git@v8.4.0-rc1 diff --git a/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml index e3fba6a819d..e4cde141a90 100644 --- a/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml @@ -23,7 +23,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - date: field: zeek.capture_loss.ts formats: diff --git a/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml index 61e116a6417..f14051ded75 100644 --- a/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml @@ -24,7 +24,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: event.kind value: event diff --git a/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml index a68f24ec539..a636924754e 100644 --- a/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml index fc3a0a89ded..e383184ccc8 100644 --- a/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml @@ -23,7 +23,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml index 5579bd04d6b..ad950729685 100644 --- a/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml index 988eb36fbbe..872c51b485c 100644 --- a/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml index 4e669b14edf..7ca4a86603b 100644 --- a/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml index 2f8b6119bfe..2980c44181d 100644 --- a/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: file diff --git a/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml index 3200d47d1fa..17bac96b504 100644 --- a/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml index 9b62ffcd793..d847f409bc8 100644 --- a/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml index c18f783f7f3..4611595cb68 100644 --- a/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: enrichment - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: threat diff --git a/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml index 8d0c219f53a..3d6fbd5917e 100644 --- a/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml index d1d0b080a9b..15f8f41522c 100644 --- a/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: ["network", "authentication"] diff --git a/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml index e04e8689d64..f69eedb568c 100644 --- a/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml @@ -17,7 +17,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: event.kind value: event diff --git a/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml index fb90c04ac80..6c5dfff0d15 100644 --- a/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml @@ -17,7 +17,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: event.kind value: event diff --git a/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml index 482e556aa00..1d2edab2061 100644 --- a/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml @@ -17,7 +17,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: event.kind value: event diff --git a/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml index 03a69cf6739..a4d34516b95 100644 --- a/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml index c0f63a3e919..c9fd4e48e0b 100644 --- a/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml index 1a949bf2f12..04d46c8aa2c 100644 --- a/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: alert - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: intrusion_detection diff --git a/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml index 9902afaebe4..8ef39ad970b 100644 --- a/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml index f98936983f4..173f0afc45a 100644 --- a/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml @@ -24,7 +24,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: event.kind value: event diff --git a/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml index 298dcd824d0..6eeeecda494 100644 --- a/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: network.transport value: tcp diff --git a/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml index b4403ef2ec5..78dbe845400 100644 --- a/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: file diff --git a/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml index d894229551c..3e80b298954 100644 --- a/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml index e0f8a1440df..e14d72f7b9f 100644 --- a/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml index e7c709893b3..9c770ab56a6 100644 --- a/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml index 770f1c638d5..895425b2a3f 100644 --- a/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml @@ -24,7 +24,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: event.kind value: alert diff --git a/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml index 65ea4b85ad3..033498f9b8d 100644 --- a/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml index b0de33b8962..4800d870a92 100644 --- a/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml index 1563413f8eb..c7ac4c0ddaa 100644 --- a/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml index 3b950519bf2..3d001996a5c 100644 --- a/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml index 60a5fb04330..d44d23535fa 100644 --- a/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml index 4b30d278bc6..0896e482647 100644 --- a/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml index 8f94b1b5289..d5d9cf8670f 100644 --- a/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml index cdbaf46587e..18387e0b7c8 100644 --- a/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml @@ -21,7 +21,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: event.kind value: event diff --git a/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml index baf5ed09366..0ded69576cd 100644 --- a/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml index 03e01fe992f..daca4b04168 100644 --- a/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml index d313c4aac62..ffcb509ce47 100644 --- a/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: zeek.stats.mem target_field: zeek.stats.memory diff --git a/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml index 2d1ecfaad32..c631ed21704 100644 --- a/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - set: field: network.protocol value: syslog diff --git a/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml index 42f8ab707c5..5832f42673e 100644 --- a/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml index 06ac4e2e98c..2a42719811d 100644 --- a/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml index 769edeba106..6379f74bc38 100644 --- a/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.category value: network diff --git a/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml index ac55284daf2..40e0813813b 100644 --- a/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - append: field: event.type value: info From 8e06e9d1a906c65274eab9478436daabea3aa1f4 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:32:26 -0500 Subject: [PATCH 02/10] Update ECS version for zerofox ECS version updated to 8.4.0 --- packages/zerofox/_dev/build/build.yml | 2 +- .../alerts/elasticsearch/ingest_pipeline/default.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/zerofox/_dev/build/build.yml b/packages/zerofox/_dev/build/build.yml index 5661d603a89..2254d90483c 100644 --- a/packages/zerofox/_dev/build/build.yml +++ b/packages/zerofox/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.3.0 + reference: git@v8.4.0-rc1 diff --git a/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml index 75a24d305a1..e9418538952 100644 --- a/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: ## ECS version. - set: field: ecs.version - value: "8.3.0" + value: '8.4.0' ## Event JSON decoding. - rename: From 40f46994b03c7ef34ffa7e83b044b24d897baa12 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:32:27 -0500 Subject: [PATCH 03/10] Update ECS version for zoom ECS version updated to 8.4.0 --- packages/zoom/_dev/build/build.yml | 2 +- .../webhook/elasticsearch/ingest_pipeline/default.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/zoom/_dev/build/build.yml b/packages/zoom/_dev/build/build.yml index 5661d603a89..2254d90483c 100644 --- a/packages/zoom/_dev/build/build.yml +++ b/packages/zoom/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.3.0 + reference: git@v8.4.0-rc1 diff --git a/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml b/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml index 731b936daed..52e50ff1e40 100644 --- a/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml @@ -9,7 +9,7 @@ processors: value: Webhook - set: field: ecs.version - value: 8.3.0 + value: '8.4.0' - script: description: Drops null/empty values recursively lang: painless From ea40805910cb3523a909dc48fcd01441f4c712a5 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:32:28 -0500 Subject: [PATCH 04/10] Update ECS version for zscaler_zia ECS version updated to 8.4.0 --- packages/zscaler_zia/_dev/build/build.yml | 2 +- .../alerts/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/dns/elasticsearch/ingest_pipeline/default.yml | 2 +- .../firewall/elasticsearch/ingest_pipeline/default.yml | 2 +- .../tunnel/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/web/elasticsearch/ingest_pipeline/default.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/packages/zscaler_zia/_dev/build/build.yml b/packages/zscaler_zia/_dev/build/build.yml index 5661d603a89..2254d90483c 100644 --- a/packages/zscaler_zia/_dev/build/build.yml +++ b/packages/zscaler_zia/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.3.0 + reference: git@v8.4.0-rc1 diff --git a/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml index b77c894f4e3..41a51f6bfae 100644 --- a/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler alert logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml index 4cb9988e49d..b6918fbf574 100644 --- a/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler dns logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml index 2df127327b6..01414dc5c88 100644 --- a/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler firewall logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml index bd6a85405fc..0233cfb79fc 100644 --- a/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler tunnel logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml index 75468149337..bf60e4fd845 100644 --- a/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler web logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original From 1d40baf1afc700cca50a738059deadef279e4b98 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:32:28 -0500 Subject: [PATCH 05/10] Update ECS version for zscaler_zpa ECS version updated to 8.4.0 --- packages/zscaler_zpa/_dev/build/build.yml | 2 +- .../elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/audit/elasticsearch/ingest_pipeline/default.yml | 2 +- .../browser_access/elasticsearch/ingest_pipeline/default.yml | 2 +- .../user_activity/elasticsearch/ingest_pipeline/default.yml | 2 +- .../user_status/elasticsearch/ingest_pipeline/default.yml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/packages/zscaler_zpa/_dev/build/build.yml b/packages/zscaler_zpa/_dev/build/build.yml index 5661d603a89..2254d90483c 100644 --- a/packages/zscaler_zpa/_dev/build/build.yml +++ b/packages/zscaler_zpa/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.3.0 + reference: git@v8.4.0-rc1 diff --git a/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml index 72acbd37aea..8dd7b1e3945 100644 --- a/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler app connector status logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index d3a2b75f765..22afadf04c0 100644 --- a/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler audit logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml index d27f76413d8..07caf320e93 100644 --- a/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler browser access logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml index f7161bbfaa2..0024812eb5c 100644 --- a/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler user activity logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml index 7a0d65a8258..0baee9c0168 100644 --- a/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler user status logs processors: - set: field: ecs.version - value: '8.3.0' + value: '8.4.0' - rename: field: message target_field: event.original From 60220fd084c92cebd5238d6ee727448c05eae1c3 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:33:50 -0500 Subject: [PATCH 06/10] Updated Changelog, Manifest and pipeline tests for zeek --- packages/zeek/changelog.yml | 5 +++ .../test-capture-loss.log-expected.json | 12 +++---- .../test/pipeline/test-conn.log-expected.json | 36 +++++++++---------- .../pipeline/test-dce-rpc.log-expected.json | 4 +-- .../test/pipeline/test-dhcp.log-expected.json | 6 ++-- .../test/pipeline/test-dnp3.log-expected.json | 4 +-- .../test/pipeline/test-dns.log-expected.json | 16 ++++----- .../test/pipeline/test-dpd.log-expected.json | 4 +-- .../pipeline/test-files.log-expected.json | 18 +++++----- .../test/pipeline/test-ftp.log-expected.json | 8 ++--- .../test/pipeline/test-http.log-expected.json | 18 +++++----- .../pipeline/test-intel.log-expected.json | 4 +-- .../test/pipeline/test-irc.log-expected.json | 8 ++--- .../pipeline/test-kerberos.log-expected.json | 4 +-- .../test-known_certs.log-expected.json | 2 +- .../test-known_hosts.log-expected.json | 10 +++--- .../test-known_services.log-expected.json | 2 +- .../pipeline/test-modbus.log-expected.json | 4 +-- .../pipeline/test-mysql.log-expected.json | 4 +-- .../pipeline/test-notice.log-expected.json | 10 +++--- .../test/pipeline/test-ntlm.log-expected.json | 4 +-- .../test/pipeline/test-ntp.log-expected.json | 4 +-- .../test/pipeline/test-ocsp.log-expected.json | 6 ++-- .../test/pipeline/test-pe.log-expected.json | 4 +-- .../pipeline/test-radius.log-expected.json | 4 +-- .../test/pipeline/test-rdp.log-expected.json | 4 +-- .../test/pipeline/test-rfb.log-expected.json | 4 +-- .../pipeline/test-signature.log-expected.json | 2 +- .../test/pipeline/test-sip.log-expected.json | 12 +++---- .../pipeline/test-smb-cmd.log-expected.json | 4 +-- .../pipeline/test-smb-files.log-expected.json | 4 +-- .../test-smb-mapping.log-expected.json | 4 +-- .../test/pipeline/test-smtp.log-expected.json | 4 +-- .../test/pipeline/test-snmp.log-expected.json | 6 ++-- .../pipeline/test-socks.log-expected.json | 4 +-- .../pipeline/test-software.log-expected.json | 2 +- .../test/pipeline/test-ssh.log-expected.json | 10 +++--- .../test/pipeline/test-ssl.log-expected.json | 24 ++++++------- .../pipeline/test-stats.log-expected.json | 4 +-- .../pipeline/test-syslog.log-expected.json | 20 +++++------ .../test-traceroute.log-expected.json | 4 +-- .../pipeline/test-tunnel.log-expected.json | 4 +-- .../pipeline/test-weird.log-expected.json | 6 ++-- .../test/pipeline/test-x509.log-expected.json | 4 +-- packages/zeek/docs/README.md | 22 ++++++------ packages/zeek/manifest.yml | 2 +- 46 files changed, 178 insertions(+), 173 deletions(-) diff --git a/packages/zeek/changelog.yml b/packages/zeek/changelog.yml index 77092bf0ddb..8bcdf63f6c4 100644 --- a/packages/zeek/changelog.yml +++ b/packages/zeek/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.4.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3872 - version: "2.3.1" changes: - description: Update package name and description to align with standard wording diff --git a/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json b/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json index 300053625ff..627f5854659 100644 --- a/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json +++ b/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-09-10T16:19:28.465Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -27,7 +27,7 @@ { "@timestamp": "2021-03-30T00:04:00.941Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -51,7 +51,7 @@ { "@timestamp": "2021-03-30T00:19:00.942Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -75,7 +75,7 @@ { "@timestamp": "2021-03-30T00:34:00.942Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -99,7 +99,7 @@ { "@timestamp": "2021-03-30T00:49:00.942Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -123,7 +123,7 @@ { "@timestamp": "2019-09-10T16:19:28.465Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json b/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json index 18237226eb4..ce5776902c0 100644 --- a/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json +++ b/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json @@ -10,7 +10,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -91,7 +91,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -172,7 +172,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -269,7 +269,7 @@ "packets": 0 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -349,7 +349,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -427,7 +427,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -506,7 +506,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -585,7 +585,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -646,7 +646,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -708,7 +708,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -770,7 +770,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -832,7 +832,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -894,7 +894,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -956,7 +956,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -1016,7 +1016,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -1076,7 +1076,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -1154,7 +1154,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -1242,7 +1242,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", diff --git a/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json b/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json index e56f7125c50..a7c4502c905 100644 --- a/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json +++ b/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "BrowserrQueryOtherDomains", @@ -62,7 +62,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "BrowserrQueryOtherDomains", diff --git a/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json b/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json index d1c7415bf94..41d3991ed68 100644 --- a/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json +++ b/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json @@ -11,7 +11,7 @@ "port": 67 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -91,7 +91,7 @@ "port": 67 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -165,7 +165,7 @@ "port": 67 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json b/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json index 0fe9b091443..6a5ee19ba2d 100644 --- a/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json +++ b/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json @@ -8,7 +8,7 @@ "port": 20000 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "read", @@ -60,7 +60,7 @@ "port": 20000 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "read", diff --git a/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json b/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json index bcd0e1e2ce1..3171538a6cd 100644 --- a/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json +++ b/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json @@ -42,7 +42,7 @@ "type": "answer" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -125,7 +125,7 @@ "type": "query" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -201,7 +201,7 @@ "type": "answer" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -297,7 +297,7 @@ "type": "answer" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -395,7 +395,7 @@ "type": "answer" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -534,7 +534,7 @@ "type": "answer" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -650,7 +650,7 @@ "type": "answer" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -734,7 +734,7 @@ "type": "answer" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json b/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json index cd567f7e298..42b9872239e 100644 --- a/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json +++ b/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -57,7 +57,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json b/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json index 55661dd1682..ed620bf7f4c 100644 --- a/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json +++ b/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json @@ -6,7 +6,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -78,7 +78,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -150,7 +150,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -222,7 +222,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -298,7 +298,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -374,7 +374,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -450,7 +450,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -522,7 +522,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -598,7 +598,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json b/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json index 7d21b02e9e5..5be168e8cd9 100644 --- a/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json +++ b/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json @@ -8,7 +8,7 @@ "port": 21 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "EPSV", @@ -77,7 +77,7 @@ "port": 21 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "RETR", @@ -144,7 +144,7 @@ "port": 21 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "STOR", @@ -208,7 +208,7 @@ "port": 21 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "STOR", diff --git a/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json b/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json index 77fdcd7c84b..8721faaffc4 100644 --- a/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json +++ b/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json @@ -26,7 +26,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "GET", @@ -138,7 +138,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "GET", @@ -244,7 +244,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -335,7 +335,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -426,7 +426,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -517,7 +517,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -608,7 +608,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -699,7 +699,7 @@ "port": 80 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "GET", @@ -795,7 +795,7 @@ "port": 7000 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "GET", diff --git a/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json b/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json index 0c65ec46e99..6c5336e3592 100644 --- a/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json +++ b/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json @@ -26,7 +26,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -98,7 +98,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json b/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json index a485596c733..27f7ef17025 100644 --- a/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json +++ b/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json @@ -26,7 +26,7 @@ "port": 8000 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "USER", @@ -97,7 +97,7 @@ "port": 8000 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "NICK", @@ -174,7 +174,7 @@ "port": 8000 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "JOIN", @@ -252,7 +252,7 @@ "port": 8000 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "JOIN", diff --git a/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json b/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json index 607806e7af8..c0604a5882d 100644 --- a/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json +++ b/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json @@ -11,7 +11,7 @@ "port": 88 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "TGS", @@ -118,7 +118,7 @@ "port": 88 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "TGS", diff --git a/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known_certs.log-expected.json b/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known_certs.log-expected.json index 3476b22f2bf..39af25b3f59 100644 --- a/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known_certs.log-expected.json +++ b/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known_certs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-12-31T15:15:53.690Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known_hosts.log-expected.json b/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known_hosts.log-expected.json index 61a9081c354..2abe1224304 100644 --- a/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known_hosts.log-expected.json +++ b/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known_hosts.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-01-03T01:19:26.260Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -35,7 +35,7 @@ { "@timestamp": "2021-01-03T01:19:27.353Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -67,7 +67,7 @@ { "@timestamp": "2021-01-03T01:19:32.488Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -99,7 +99,7 @@ { "@timestamp": "2021-01-03T01:19:58.792Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -131,7 +131,7 @@ { "@timestamp": "2021-01-03T12:17:22.496Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known_services.log-expected.json b/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known_services.log-expected.json index 58281f96d7c..e33e772c6a2 100644 --- a/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known_services.log-expected.json +++ b/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known_services.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-01-03T01:19:36.242Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json b/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json index 5aed449da5a..8d4fd9692f7 100644 --- a/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json +++ b/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json @@ -8,7 +8,7 @@ "port": 502 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "READ_COILS", @@ -59,7 +59,7 @@ "port": 502 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "READ_COILS", diff --git a/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json b/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json index cb1fc1398eb..3f3bff836ea 100644 --- a/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json +++ b/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json @@ -8,7 +8,7 @@ "port": 3306 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "query", @@ -63,7 +63,7 @@ "port": 3306 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "query", diff --git a/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json b/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json index 84e32a47d62..f19ae8fe90b 100644 --- a/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json +++ b/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2011-11-04T19:44:35.879Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -72,7 +72,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -137,7 +137,7 @@ { "@timestamp": "2021-03-30T09:49:00.958Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -194,7 +194,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -270,7 +270,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json b/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json index e95e79dcba6..99b8acec019 100644 --- a/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json +++ b/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -74,7 +74,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json b/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json index 5976c9e61bb..f2f1dd879e7 100644 --- a/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json +++ b/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json @@ -26,7 +26,7 @@ "port": 123 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", @@ -122,7 +122,7 @@ "port": 123 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", diff --git a/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json b/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json index 95d65f3268d..5778eeec464 100644 --- a/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json +++ b/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2011-06-10T13:27:01.847Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -41,7 +41,7 @@ { "@timestamp": "2011-06-08T19:46:56.100Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -76,7 +76,7 @@ { "@timestamp": "2011-06-08T19:46:56.100Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json b/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json index 09d26c842f4..2317f050a3b 100644 --- a/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json +++ b/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2017-10-09T16:13:19.578Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -49,7 +49,7 @@ { "@timestamp": "2017-10-09T16:13:19.578Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json b/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json index 2478a501092..78bcfb1b9e3 100644 --- a/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json +++ b/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json @@ -8,7 +8,7 @@ "port": 1812 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -67,7 +67,7 @@ "port": 1812 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json b/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json index e43a44efbac..5bbbdc69ed9 100644 --- a/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json +++ b/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json @@ -8,7 +8,7 @@ "port": 3389 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -65,7 +65,7 @@ "port": 3389 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json b/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json index a551c07d02d..cbb1f6d019f 100644 --- a/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json +++ b/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json @@ -8,7 +8,7 @@ "port": 5900 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -74,7 +74,7 @@ "port": 5900 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json b/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json index ca4240d1363..4cd7ab9f978 100644 --- a/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json +++ b/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json @@ -26,7 +26,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "network", diff --git a/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json b/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json index 1492f37e31d..5dbbd192712 100644 --- a/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json +++ b/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json @@ -26,7 +26,7 @@ "port": 5060 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "REGISTER", @@ -126,7 +126,7 @@ "port": 5060 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "INVITE", @@ -245,7 +245,7 @@ "port": 5060 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "REGISTER", @@ -343,7 +343,7 @@ "port": 5060 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "OPTIONS", @@ -432,7 +432,7 @@ "port": 5060 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "OPTIONS", @@ -539,7 +539,7 @@ "port": 5060 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "REGISTER", diff --git a/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json b/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json index 3ce6aca7260..ddebab0f1ad 100644 --- a/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json +++ b/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "NT_CREATE_ANDX", @@ -74,7 +74,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "NT_CREATE_ANDX", diff --git a/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json b/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json index bf656fc1580..c02b820c3dc 100644 --- a/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json +++ b/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "SMB::FILE_OPEN", @@ -78,7 +78,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "SMB::FILE_OPEN", diff --git a/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json b/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json index e6267dd4f70..10a314cc4b2 100644 --- a/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json +++ b/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -58,7 +58,7 @@ "port": 445 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json b/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json index 0a9f1354dfc..081172c424b 100644 --- a/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json +++ b/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json @@ -8,7 +8,7 @@ "port": 25 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -68,7 +68,7 @@ "port": 25 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json b/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json index 0b4d82d69e9..8bb86be4db7 100644 --- a/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json +++ b/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json @@ -8,7 +8,7 @@ "port": 161 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -68,7 +68,7 @@ "port": 161 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -145,7 +145,7 @@ "port": 161 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json b/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json index a9ac5cffe9d..4f721dd6717 100644 --- a/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json +++ b/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json @@ -8,7 +8,7 @@ "port": 8080 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -66,7 +66,7 @@ "port": 8080 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json b/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json index 7015de42e2c..b12c1fc355f 100644 --- a/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json +++ b/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-01-03T00:16:22.694Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json b/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json index 3f138d41edc..fcfb18326bb 100644 --- a/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json +++ b/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json @@ -8,7 +8,7 @@ "port": 22 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -72,7 +72,7 @@ "port": 22 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -143,7 +143,7 @@ "port": 22 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -214,7 +214,7 @@ "port": 22 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -285,7 +285,7 @@ "port": 22 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json b/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json index ff14f1ffd7d..c1dd931535d 100644 --- a/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json +++ b/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json @@ -29,7 +29,7 @@ "port": 9243 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -154,7 +154,7 @@ "port": 9243 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -279,7 +279,7 @@ "port": 9243 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -386,7 +386,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -523,7 +523,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -587,7 +587,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -667,7 +667,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -747,7 +747,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -845,7 +845,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -919,7 +919,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -1017,7 +1017,7 @@ "port": 9243 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -1124,7 +1124,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json b/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json index 554bc0ed0dd..4e54c622470 100644 --- a/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json +++ b/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2016-10-16T08:17:58.714Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -65,7 +65,7 @@ { "@timestamp": "2016-10-16T08:17:58.714Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json b/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json index fb4fd1c51ba..b5e2be6fb68 100644 --- a/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json +++ b/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json @@ -8,7 +8,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -64,7 +64,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -120,7 +120,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -176,7 +176,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -232,7 +232,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -288,7 +288,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -344,7 +344,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -400,7 +400,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -456,7 +456,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -512,7 +512,7 @@ "port": 514 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json b/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json index ca9cd4cd972..295efce5469 100644 --- a/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json +++ b/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json @@ -25,7 +25,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -81,7 +81,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json b/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json index 50faa4a4f3f..d5e8c612476 100644 --- a/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json +++ b/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json @@ -26,7 +26,7 @@ "port": 8080 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "Tunnel::DISCOVER", @@ -104,7 +104,7 @@ "port": 8080 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "Tunnel::DISCOVER", diff --git a/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json b/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json index bcc9934dc72..e553e716f60 100644 --- a/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json +++ b/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json @@ -8,7 +8,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -48,7 +48,7 @@ { "@timestamp": "2020-01-28T16:00:59.342Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -80,7 +80,7 @@ "port": 53 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json b/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json index 635998f6faf..5b7ce9014cc 100644 --- a/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json +++ b/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-12-03T20:00:00.143Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -225,7 +225,7 @@ { "@timestamp": "2018-12-03T20:00:00.143Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/docs/README.md b/packages/zeek/docs/README.md index eba27c20f1b..7bbb8d4307e 100644 --- a/packages/zeek/docs/README.md +++ b/packages/zeek/docs/README.md @@ -160,7 +160,7 @@ contains TCP/UDP/ICMP connection data. | log.offset | Offset of the entry in the log file. | long | | network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | | network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | | network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | @@ -534,7 +534,7 @@ activity. | dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | | dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | | dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.header_flags | Array of 2 letter DNS header flags. Expected values are: AA, TC, RD, RA, AD, CD, DO. | keyword | +| dns.header_flags | Array of 2 letter DNS header flags. | keyword | | dns.id | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | keyword | | dns.question.class | The class of records being queried. | keyword | | dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | @@ -1383,13 +1383,13 @@ contains kerberos data. | source.port | Port of the source. | long | | tags | List of keywords used to tag each event. | keyword | | tls.client.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.client.x509.subject.country | List of country (C) code | keyword | +| tls.client.x509.subject.country | List of country \(C) code | keyword | | tls.client.x509.subject.locality | List of locality names (L) | keyword | | tls.client.x509.subject.organization | List of organizations (O) of subject. | keyword | | tls.client.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | | tls.client.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | | tls.server.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.server.x509.subject.country | List of country (C) code | keyword | +| tls.server.x509.subject.country | List of country \(C) code | keyword | | tls.server.x509.subject.locality | List of locality names (L) | keyword | | tls.server.x509.subject.organization | List of organizations (O) of subject. | keyword | | tls.server.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | @@ -2045,7 +2045,7 @@ NTP data. | log.offset | Offset of the entry in the log file. | long | | network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | | network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | | network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | @@ -2738,7 +2738,7 @@ Zeek signature matches. | log.offset | Offset of the entry in the log file. | long | | network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | | network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | | network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | @@ -3819,7 +3819,7 @@ SSL/TLS handshake info. | tls.client.issuer | Distinguished name of subject of the issuer of the x.509 certificate presented by the client. | keyword | | tls.client.ja3 | A hash that identifies clients based on how they perform an SSL/TLS handshake. | keyword | | tls.client.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.client.x509.subject.country | List of country (C) code | keyword | +| tls.client.x509.subject.country | List of country \(C) code | keyword | | tls.client.x509.subject.locality | List of locality names (L) | keyword | | tls.client.x509.subject.organization | List of organizations (O) of subject. | keyword | | tls.client.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | @@ -3834,14 +3834,14 @@ SSL/TLS handshake info. | tls.server.not_before | Timestamp indicating when server certificate is first considered valid. | date | | tls.server.subject | Subject of the x.509 certificate presented by the server. | keyword | | tls.server.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| tls.server.x509.issuer.country | List of country (C) codes | keyword | +| tls.server.x509.issuer.country | List of country \(C) codes | keyword | | tls.server.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | | tls.server.x509.issuer.locality | List of locality names (L) | keyword | | tls.server.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | | tls.server.x509.issuer.organizational_unit | List of organizational units (OU) of issuing certificate authority. | keyword | | tls.server.x509.issuer.state_or_province | List of state or province names (ST, S, or P) | keyword | | tls.server.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| tls.server.x509.subject.country | List of country (C) code | keyword | +| tls.server.x509.subject.country | List of country \(C) code | keyword | | tls.server.x509.subject.locality | List of locality names (L) | keyword | | tls.server.x509.subject.organization | List of organizations (O) of subject. | keyword | | tls.server.x509.subject.organizational_unit | List of organizational units (OU) of subject. | keyword | @@ -4382,7 +4382,7 @@ X.509 certificate info. | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | | file.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | -| file.x509.issuer.country | List of country (C) codes | keyword | +| file.x509.issuer.country | List of country \(C) codes | keyword | | file.x509.issuer.distinguished_name | Distinguished name (DN) of issuing certificate authority. | keyword | | file.x509.issuer.locality | List of locality names (L) | keyword | | file.x509.issuer.organization | List of organizations (O) of issuing certificate authority. | keyword | @@ -4397,7 +4397,7 @@ X.509 certificate info. | file.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | | file.x509.signature_algorithm | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | keyword | | file.x509.subject.common_name | List of common names (CN) of subject. | keyword | -| file.x509.subject.country | List of country (C) code | keyword | +| file.x509.subject.country | List of country \(C) code | keyword | | file.x509.subject.distinguished_name | Distinguished name (DN) of the certificate subject entity. | keyword | | file.x509.subject.locality | List of locality names (L) | keyword | | file.x509.subject.organization | List of organizations (O) of subject. | keyword | diff --git a/packages/zeek/manifest.yml b/packages/zeek/manifest.yml index 9935c72d10a..8a249ca1807 100644 --- a/packages/zeek/manifest.yml +++ b/packages/zeek/manifest.yml @@ -1,6 +1,6 @@ name: zeek title: Zeek -version: 2.3.1 +version: 2.4.0 release: ga description: Collect logs from Zeek with Elastic Agent. type: integration From bdfd6de22405252754931740b420d64f74dc71d4 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:33:52 -0500 Subject: [PATCH 07/10] Updated Changelog, Manifest and pipeline tests for zerofox --- packages/zerofox/changelog.yml | 5 +++++ .../alerts/_dev/test/pipeline/test-alert.json-expected.json | 6 +++--- packages/zerofox/manifest.yml | 2 +- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/packages/zerofox/changelog.yml b/packages/zerofox/changelog.yml index 3a388ce2b9f..3930038765b 100644 --- a/packages/zerofox/changelog.yml +++ b/packages/zerofox/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.5.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3872 - version: "1.4.1" changes: - description: Update package name and description to align with standard wording diff --git a/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json b/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json index 110d68d653e..1e288747a77 100644 --- a/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json +++ b/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-04-29T18:56:51.000Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2017-01-10T11:00:00.000Z", @@ -60,7 +60,7 @@ { "@timestamp": "2021-05-06T13:50:48.000Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2021-05-06T13:29:27.000Z", @@ -126,7 +126,7 @@ { "@timestamp": "2021-05-05T19:22:00.000Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "created": "2014-08-09T16:00:16.000Z", diff --git a/packages/zerofox/manifest.yml b/packages/zerofox/manifest.yml index 05a6a1e3cbf..e032bf68291 100644 --- a/packages/zerofox/manifest.yml +++ b/packages/zerofox/manifest.yml @@ -1,6 +1,6 @@ name: zerofox title: ZeroFox -version: 1.4.1 +version: 1.5.0 release: ga description: Collect logs from ZeroFox with Elastic Agent. type: integration From 7d0daa086536ac66683b51341379e4ae322d0510 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:33:55 -0500 Subject: [PATCH 08/10] Updated Changelog, Manifest and pipeline tests for zoom --- packages/zoom/changelog.yml | 5 ++++ .../pipeline/test-account.json-expected.json | 6 ++-- .../test-chat-channel.json-expected.json | 12 ++++---- .../test-chat-message.json-expected.json | 6 ++-- .../pipeline/test-meeting.json-expected.json | 30 +++++++++---------- .../pipeline/test-phone.json-expected.json | 22 +++++++------- .../test-recording.json-expected.json | 26 ++++++++-------- .../pipeline/test-user.json-expected.json | 26 ++++++++-------- .../pipeline/test-webinar.json-expected.json | 28 ++++++++--------- .../pipeline/test-zoomroom.json-expected.json | 8 ++--- packages/zoom/manifest.yml | 2 +- 11 files changed, 88 insertions(+), 83 deletions(-) diff --git a/packages/zoom/changelog.yml b/packages/zoom/changelog.yml index a5649d31035..06421732a83 100644 --- a/packages/zoom/changelog.yml +++ b/packages/zoom/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.5.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3872 - version: "1.4.1" changes: - description: Update package name and description to align with standard wording diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json index 1e10a8efe17..dfa2b226ecc 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "account.created", @@ -49,7 +49,7 @@ { "@timestamp": "2019-07-01T17:03:04.527Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "account.updated", @@ -103,7 +103,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "account.disassociated", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json index 7e0796b4049..775111c2f25 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_channel.created", @@ -44,7 +44,7 @@ { "@timestamp": "2020-02-10T21:59:05.584Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_channel.updated", @@ -82,7 +82,7 @@ { "@timestamp": "2020-02-10T21:59:05.584Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_channel.deleted", @@ -120,7 +120,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_channel.member_invited", @@ -160,7 +160,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_channel.member_joined", @@ -198,7 +198,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_channel.member_left", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json index 20006257712..8922d5bbe2f 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-11T22:02:11.930Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_message.sent", @@ -45,7 +45,7 @@ { "@timestamp": "2020-02-11T23:00:08.594Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_message.updated", @@ -87,7 +87,7 @@ { "@timestamp": "2020-02-11T23:00:08.594Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "chat_message.updated", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json index 8b99429f81b..2dc97230527 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.alert", @@ -41,7 +41,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.created", @@ -84,7 +84,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.updated", @@ -141,7 +141,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.deleted", @@ -184,7 +184,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.started", @@ -223,7 +223,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.ended", @@ -263,7 +263,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.registration_created", @@ -313,7 +313,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.registration_approved", @@ -363,7 +363,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.registration_cancelled", @@ -409,7 +409,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.sharing_started", @@ -461,7 +461,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.sharing_ended", @@ -514,7 +514,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.participant_jbh_waiting", @@ -556,7 +556,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.participant_jbh_joined", @@ -598,7 +598,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.participant_joined", @@ -644,7 +644,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "meeting.participant_left", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json index 1fb2e252e90..38938f10f27 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.caller_ringing", @@ -49,7 +49,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.caller_connected", @@ -97,7 +97,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.caller_ringing", @@ -148,7 +148,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.callee_answered", @@ -196,7 +196,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.callee_missed", @@ -240,7 +240,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.callee_ended", @@ -288,7 +288,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.caller_ended", @@ -336,7 +336,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.callee_rejected", @@ -383,7 +383,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.voicemail_received", @@ -429,7 +429,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.caller_call_log_completed", @@ -453,7 +453,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "phone.callee_call_log_completed", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json index bed75aff08d..b9208031e17 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.started", @@ -46,7 +46,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.paused", @@ -89,7 +89,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.resumed", @@ -132,7 +132,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.stopped", @@ -177,7 +177,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.completed", @@ -224,7 +224,7 @@ { "@timestamp": "2019-12-04T23:00:57.395Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.renamed", @@ -269,7 +269,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.trashed", @@ -314,7 +314,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.deleted", @@ -359,7 +359,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.recovered", @@ -404,7 +404,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.transcript_completed", @@ -449,7 +449,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.registration_created", @@ -498,7 +498,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.registration_approved", @@ -547,7 +547,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "recording.registration_denied", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json index 663a510d519..a6f54e2becd 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.created", @@ -45,7 +45,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.invitation_accepted", @@ -87,7 +87,7 @@ { "@timestamp": "2019-07-19T18:10:54.861Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.updated", @@ -136,7 +136,7 @@ { "@timestamp": "2019-07-19T21:47:06.929Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.settings_updated", @@ -194,7 +194,7 @@ { "@timestamp": "2020-06-29T17:32:19.427Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.settings_updated", @@ -247,7 +247,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.deactivated", @@ -296,7 +296,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.activated", @@ -345,7 +345,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.disassociated", @@ -394,7 +394,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.deleted", @@ -443,7 +443,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.presence_status_updated", @@ -482,7 +482,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.personal_notes_updated", @@ -528,7 +528,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.signed_in", @@ -568,7 +568,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "user.signed_out", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json index 0087fccdaf2..21e55928680 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.created", @@ -45,7 +45,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.updated", @@ -99,7 +99,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.deleted", @@ -142,7 +142,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.started", @@ -183,7 +183,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.ended", @@ -224,7 +224,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.alert", @@ -260,7 +260,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.sharing_started", @@ -313,7 +313,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.sharing_started", @@ -366,7 +366,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.registration_created", @@ -417,7 +417,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.registration_approved", @@ -470,7 +470,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.registration_denied", @@ -521,7 +521,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.registration_cancelled", @@ -571,7 +571,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.participant_joined", @@ -619,7 +619,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "webinar.participant_left", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json index 3e2c2af63e5..0a4815ac045 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "zoomroom.alert", @@ -30,7 +30,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "zoomroom.delayed_alert", @@ -58,7 +58,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "zoomroom.checked_in", @@ -90,7 +90,7 @@ }, { "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "zoomroom.checked_in", diff --git a/packages/zoom/manifest.yml b/packages/zoom/manifest.yml index 075eac73c25..f539984b774 100644 --- a/packages/zoom/manifest.yml +++ b/packages/zoom/manifest.yml @@ -1,6 +1,6 @@ name: zoom title: Zoom -version: 1.4.1 +version: 1.5.0 release: ga description: Collect logs from Zoom with Elastic Agent. type: integration From 57214ff7d8f85afcd2bfde8f3b6663c53397af32 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:33:58 -0500 Subject: [PATCH 09/10] Updated Changelog, Manifest and pipeline tests for zscaler_zia --- packages/zscaler_zia/changelog.yml | 5 +++++ .../_dev/test/pipeline/test-alerts.log-expected.json | 6 +++--- .../pipeline/test-dns-http_endpoint.log-expected.json | 2 +- .../dns/_dev/test/pipeline/test-dns.log-expected.json | 2 +- .../test-firewall-http_endpoint.log-expected.json | 2 +- .../_dev/test/pipeline/test-firewall.log-expected.json | 2 +- .../test-tunnel-http_endpoint.log-expected.json | 2 +- .../_dev/test/pipeline/test-tunnel.log-expected.json | 6 +++--- .../pipeline/test-web-http_endpoint.log-expected.json | 2 +- .../web/_dev/test/pipeline/test-web.log-expected.json | 10 +++++----- packages/zscaler_zia/manifest.yml | 2 +- 11 files changed, 23 insertions(+), 18 deletions(-) diff --git a/packages/zscaler_zia/changelog.yml b/packages/zscaler_zia/changelog.yml index f03f8d1b092..2d984299993 100644 --- a/packages/zscaler_zia/changelog.yml +++ b/packages/zscaler_zia/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.4.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3872 - version: "2.3.1" changes: - description: Updated the documentation links in README file diff --git a/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json b/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json index 1c11d5c3d85..6ecd6ec8ab0 100644 --- a/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json +++ b/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json @@ -8,7 +8,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "original": "\u003c114\u003eDec 31 12:01:04 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes" @@ -41,7 +41,7 @@ "port": 9012 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "original": "\u003c114\u003eDec 31 13:02:05 [81.2.69.193] ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes" @@ -74,7 +74,7 @@ "ip": "81.2.69.193" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "original": "\u003c114\u003eDec 31 14:03:06 [81.2.69.193] Hey, that's a new type of alert. Isn't it?" diff --git a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http_endpoint.log-expected.json b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http_endpoint.log-expected.json index b83141b3957..bfa714db357 100644 --- a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http_endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http_endpoint.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json index 31cf33229b8..af5a49673af 100644 --- a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json +++ b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json @@ -34,7 +34,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http_endpoint.log-expected.json b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http_endpoint.log-expected.json index 24aefb223d2..f1ea0db1766 100644 --- a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http_endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http_endpoint.log-expected.json @@ -11,7 +11,7 @@ "port": 456 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "outofrange", diff --git a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json index fcc11db16e5..ef4d7fa34ae 100644 --- a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json +++ b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json @@ -11,7 +11,7 @@ "port": 443 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "drop", diff --git a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http_endpoint.log-expected.json b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http_endpoint.log-expected.json index 5c161b139e0..5ef597dc6b4 100644 --- a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http_endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http_endpoint.log-expected.json @@ -7,7 +7,7 @@ "ip": "0.0.0.0" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json index 6af12891d06..1fa0a324d28 100644 --- a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json +++ b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json @@ -6,7 +6,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -98,7 +98,7 @@ "port": 500 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -166,7 +166,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "IPsec tunnel is up", diff --git a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http_endpoint.log-expected.json b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http_endpoint.log-expected.json index fa37cdafbae..184aa5c4235 100644 --- a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http_endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http_endpoint.log-expected.json @@ -6,7 +6,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "blocked", diff --git a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json index 48c60c0cfb0..8a2172ad011 100644 --- a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json +++ b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json @@ -6,7 +6,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "blocked", @@ -122,7 +122,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "blocked", @@ -234,7 +234,7 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "blocked", @@ -350,7 +350,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "blocked", @@ -466,7 +466,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "action": "blocked", diff --git a/packages/zscaler_zia/manifest.yml b/packages/zscaler_zia/manifest.yml index 10f2c837c9a..a5acb5043f8 100644 --- a/packages/zscaler_zia/manifest.yml +++ b/packages/zscaler_zia/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: zscaler_zia title: Zscaler Internet Access -version: 2.3.1 +version: 2.4.0 license: basic description: Collect logs from Zscaler Internet Access (ZIA) with Elastic Agent. type: integration From 699e06100cd73a5526a1c7043c6381a4608f294c Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Wed, 27 Jul 2022 16:34:01 -0500 Subject: [PATCH 10/10] Updated Changelog, Manifest and pipeline tests for zscaler_zpa --- packages/zscaler_zpa/changelog.yml | 5 +++++ .../pipeline/test-app-connector-status.log-expected.json | 2 +- .../audit/_dev/test/pipeline/test-audit.log-expected.json | 4 ++-- .../_dev/test/pipeline/test-browser-access.log-expected.json | 2 +- .../_dev/test/pipeline/test-user-activity.log-expected.json | 2 +- .../_dev/test/pipeline/test-user-status.log-expected.json | 2 +- packages/zscaler_zpa/manifest.yml | 2 +- 7 files changed, 12 insertions(+), 7 deletions(-) diff --git a/packages/zscaler_zpa/changelog.yml b/packages/zscaler_zpa/changelog.yml index 21d2baba42a..eedcc5787ff 100644 --- a/packages/zscaler_zpa/changelog.yml +++ b/packages/zscaler_zpa/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.2.0" + changes: + - description: Update package to ECS 8.4.0 + type: enhancement + link: https://github.com/elastic/integrations/pull/3872 - version: "1.1.0" changes: - description: Update package to ECS 8.3.0. diff --git a/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json b/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json index 4134452043f..dd83221ac60 100644 --- a/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json +++ b/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json @@ -8,7 +8,7 @@ } }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "package", diff --git a/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 7bdcab05689..0996bb2c1bc 100644 --- a/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-11-17T04:29:38.000Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ @@ -63,7 +63,7 @@ { "@timestamp": "2021-11-17T04:29:38.000Z", "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json b/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json index 0e7c9e7a0e2..8e1cce1083a 100644 --- a/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json +++ b/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json @@ -19,7 +19,7 @@ "port": 60006 }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": [ diff --git a/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json b/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json index 31ec4328362..f10cd8c2693 100644 --- a/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json +++ b/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json @@ -13,7 +13,7 @@ "ip": "81.2.69.193" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "iam", diff --git a/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json b/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json index fc47906fedb..265225d25b6 100644 --- a/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json +++ b/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json @@ -13,7 +13,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.3.0" + "version": "8.4.0" }, "event": { "category": "iam", diff --git a/packages/zscaler_zpa/manifest.yml b/packages/zscaler_zpa/manifest.yml index 5ca3aff1d42..08029ebbf8c 100644 --- a/packages/zscaler_zpa/manifest.yml +++ b/packages/zscaler_zpa/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: zscaler_zpa title: "Zscaler Private Access" -version: "1.1.0" +version: "1.2.0" license: basic description: Collect logs from Zscaler Private Access (ZPA) with Elastic Agent. type: integration