Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Updates to Suricata module #20220

Merged
merged 2 commits into from
Jul 29, 2020
Merged

[Filebeat] Updates to Suricata module #20220

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
75f2b79
Updates to Suricata module
andrewkroh Jul 23, 2020
5b53e24
Always remove event.ingested from test data
andrewkroh Jul 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -491,6 +491,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Add initial support for configurable file identity tracking. {pull}18748[18748]
- Add event.ingested for CrowdStrike module {pull}20138[20138]
- Add support for additional fields and FirewallMatchEvent type events in CrowdStrike module {pull}20138[20138]
- Add event.ingested for Suricata module {pull}20220[20220]

*Heartbeat*

Expand Down
Binary file modified filebeat/docs/images/filebeat-suricata-alerts.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file modified filebeat/docs/images/filebeat-suricata-events.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
4 changes: 1 addition & 3 deletions filebeat/tests/system/test_modules.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ def clean_keys(obj):
host_keys.append("host.name")

# The create timestamps area always new
time_keys = ["event.created"]
time_keys = ["event.created", "event.ingested"]
# source path and agent.version can be different for each run
other_keys = ["log.file.path", "agent.version"]
# ECS versions change for any ECS release, large or small
Expand Down Expand Up @@ -276,8 +276,6 @@ def clean_keys(obj):
delete_key(obj, "@timestamp")
# Also remove alternate time field from rsa parsers.
delete_key(obj, "rsa.time.event_time")
# Remove event.ingested from testing, as it will never be the same.
delete_key(obj, "event.ingested")
else:
# excluded events need to have their filename saved to the expected.json
# so that the exception mechanism can be triggered when the json is
Expand Down
Loading