Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[1.x] Specify MAC address format (#456) #1260

Merged
merged 1 commit into from
Feb 11, 2021
Merged

[1.x] Specify MAC address format (#456) #1260

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ Thanks, you're awesome :-) -->

#### Improvements

* Include formatting guidance and examples for MAC address fields. #456

#### Deprecated


Expand Down
4 changes: 4 additions & 0 deletions code/go/ecs/client.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions code/go/ecs/destination.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 5 additions & 1 deletion code/go/ecs/host.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 11 additions & 7 deletions code/go/ecs/observer.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions code/go/ecs/server.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions code/go/ecs/source.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

36 changes: 24 additions & 12 deletions docs/field-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -375,11 +375,13 @@ type: ip

| MAC address of the client.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down Expand Up @@ -1067,11 +1069,13 @@ type: ip

| MAC address of the destination.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down Expand Up @@ -3263,7 +3267,9 @@ Note: this field should contain an array of values.
[[field-host-mac]]
<<field-host-mac, host.mac>>

| Host mac addresses.
| Host MAC addresses.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

Expand All @@ -3272,7 +3278,7 @@ Note: this field should contain an array of values.




example: `["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`

| core

Expand Down Expand Up @@ -4238,7 +4244,7 @@ This could be a custom hardware appliance or a server that has been configured t
[[field-observer-egress]]
<<field-observer-egress, observer.egress>>

| Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.
| Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

type: object

Expand All @@ -4254,7 +4260,7 @@ type: object
[[field-observer-egress-zone]]
<<field-observer-egress-zone, observer.egress.zone>>

| Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.
| Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.

type: keyword

Expand Down Expand Up @@ -4286,7 +4292,7 @@ type: keyword
[[field-observer-ingress]]
<<field-observer-ingress, observer.ingress>>

| Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.
| Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

type: object

Expand All @@ -4302,7 +4308,7 @@ type: object
[[field-observer-ingress-zone]]
<<field-observer-ingress-zone, observer.ingress.zone>>

| Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.
| Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.

type: keyword

Expand Down Expand Up @@ -4337,7 +4343,9 @@ Note: this field should contain an array of values.
[[field-observer-mac]]
<<field-observer-mac, observer.mac>>

| MAC addresses of the observer
| MAC addresses of the observer.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

Expand All @@ -4346,7 +4354,7 @@ Note: this field should contain an array of values.




example: `["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`

| core

Expand Down Expand Up @@ -5965,11 +5973,13 @@ type: ip

| MAC address of the server.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down Expand Up @@ -6376,11 +6386,13 @@ type: ip

| MAC address of the source.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down
64 changes: 50 additions & 14 deletions experimental/generated/beats/fields.ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the client.
description: 'MAC address of the client.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down Expand Up @@ -785,7 +791,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the destination.
description: 'MAC address of the destination.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down Expand Up @@ -2338,7 +2350,13 @@
level: core
type: keyword
ignore_above: 1024
description: Host mac addresses.
description: 'Host MAC addresses.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
- name: name
level: core
type: keyword
Expand Down Expand Up @@ -2965,9 +2983,9 @@
level: extended
type: object
description: Observer.egress holds information like interface number and name,
vlan, and zone information to classify egress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress
to categorize traffic.
vlan, and zone information to classify egress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress to
categorize traffic.
default_field: false
- name: egress.interface.alias
level: extended
Expand Down Expand Up @@ -3011,7 +3029,7 @@
type: keyword
ignore_above: 1024
description: Network zone of outbound traffic as reported by the observer to
categorize the destination area of egress traffic, e.g. Internal, External,
categorize the destination area of egress traffic, e.g. Internal, External,
DMZ, HR, Legal, etc.
example: Public_Internet
default_field: false
Expand Down Expand Up @@ -3100,9 +3118,9 @@
level: extended
type: object
description: Observer.ingress holds information like interface number and name,
vlan, and zone information to classify ingress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress
to categorize traffic.
vlan, and zone information to classify ingress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress to
categorize traffic.
default_field: false
- name: ingress.interface.alias
level: extended
Expand Down Expand Up @@ -3146,7 +3164,7 @@
type: keyword
ignore_above: 1024
description: Network zone of incoming traffic as reported by the observer to
categorize the source area of ingress traffic. e.g. internal, External, DMZ,
categorize the source area of ingress traffic. e.g. internal, External, DMZ,
HR, Legal, etc.
example: DMZ
default_field: false
Expand All @@ -3158,7 +3176,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC addresses of the observer
description: 'MAC addresses of the observer.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
- name: name
level: extended
type: keyword
Expand Down Expand Up @@ -4381,7 +4405,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the server.
description: 'MAC address of the server.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down Expand Up @@ -4734,7 +4764,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the source.
description: 'MAC address of the source.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down
Loading