Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Define base encoding in x509.serial_number #2383

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Define base encoding in x509.serial_number #2383

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
04423b0
Define base encoding in x509.serial_number
haesbaert Sep 17, 2024
89f9df5
CHANGELOG.next.md entry
haesbaert Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ Thanks, you're awesome :-) -->

#### Improvements

* Define base encoding of `x509.serial_number`. #2383

#### Deprecated

### Tooling and Artifact Changes
Expand Down
2 changes: 1 addition & 1 deletion docs/fields/field-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13803,7 +13803,7 @@ example: `2048`
[[field-x509-serial-number]]
<<field-x509-serial-number, x509.serial_number>>

a| Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.
a| Unique serial number issued by the certificate authority. For consistency, this should be encoded in base 16 and formatted without colons and uppercase characters.

type: keyword

Expand Down
14 changes: 7 additions & 7 deletions experimental/generated/beats/fields.ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3337,7 +3337,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -9979,7 +9979,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -10536,7 +10536,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -11600,7 +11600,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -12168,7 +12168,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -12584,7 +12584,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -12866,7 +12866,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down
21 changes: 7 additions & 14 deletions experimental/generated/ecs/ecs_flat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5508,8 +5508,7 @@ file.x509.public_key_size:
file.x509.serial_number:
dashed_name: file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: file.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -16155,8 +16154,7 @@ threat.enrichments.indicator.file.x509.public_key_size:
threat.enrichments.indicator.file.x509.serial_number:
dashed_name: threat-enrichments-indicator-file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.enrichments.indicator.file.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -17082,8 +17080,7 @@ threat.enrichments.indicator.x509.public_key_size:
threat.enrichments.indicator.x509.serial_number:
dashed_name: threat-enrichments-indicator-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.enrichments.indicator.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -18891,8 +18888,7 @@ threat.indicator.file.x509.public_key_size:
threat.indicator.file.x509.serial_number:
dashed_name: threat-indicator-file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.indicator.file.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -19834,8 +19830,7 @@ threat.indicator.x509.public_key_size:
threat.indicator.x509.serial_number:
dashed_name: threat-indicator-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.indicator.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -20525,8 +20520,7 @@ tls.client.x509.public_key_size:
tls.client.x509.serial_number:
dashed_name: tls-client-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: tls.client.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -21002,8 +20996,7 @@ tls.server.x509.public_key_size:
tls.server.x509.serial_number:
dashed_name: tls-server-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: tls.server.x509.serial_number
ignore_above: 1024
Expand Down
16 changes: 8 additions & 8 deletions experimental/generated/ecs/ecs_nested.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6555,7 +6555,7 @@ file:
file.x509.serial_number:
dashed_name: file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: file.x509.serial_number
Expand Down Expand Up @@ -18857,7 +18857,7 @@ threat:
threat.enrichments.indicator.file.x509.serial_number:
dashed_name: threat-enrichments-indicator-file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.enrichments.indicator.file.x509.serial_number
Expand Down Expand Up @@ -19788,7 +19788,7 @@ threat:
threat.enrichments.indicator.x509.serial_number:
dashed_name: threat-enrichments-indicator-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.enrichments.indicator.x509.serial_number
Expand Down Expand Up @@ -21599,7 +21599,7 @@ threat:
threat.indicator.file.x509.serial_number:
dashed_name: threat-indicator-file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.indicator.file.x509.serial_number
Expand Down Expand Up @@ -22546,7 +22546,7 @@ threat:
threat.indicator.x509.serial_number:
dashed_name: threat-indicator-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.indicator.x509.serial_number
Expand Down Expand Up @@ -23301,7 +23301,7 @@ tls:
tls.client.x509.serial_number:
dashed_name: tls-client-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: tls.client.x509.serial_number
Expand Down Expand Up @@ -23781,7 +23781,7 @@ tls:
tls.server.x509.serial_number:
dashed_name: tls-server-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: tls.server.x509.serial_number
Expand Down Expand Up @@ -25699,7 +25699,7 @@ x509:
x509.serial_number:
dashed_name: x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: x509.serial_number
Expand Down
14 changes: 7 additions & 7 deletions generated/beats/fields.ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3287,7 +3287,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -9929,7 +9929,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -10486,7 +10486,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -11550,7 +11550,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -12118,7 +12118,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -12534,7 +12534,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down Expand Up @@ -12816,7 +12816,7 @@
type: keyword
ignore_above: 1024
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
this should be encoded in base 16 and formatted without colons and uppercase
characters.
example: 55FBB9C7DEBF09809D12CCAA
default_field: false
Expand Down
21 changes: 7 additions & 14 deletions generated/ecs/ecs_flat.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5439,8 +5439,7 @@ file.x509.public_key_size:
file.x509.serial_number:
dashed_name: file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: file.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -16086,8 +16085,7 @@ threat.enrichments.indicator.file.x509.public_key_size:
threat.enrichments.indicator.file.x509.serial_number:
dashed_name: threat-enrichments-indicator-file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.enrichments.indicator.file.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -17013,8 +17011,7 @@ threat.enrichments.indicator.x509.public_key_size:
threat.enrichments.indicator.x509.serial_number:
dashed_name: threat-enrichments-indicator-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.enrichments.indicator.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -18822,8 +18819,7 @@ threat.indicator.file.x509.public_key_size:
threat.indicator.file.x509.serial_number:
dashed_name: threat-indicator-file-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.indicator.file.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -19765,8 +19761,7 @@ threat.indicator.x509.public_key_size:
threat.indicator.x509.serial_number:
dashed_name: threat-indicator-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: threat.indicator.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -20456,8 +20451,7 @@ tls.client.x509.public_key_size:
tls.client.x509.serial_number:
dashed_name: tls-client-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: tls.client.x509.serial_number
ignore_above: 1024
Expand Down Expand Up @@ -20933,8 +20927,7 @@ tls.server.x509.public_key_size:
tls.server.x509.serial_number:
dashed_name: tls-server-x509-serial-number
description: Unique serial number issued by the certificate authority. For consistency,
if this value is alphanumeric, it should be formatted without colons and uppercase
characters.
this should be encoded in base 16 and formatted without colons and uppercase characters.
example: 55FBB9C7DEBF09809D12CCAA
flat_name: tls.server.x509.serial_number
ignore_above: 1024
Expand Down
Loading