[netflow]: Append all ip addresses found to the related.ip field.

elastic / integrations

Elastic Integrations

https://www.elastic.co/integrations

Other

196 stars 424 forks source link

[netflow]: Append all ip addresses found to the related.ip field. #11193

Closed aleksmaus closed 5 days ago

aleksmaus commented 1 week ago

Proposed commit message

Append all ip addresses found to the related.ip field.

I was not sure if the original issue meant specific fields, if yes then ipv6 was not included in the list.

Anyways, in the first cut appending all the fields that end with *_ipv4_address or *_ipv6_address. Can redo if the list of the fields limited to just: netflow.post_nat_destination_ipv4_address , netflow.post_nat_source_ipv4_address, netflow.post_nat_destination_ipv6_address , netflow.post_nat_source_ipv6_address.

Let me know.

Checklist

[x] I have reviewed tips for building integrations and this pull request is aligned with them.
[x] I have verified that all data streams collect metrics or logs.
[x] I have added an entry to my package's changelog.yml file.
[x] I have verified that Kibana version constraints are current according to guidelines.

Related issues

Closes https://github.com/elastic/integrations/issues/9202

elasticmachine commented 1 week ago

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

elastic-vault-github-plugin-prod[bot] commented 1 week ago

:rocket: Benchmarks report

To see the full report comment with /test benchmark fullreport

aleksmaus commented 5 days ago

Do we want to handle observer.ip as well?

I don't know what are the rules. Do we usually add that related.ip? The original ticket doesn't say anything about this.

taylor-swanson commented 5 days ago

I poked around other integrations. While we're not great at setting related fields, I am seeing other integrations adding observer fields to the related fields, so we should do the same here. If you don't want to mess with the painless script, you could add an append processor for observer.ip instead.

taylor-swanson commented 5 days ago

This is what ECS says about related.ip: