search

elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
28 stars 445 forks source link

aws vpcflow integration should properly set event.type #5478

Open gsjlusky opened 1 year ago

gsjlusky commented 1 year ago

For aws vpcflow integration with aws.vpcflow.action:REJECT, I only see event.outcome:failure. It should set event.type based on aws.vpcflow.action.

aws.vpcflow.action can be ACCEPT or REJECT according to https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html

@jamiehynds

elasticmachine commented 1 year ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)