search

logstash-plugins / logstash-patterns-core

Apache License 2.0
2.17k stars 979 forks source link

Feat: make firewall patterns ECS compliant (2/2) #296

Closed kares closed 3 years ago

kares commented 3 years ago

Second part of https://github.com/logstash-plugins/logstash-patterns-core/pull/293 to ECS-ize firewalls patterns.

There's still 2 types of unrelated captures here: various CISCO... patterns and NETSCREENSESSIONLOG.

Beats has no support for the type of Net-Screen logs we handle, as for the CISCO logs most (and more but not all) are supported as the Cisco Asa firewall fileset.

kares commented 3 years ago

// cc @ebeahan @webmat if you get a chance to review these, please - left some remarks in the comments ^^^