Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #16907 to 7.x: [SIEM][CEF] Add support for Check Point devices #17111

Merged
merged 4 commits into from
Mar 20, 2020

Commits on Mar 19, 2020

  1. [SIEM][CEF] Add support for Check Point devices (elastic#16907)

    * Make CEF key name mapping case-insensitive
    
    There's some case inconsistency in CEF docs (i.e. C6a4Label). Better to
    ignore case when mapping keys to full names.
    
    * Add missing custom CEF extensions
    
    This adds:
     - `deviceCustomIPv6Address2(Label)`: Only 1, 3 and 4 were expected.
     - `flexNumber[12](Label)`: These two alternative custom numbers were
       dropped after V23 of the spec, but still used by some vendors.
    
    [Maybe unnecessary] changes:
    
     - Changed the case of `DeviceCustomNumber2` from uppercase as
       documented) to lowercase to align with the other fields.
    
    * CEF module: Support Check Point devices
    
    This adds a new ingest pipeline and fields to populate from Check Point
    CEF logs.
    
    Closes elastic#16041
    
    (cherry picked from commit f6fde2e)
    adriansr committed Mar 19, 2020
    Configuration menu
    Copy the full SHA
    c77551d View commit details
    Browse the repository at this point in the history
  2. Fix changelog

    adriansr committed Mar 19, 2020
    Configuration menu
    Copy the full SHA
    3d72e28 View commit details
    Browse the repository at this point in the history

Commits on Mar 20, 2020

  1. Restore entry from changelog

    adriansr committed Mar 20, 2020
    Configuration menu
    Copy the full SHA
    b8bf055 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    555e32b View commit details
    Browse the repository at this point in the history