Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow host.* fields to be disabled in Zeek module #19113

Merged
merged 2 commits into from
Jun 12, 2020

Conversation

andrewkroh
Copy link
Member

What does this PR do?

If forwarded as configured as a tag (e.g. var.tags: [forwarded]) for the Zeek module then Filebeat will not add host fields to events. This is for use cases where Zeek is analyzing forwarded data (like from a network tap or mirror port).

Why is it important?

We want Filebeat to follow Elastic Common Schema. And setting host with the correct value is part of that. By setting (or not setting host) we can better interpret events. Without this change the Filebeat host is being attributed as the source even if data was received over a network tap or mirror port.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 10, 2020
If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Zeek module then Filebeat will not add `host` fields to events. This is for use cases where Zeek is analyzing forwarded data (like from a network tap or mirror port).

Relates: elastic#13920
@andrewkroh andrewkroh force-pushed the feature/fb/disable-host-zeek branch from 1f26175 to 0a6df63 Compare June 10, 2020 15:32
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jun 10, 2020
@andrewkroh andrewkroh marked this pull request as ready for review June 10, 2020 15:32
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 10, 2020

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #19113 updated]

  • Start Time: 2020-06-11T15:42:43.475+0000

  • Duration: 52 min 48 sec

Test stats 🧪

Test Results
Failed 0
Passed 2342
Skipped 382
Total 2724

@andrewkroh andrewkroh merged commit 018b17c into elastic:master Jun 12, 2020
v1v added a commit to v1v/beats that referenced this pull request Jun 15, 2020
…ngs-archive

* upstream/master:
  Fix minor spelling error in Jenkinsfile (elastic#19153)
  [CI] fail if not possible to install python3 (elastic#19164)
  [Elastic Agent] Improved mage demo experience (elastic#18445)
  [yum] Clear cached data and add retry loop (elastic#19182)
  fix lint job by updating NOTICE (elastic#19161)
  Fix tags for coredns/envoyproxy (elastic#19134)
  Disable host.* fields by default for CrowdStrike module (elastic#19132)
  Allow host.* fields to be disabled in Zeek module (elastic#19113)
  Rename to management.Manager, add UpdateStatus to Manager interface. (elastic#19114)
  Edit Elastic Agent docs (elastic#19146)
  [JJBB] create job definition for the golang-crossbuild project (elastic#19162)
  Fix incorrect usage of hints builder when exposed port is a substring of the hint (elastic#19052)
  Add basic cloudfoundry integration tests (elastic#19018)
@andrewkroh andrewkroh added the needs_backport PR is waiting to be backported to other branches. label Jun 18, 2020
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jun 18, 2020
If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Zeek module then Filebeat will not add `host` fields to events. This is for use cases where Zeek is analyzing forwarded data (like from a network tap or mirror port).

Relates: elastic#13920
(cherry picked from commit 018b17c)
@andrewkroh andrewkroh added v7.9.0 and removed needs_backport PR is waiting to be backported to other branches. labels Jun 18, 2020
andrewkroh added a commit that referenced this pull request Jun 26, 2020
If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Zeek module then Filebeat will not add `host` fields to events. This is for use cases where Zeek is analyzing forwarded data (like from a network tap or mirror port).

Relates: #13920
(cherry picked from commit 018b17c)
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Zeek module then Filebeat will not add `host` fields to events. This is for use cases where Zeek is analyzing forwarded data (like from a network tap or mirror port).

Relates: elastic#13920
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants