Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Swap source.bytes and destination.bytes traffic log mappings #32927

Merged
merged 3 commits into from
Sep 12, 2022

Commits on Aug 30, 2022

  1. Swap source.bytes and destination.bytes traffic log mappings

    This documentation currently mapps `Bytes Received` to `server.bytes` and `source.bytes` as well as `Bytes Sent` to `client.bytes` and `destination.bytes`. 
    
    This mapping is incorrect as per the [Palot Alto Docs](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields), `bytes_sent` is defined as `Number of bytes in the client-to-server direction of the session.` and matches the ECS definitions for `client.bytes` and `source.bytes` being bytes from `client/source => server/destination`. 
    
    Likewise, `bytes_received` is defined as `Number of bytes in the server-to-client direction of the session.` and matches the `destination.bytes` and `server.bytes` definitions in ECS being the bytes sent from `server/destination => client/source`.
    
    Furthermore, the [panw filebeat module mapping](https://github.com/elastic/beats/blob/v8.4.0/x-pack/filebeat/module/panw/panos/config/input.yml#L95) and [integration pipeline](https://github.com/elastic/integrations/blob/main/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/traffic.yml#L212) both follow the above conventions. 
    
    This proposed change will map `Bytes Received` to `destination.bytes` and `Bytes Sent` to `client.bytes`.
    asmith-elastic authored Aug 30, 2022
    Configuration menu
    Copy the full SHA
    9e85ca4 View commit details
    Browse the repository at this point in the history
  2. Swap source.bytes and destination.bytes traffic log mappings

    Swapping the values of `source.bytes` and `destination.bytes` in order to align the documentation with the changes implemented in #18525
    asmith-elastic authored Aug 30, 2022
    Configuration menu
    Copy the full SHA
    c7e6e27 View commit details
    Browse the repository at this point in the history

Commits on Sep 6, 2022

  1. Run make update

    dedemorton committed Sep 6, 2022
    Configuration menu
    Copy the full SHA
    7584c17 View commit details
    Browse the repository at this point in the history