Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[pfsense] Add SNORT log processing #11182

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

[pfsense] Add SNORT log processing #11182

wants to merge 3 commits into from
+248 −2

Conversation

aleksmaus
Copy link
Member

Proposed commit message

Add SNORT log processing

Didn't have any data samples in the original issue #10558, so had to look around and invent a couple.

It was not clear how to map some of the snort fields to ECS, mapped what was obvious and have put the rest under "snort" field similar to how it was done for "squid" logs.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues

@aleksmaus aleksmaus added enhancement New feature or request Integration:pfsense pfSense Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices] labels Sep 18, 2024
@aleksmaus aleksmaus self-assigned this Sep 18, 2024
@aleksmaus aleksmaus requested a review from a team as a code owner September 18, 2024 19:46
@elasticmachine
Copy link

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

@elasticmachine
Copy link

💚 Build Succeeded

cc @aleksmaus

@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
83.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh Awaiting requested review from andrewkroh

At least 1 approving review is required to merge this pull request.

Assignees

@aleksmaus aleksmaus

Labels
enhancement New feature or request Integration:pfsense pfSense Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[pfSense] SNORT log processing
3 participants
@aleksmaus @elasticmachine @andrewkroh