[Filebeat] Add dashboards to CEF module #14342
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
andrewkroh
force-pushed
the
feature/fb/cef-module-dashboards
branch
from
59559b7
to
b0df5af
Compare
|
Pinging @elastic/siem (Team:SIEM) |
andrewkroh
force-pushed
the
feature/fb/cef-module-dashboards
branch
from
a36306f
to
ca9a036
Compare
andrewkroh
force-pushed
the
feature/fb/cef-module-dashboards
branch
from
efc0791
to
715f046
Compare
adriansr
approved these changes
Nov 25, 2019
| @@ -401,6 +402,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d | |||
| - Add `index` option to all inputs to directly set a per-input index value. {pull}14010[14010] | |||
| - Remove beta flag for some filebeat modules. {pull}14374[14374] | |||
| - Add attack_pattern_kql field to MISP threat indicators. {pull}14470[14470] | |||
| - Add dashboards to the CEF module (ported from the Logstash ArcSight module). | |||
Load dashboards to Kibana 8 via Logstash module setup. Then use mage exportDashboard to download each of them to Beats.
Previously all of cef.extensions.* were string values. Now it uses the data types that are defined for each CEF field to do the translation within the processor. If the field is not the correct data type then the value is dropped from the event in order to avoid mapping exceptions at index time.
These fields aren't specifically in CEF. They are commonly used in ArcSight.
andrewkroh
force-pushed
the
feature/fb/cef-module-dashboards
branch
from
715f046
to
6f9d1b8
Compare
andrewkroh
added
the
needs_backport
andrewkroh
added
v7.6.0
and removed
needs_backport
andrewkroh
added a commit
to andrewkroh/beats
that referenced
this pull request
Jan 8, 2020
* Import Arcsight module dashboards from Logstash Load dashboards to Kibana 8 via Logstash module setup. Then use mage exportDashboard to download each of them to Beats. * Change index pattern from arcsight-* to filebeat-* * Make UUIDs unique from Logstash module * Change [ArcSight] to [Filebeat CEF] in titles * Fix dashboard IDs in navigation * Update field names in dashboards * Convert CEF extension value data types Previously all of cef.extensions.* were string values. Now it uses the data types that are defined for each CEF field to do the translation within the processor. If the field is not the correct data type then the value is dropped from the event in order to avoid mapping exceptions at index time. * Add fields for ArcSight to the mapping These fields aren't specifically in CEF. They are commonly used in ArcSight. * Exclude cef.extension fields from default_field and update dashboards * Add descriptions to dashboards (cherry picked from commit a77de0d)
andrewkroh
added a commit
that referenced
this pull request
Jan 8, 2020
* Import Arcsight module dashboards from Logstash Load dashboards to Kibana 8 via Logstash module setup. Then use mage exportDashboard to download each of them to Beats. * Change index pattern from arcsight-* to filebeat-* * Make UUIDs unique from Logstash module * Change [ArcSight] to [Filebeat CEF] in titles * Fix dashboard IDs in navigation * Update field names in dashboards * Convert CEF extension value data types Previously all of cef.extensions.* were string values. Now it uses the data types that are defined for each CEF field to do the translation within the processor. If the field is not the correct data type then the value is dropped from the event in order to avoid mapping exceptions at index time. * Add fields for ArcSight to the mapping These fields aren't specifically in CEF. They are commonly used in ArcSight. * Exclude cef.extension fields from default_field and update dashboards * Add descriptions to dashboards (cherry picked from commit a77de0d)
|
@jamiesmith, I wanted to bring this to your attention because I recall getting your help last year with a screenshot of a dashboard of CEF-formatted data and figure that you might find it helpful to know. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This migrates the dashboards from the Logstash ArcSight module into the Filebeat CEF module.
Breaking Change: The mapping for the
cef.extension.*fields was changed from allkeywordtypes to match the data types defined in the CEF guide. Thedecode_cefprocessor will convert the strings to the correct data type. If any value does not convert then that field is dropped anderror.messageis updated with info about the failure.And because of the limit on field expansion in Elasticsearch queries the
cef.extension.*fields are excluded fromdefault_fieldin Filebeat's index template.