Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow host.* fields to be disabled in Suricata module #19107

Merged
merged 1 commit into from
Jun 10, 2020
Merged

Allow host.* fields to be disabled in Suricata module #19107

merged 1 commit into from
Jun 10, 2020

Conversation

andrewkroh
Copy link
Member

What does this PR do?

If forwarded as configured as a tag (e.g. var.tags: [forwarded]) for the Suricata module then Filebeat will not add host fields to events. This is for use cases where Suricata is analyzing forwarded data (like from a network tap or mirror port).

Why is it important?

We want Filebeat to follow Elastic Common Schema. And setting host with the correct value is part of that. By setting (or not setting host) we can better interpret events. Without this change the Filebeat host is being attributed as the source even if data was received over a network tap or mirror port.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 10, 2020
@andrewkroh
Allow host.* fields to be disabled in Suricata module
95c8071 
If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Suricata module then Filebeat will not add `host` fields to events. This is for use cases where Suricata is analyzing forwarded data (like from a network tap or mirror port).

Relates: elastic#13920
@andrewkroh andrewkroh force-pushed the feature/fb/disable-host-suricata branch from 0ceef8a to 95c8071 Compare June 10, 2020 14:45
@andrewkroh andrewkroh added Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. review Team:SIEM labels Jun 10, 2020
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jun 10, 2020
@andrewkroh andrewkroh marked this pull request as ready for review June 10, 2020 14:46
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 10, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [andrewkroh commented: jenkins, run tests]

  • Start Time: 2020-06-10T15:35:49.057+0000

  • Duration: 58 min 10 sec

Test stats 🧪

Test Results
Failed 0
Passed 3827
Skipped 672
Total 4499

Steps errors

Expand to view the steps failures

  • Name: Report to Codecov

    • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

    • Duration: 1 min 27 sec

    • Start Time: 2020-06-10T16:07:17.813+0000

    • log

  • Name: Report to Codecov

    • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

    • Duration: 1 min 27 sec

    • Start Time: 2020-06-10T16:08:45.086+0000

    • log

@andrewkroh andrewkroh mentioned this pull request Jun 10, 2020
Open
@andrewkroh
Copy link
Member Author

jenkins, run tests

@andrewkroh andrewkroh merged commit 79d79bf into elastic:master Jun 10, 2020
v1v added a commit to v1v/beats that referenced this pull request Jun 12, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/fix-warni…
fd04fee 
…ngs-archive

* upstream/master: (119 commits)
  Update filebeat input docs (elastic#19110)
  Add ECS fields from log pipeline of PostgreSQL (elastic#19127)
  Init package libbeat/statestore (elastic#19117)
  [Ingest Manager] Retryable downloads of beats (elastic#19102)
  [DOCS] Add output.console to Functionbeat doc and Functionbeat reference file (elastic#18965)
  Add compatibility info (elastic#18929)
  Set ecszap version to v0.2.0 (elastic#19106)
  [filebeat][httpjson] Fix unit test function call (elastic#19124)
  [Filebeat][httpjson] Adds oauth2 support for httpjson input (elastic#18892)
  Allow host.* fields to be disabled in Suricata module (elastic#19107)
  Make selector string casing configurable (elastic#18854)
  Switch the GRPC communication where Agent is running the server and the beats are connecting back to Agent (elastic#18973)
  Disable host.* fields by default for netflow module (elastic#19087)
  Automatically fill zube teams on backports if available (elastic#18924)
  Fix crash on vsphere module (elastic#19078)
  [Ingest Manager] Download snapshot artifacts from snapshots repo (elastic#18685)
  [Ingest Manager] Basic Elastic Agent documentation (elastic#19030)
  Make user.id a string in system/users, in line with ECS (elastic#19019)
  [docs] Add 7.8 release highlights placeholder file (elastic#18493)
  Fix translate_sid's empty target field handling (elastic#18991)
  ...
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jun 18, 2020
@andrewkroh
Allow host.* fields to be disabled in Suricata module (elastic#19107)
5cf25c2 
If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Suricata module then Filebeat will not add `host` fields to events. This is for use cases where Suricata is analyzing forwarded data (like from a network tap or mirror port).

Relates: elastic#13920
(cherry picked from commit 79d79bf)
@andrewkroh andrewkroh mentioned this pull request Jun 18, 2020
Merged
5 tasks
@andrewkroh andrewkroh added v7.9.0 and removed needs_backport PR is waiting to be backported to other branches. labels Jun 18, 2020
andrewkroh added a commit that referenced this pull request Jun 26, 2020
@andrewkroh
Cherry-pick #19107 to 7.x: Allow host.* fields to be disabled in Suri…
5e4077d 
…cata module (#19293)

If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Suricata module then Filebeat will not add `host` fields to events. This is for use cases where Suricata is analyzing forwarded data (like from a network tap or mirror port).

Relates: #13920
(cherry picked from commit 79d79bf)
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@andrewkroh @melchiormoulin
Allow host.* fields to be disabled in Suricata module (elastic#19107)
8c27325 
If `forwarded` as configured as a tag (e.g. `var.tags: [forwarded]`) for the Suricata module then Filebeat will not add `host` fields to events. This is for use cases where Suricata is analyzing forwarded data (like from a network tap or mirror port).

Relates: elastic#13920
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees
No one assigned
Labels
Filebeat Filebeat review v7.9.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@andrewkroh @elasticmachine @marc-gr