Skip to content

Commit c71e855

Browse files
bhapasbhapas
committed
Add CEF spec 1.x fields
1 parent 1687e5d commit c71e855

File tree

2 files changed

+34
-8
lines changed

2 files changed

+34
-8
lines changed

‎modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,8 @@ enum DataType {
118118
entry("agentZoneURI", new ExtensionMapping("agentZoneURI", StringType, null)),
119119
entry("app", new ExtensionMapping("applicationProtocol", StringType, "network.protocol")),
120120
entry("cnt", new ExtensionMapping("baseEventCount", IntegerType, null)),
121-
entry("in", new ExtensionMapping("bytesIn", IntegerType, "source.bytes")),
122-
entry("out", new ExtensionMapping("bytesOut", IntegerType, "destination.bytes")),
121+
entry("in", new ExtensionMapping("bytesIn", LongType, "source.bytes")), // LongType from Spec 1.x
122+
entry("out", new ExtensionMapping("bytesOut", LongType, "destination.bytes")), // LongType from Spec 1.x
123123
entry("customerExternalID", new ExtensionMapping("customerExternalID", StringType, "organization.id")),
124124
entry("customerURI", new ExtensionMapping("customerURI", StringType, "organization.name")),
125125
entry("dst", new ExtensionMapping("destinationAddress", IPType, "destination.ip")),
@@ -266,7 +266,19 @@ enum DataType {
266266
entry("proto", new ExtensionMapping("transportProtocol", StringType, "network.transport")),
267267
entry("type", new ExtensionMapping("type", StringType, "event.kind")),
268268
entry("catdt", new ExtensionMapping("categoryDeviceType", StringType, null)),
269-
entry("mrt", new ExtensionMapping("managerReceiptTime", TimestampType, "event.ingested"))
269+
entry("mrt", new ExtensionMapping("managerReceiptTime", TimestampType, "event.ingested")),
270+
// CEF Spec version 1.2
271+
entry("agentTranslatedZoneKey", new ExtensionMapping("agentTranslatedZoneKey", LongType, null)),
272+
entry("agentZoneKey", new ExtensionMapping("agentZoneKey", LongType, null)),
273+
entry("customerKey", new ExtensionMapping("customerKey", LongType, null)),
274+
entry("destinationTranslatedZoneKey", new ExtensionMapping("destinationTranslatedZoneKey", LongType, null)),
275+
entry("dZoneKey", new ExtensionMapping("destinationZoneKey", LongType, null)),
276+
entry("deviceTranslatedZoneKey", new ExtensionMapping("deviceTranslatedZoneKey", LongType, null)),
277+
entry("deviceZoneKey", new ExtensionMapping("deviceZoneKey", LongType, null)),
278+
entry("sTranslatedZoneKey", new ExtensionMapping("sourceTranslatedZoneKey", LongType, null)),
279+
entry("sZoneKey", new ExtensionMapping("sourceZoneKey", LongType, null)),
280+
entry("parserVersion", new ExtensionMapping("parserVersion", StringType, null)),
281+
entry("parserIdentifier", new ExtensionMapping("parserIdentifier", StringType, null))
270282
);
271283

272284
private static final String INCOMPLETE_CEF_HEADER = "Incomplete CEF header";

‎modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/CefProcessorTests.java‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,8 @@ public void testStandardMessage() {
109109
)
110110
),
111111
entry("observer", Map.of("product", "threatmanager", "vendor", "security", "version", "1.0")),
112-
entry("source", Map.of("ip", "10.0.0.192", "port", 1232, "bytes", 4294)),
113-
entry("destination", Map.of("ip", "12.121.122.82", "bytes", 4294)),
112+
entry("source", Map.of("ip", "10.0.0.192", "port", 1232, "bytes", 4294L)),
113+
entry("destination", Map.of("ip", "12.121.122.82", "bytes", 4294L)),
114114
entry("event", Map.of("id", "1", "code", "100")),
115115
entry("message", message)
116116
)
@@ -737,7 +737,10 @@ public void testAllFieldsInExtension() {
737737
+ "sproc=sourceProc sourceServiceName=sourceService "
738738
+ "sourceTranslatedAddress=10.0.0.4 sourceTranslatedPort=8081 sourceTranslatedZoneExternalID=sourceExtId "
739739
+ "sourceTranslatedZoneURI=sourceUri suid=sourceUserId suser=sourceUser spriv=sourcePriv sourceZoneExternalID=sourceZoneExtId "
740-
+ "sourceZoneURI=sourceZoneUri start=1622547800000 proto=TCP type=1 catdt=catDeviceType mrt=1622547800000";
740+
+ "sourceZoneURI=sourceZoneUri start=1622547800000 proto=TCP type=1 catdt=catDeviceType mrt=1622547800000 "
741+
+ "agentTranslatedZoneKey=54854 agentZoneKey=54855 customerKey=54866 destinationTranslatedZoneKey=54867 "
742+
+ "dZoneKey=54877 deviceTranslatedZoneKey=54898 deviceZoneKey=54899 sTranslatedZoneKey=54998 sZoneKey=546986 "
743+
+ "parserVersion=1.x.2 parserIdentifier=ABC123";
741744
Map<String, Object> source = new HashMap<>();
742745
source.put("message", message);
743746
document = new IngestDocument("index", "id", 1L, null, null, source);
@@ -759,6 +762,17 @@ public void testAllFieldsInExtension() {
759762
entry(
760763
"extensions",
761764
Map.ofEntries(
765+
entry("agentTranslatedZoneKey", 54854L),
766+
entry("agentZoneKey", 54855L),
767+
entry("customerKey", 54866L),
768+
entry("destinationTranslatedZoneKey", 54867L),
769+
entry("destinationZoneKey", 54877L),
770+
entry("deviceTranslatedZoneKey", 54898L),
771+
entry("deviceZoneKey", 54899L),
772+
entry("sourceTranslatedZoneKey", 54998L),
773+
entry("sourceZoneKey", 546986L),
774+
entry("parserVersion", "1.x.2"),
775+
entry("parserIdentifier", "ABC123"),
762776
entry("deviceNtDomain", "example.org"),
763777
entry("agentZoneExternalID", "zoneExtId"),
764778
entry("agentTimeZone", "UTC"),
@@ -878,7 +892,7 @@ public void testAllFieldsInExtension() {
878892
entry("registered_domain", "destNtDomain"),
879893
entry("process", Map.of("name", "destProc", "pid", 1234)),
880894
entry("port", 80),
881-
entry("bytes", 91011),
895+
entry("bytes", 91011L),
882896
entry("service", Map.of("name", "destService")),
883897
entry("domain", "destHost"),
884898
entry("ip", "192.168.0.2"),
@@ -895,7 +909,7 @@ public void testAllFieldsInExtension() {
895909
entry("process", Map.of("name", "sourceProc", "pid", 1234)),
896910
entry("port", 443),
897911
entry("service", Map.of("name", "sourceService")),
898-
entry("bytes", 5678),
912+
entry("bytes", 5678L),
899913
entry("ip", "192.168.0.4"),
900914
entry("domain", "sourceDomain"),
901915
entry("user", Map.of("name", "sourceUser", "id", "sourceUserId", "group", Map.of("name", "sourcePriv"))),

0 commit comments

Comments
 (0)