Skip to content

Commit

Permalink
Specify MAC address format (elastic#456)
Browse files Browse the repository at this point in the history 
Co-authored-by: Eric Beahan <eric.beahan@elastic.co>
# Conflicts:
#	experimental/generated/csv/fields.csv
#	generated/csv/fields.csv
  • Loading branch information
@ypid-geberit @ebeahan
ypid-geberit authored and ebeahan committed Feb 11, 2021
1 parent 90db312 commit 37eccc1
Show file tree
Hide file tree
Showing 22 changed files with 413 additions and 131 deletions.
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ Thanks, you're awesome :-) -->

#### Improvements

* Include formatting guidance and examples for MAC address fields. #456

#### Deprecated


Expand Down
4 changes: 4 additions & 0 deletions code/go/ecs/client.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions code/go/ecs/destination.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 5 additions & 1 deletion code/go/ecs/host.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 11 additions & 7 deletions code/go/ecs/observer.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions code/go/ecs/server.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions code/go/ecs/source.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

36 changes: 24 additions & 12 deletions docs/field-details.asciidoc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -375,11 +375,13 @@ type: ip

| MAC address of the client.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down Expand Up @@ -1067,11 +1069,13 @@ type: ip

| MAC address of the destination.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down Expand Up @@ -3263,7 +3267,9 @@ Note: this field should contain an array of values.
[[field-host-mac]]
<<field-host-mac, host.mac>>

| Host mac addresses.
| Host MAC addresses.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

Expand All @@ -3272,7 +3278,7 @@ Note: this field should contain an array of values.




example: `["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`

| core

Expand Down Expand Up @@ -4238,7 +4244,7 @@ This could be a custom hardware appliance or a server that has been configured t
[[field-observer-egress]]
<<field-observer-egress, observer.egress>>

| Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.
| Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

type: object

Expand All @@ -4254,7 +4260,7 @@ type: object
[[field-observer-egress-zone]]
<<field-observer-egress-zone, observer.egress.zone>>

| Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.
| Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.

type: keyword

Expand Down Expand Up @@ -4286,7 +4292,7 @@ type: keyword
[[field-observer-ingress]]
<<field-observer-ingress, observer.ingress>>

| Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.
| Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

type: object

Expand All @@ -4302,7 +4308,7 @@ type: object
[[field-observer-ingress-zone]]
<<field-observer-ingress-zone, observer.ingress.zone>>

| Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.
| Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.

type: keyword

Expand Down Expand Up @@ -4337,7 +4343,9 @@ Note: this field should contain an array of values.
[[field-observer-mac]]
<<field-observer-mac, observer.mac>>

| MAC addresses of the observer
| MAC addresses of the observer.

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword

Expand All @@ -4346,7 +4354,7 @@ Note: this field should contain an array of values.




example: `["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`

| core

Expand Down Expand Up @@ -5965,11 +5973,13 @@ type: ip

| MAC address of the server.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down Expand Up @@ -6376,11 +6386,13 @@ type: ip

| MAC address of the source.

type: keyword
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

type: keyword



example: `00-00-5E-00-53-23`

| core

Expand Down
64 changes: 50 additions & 14 deletions experimental/generated/beats/fields.ecs.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the client.
description: 'MAC address of the client.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down Expand Up @@ -785,7 +791,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the destination.
description: 'MAC address of the destination.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down Expand Up @@ -2338,7 +2350,13 @@
level: core
type: keyword
ignore_above: 1024
description: Host mac addresses.
description: 'Host MAC addresses.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
- name: name
level: core
type: keyword
Expand Down Expand Up @@ -2965,9 +2983,9 @@
level: extended
type: object
description: Observer.egress holds information like interface number and name,
vlan, and zone information to classify egress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress
to categorize traffic.
vlan, and zone information to classify egress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress to
categorize traffic.
default_field: false
- name: egress.interface.alias
level: extended
Expand Down Expand Up @@ -3011,7 +3029,7 @@
type: keyword
ignore_above: 1024
description: Network zone of outbound traffic as reported by the observer to
categorize the destination area of egress traffic, e.g. Internal, External,
categorize the destination area of egress traffic, e.g. Internal, External,
DMZ, HR, Legal, etc.
example: Public_Internet
default_field: false
Expand Down Expand Up @@ -3100,9 +3118,9 @@
level: extended
type: object
description: Observer.ingress holds information like interface number and name,
vlan, and zone information to classify ingress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress
to categorize traffic.
vlan, and zone information to classify ingress traffic. Single armed monitoring
such as a network sensor on a span port should only use observer.ingress to
categorize traffic.
default_field: false
- name: ingress.interface.alias
level: extended
Expand Down Expand Up @@ -3146,7 +3164,7 @@
type: keyword
ignore_above: 1024
description: Network zone of incoming traffic as reported by the observer to
categorize the source area of ingress traffic. e.g. internal, External, DMZ,
categorize the source area of ingress traffic. e.g. internal, External, DMZ,
HR, Legal, etc.
example: DMZ
default_field: false
Expand All @@ -3158,7 +3176,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC addresses of the observer
description: 'MAC addresses of the observer.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: '["00-00-5E-00-53-23", "00-00-5E-00-53-24"]'
- name: name
level: extended
type: keyword
Expand Down Expand Up @@ -4381,7 +4405,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the server.
description: 'MAC address of the server.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down Expand Up @@ -4734,7 +4764,13 @@
level: core
type: keyword
ignore_above: 1024
description: MAC address of the source.
description: 'MAC address of the source.
The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit
byte) is represented by two [uppercase] hexadecimal digits giving the value
of the octet as an unsigned integer. Successive octets are separated by a
hyphen.'
example: 00-00-5E-00-53-23
- name: nat.ip
level: extended
type: ip
Expand Down
Loading

0 comments on commit 37eccc1

Please sign in to comment.