Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Add module for Forcepoint firewall logs #14663

Closed
andrewkroh opened this issue Nov 20, 2019 · 1 comment · Fixed by #15910
Closed

[Filebeat] Add module for Forcepoint firewall logs #14663

andrewkroh opened this issue Nov 20, 2019 · 1 comment · Fixed by #15910
Assignees
@leehinman
Labels
enhancement Filebeat Filebeat module

Comments

@andrewkroh
Copy link
Member

Add a fileset for ingesting logs from Forcepoint Next Generation Firewall (NGFW). The firewall can export CEF data over syslog (among other formats). So the fileset should be able to leverage the syslog input and the decode_cef processor to ingest the logs and then in a module apply the appropriate transformations to match ECS as much as possible.
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@leehinman leehinman mentioned this issue Jan 28, 2020
Merged
leehinman added a commit to leehinman/beats that referenced this issue Jan 28, 2020
@leehinman
Add CustomString mapping to CEF for Forcepoint NGFW
02058e0 
Closes elastic#14663
leehinman added a commit that referenced this issue Feb 5, 2020
@leehinman
[Filebeat] Add CustomString mapping to CEF for Forcepoint NGFW (#15910)
82b8fe6 
* Add CustomString mapping to CEF for Forcepoint NGFW

Closes #14663
leehinman added a commit to leehinman/beats that referenced this issue Feb 5, 2020
@leehinman
[Filebeat] Add CustomString mapping to CEF for Forcepoint NGFW (elast…
7f251da 
…ic#15910)

* Add CustomString mapping to CEF for Forcepoint NGFW

Closes elastic#14663

(cherry picked from commit 82b8fe6)
@leehinman leehinman mentioned this issue Feb 5, 2020
Merged
leehinman added a commit that referenced this issue Mar 12, 2020
@leehinman
[Filebeat] Add CustomString mapping to CEF for Forcepoint NGFW (#15910)…
22941be 
… (#16106)

* Add CustomString mapping to CEF for Forcepoint NGFW

Closes #14663

(cherry picked from commit 82b8fe6)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@leehinman leehinman

Labels
enhancement Filebeat Filebeat module
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Filebeat] Add CustomString mapping to CEF for Forcepoint NGFW leehinman/beats
3 participants
@andrewkroh @elasticmachine @leehinman