Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add 21 autogenerated filesets from rsa2elk devices #19713

Merged
merged 19 commits into from
Jul 14, 2020
Merged

Add 21 autogenerated filesets from rsa2elk devices #19713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
4cd4aa1
Fix assertion in fields validation
adriansr Jul 7, 2020
2453c87
Terminate fortinet fileset docs
adriansr Jul 7, 2020
44d6e99
Drop @timestamp for comparison in a few new filesets
adriansr Jul 6, 2020
ce6baef
Ignore custom rsa key in addition to `@timestamp` in tests
adriansr Jul 13, 2020
3bafcf3
Update cisco docs to mention new fileset
adriansr Jul 7, 2020
d8dbfa7
Add 21 autogenerated filesets from rsa2elk devices
adriansr Jul 7, 2020
30f929b
Fix fortnet/clientendpoint parsing.
adriansr Jul 8, 2020
6e00df1
Fixes for sonicwall parsing
adriansr Jul 8, 2020
0e90904
Add overwrite: true to fields
adriansr Jul 8, 2020
f8097ff
Prefer event.action to event.category, better user.name / related.user
adriansr Jul 8, 2020
2bd73b6
Improved parsers
adriansr Jul 8, 2020
320c9e2
event.action is not an array
adriansr Jul 8, 2020
c7e8569
event.outcome / group.name / group.id / host.mac / direction
adriansr Jul 8, 2020
b6af936
Update test files
adriansr Jul 13, 2020
d5a77a4
Update
adriansr Jul 13, 2020
cac973c
Fix mac address parsers in microsoft/dhcp
adriansr Jul 13, 2020
4f80f24
Use file.name instead of http.response.body.content
adriansr Jul 13, 2020
14e7d41
Changelog entries
adriansr Jul 13, 2020
27573b7
Remove questionable log files from squid
adriansr Jul 13, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
21 changes: 21 additions & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -439,6 +439,27 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Improve ECS categorization field mappings in traefik module. {issue}16183[16183] {pull}19379[19379]
- Improve ECS categorization field mappings in azure module. {issue}16155[16155] {pull}19376[19376]
- Add text & flattened versions of fields with unknown subfields in aws cloudtrail fileset. {issue}18866[18866] {pull}19121[19121]
- Add experimental dataset tomcat/log for Apache TomCat logs {pull}19713[19713]
- Add experimental dataset netscout/sightline for Netscout Arbor Sightline logs {pull}19713[19713]
- Add experimental dataset barracuda/waf for Barracuda Web Application Firewall logs {pull}19713[19713]
- Add experimental dataset f5/bigipapm for F5 Big-IP Access Policy Manager logs {pull}19713[19713]
- Add experimental dataset bluecoat/director for Bluecoat Director logs {pull}19713[19713]
- Add experimental dataset cisco/nexus for Cisco Nexus logs {pull}19713[19713]
- Add experimental dataset citrix/virtualapps for Citrix Virtual Apps logs {pull}19713[19713]
- Add experimental dataset cylance/protect for Cylance Protect logs {pull}19713[19713]
- Add experimental dataset f5/firepass for F5 FirePass SSL VPN logs {pull}19713[19713]
- Add experimental dataset fortinet/clientendpoint for Fortinet FortiClient Endpoint Protection logs {pull}19713[19713]
- Add experimental dataset imperva/securesphere for Imperva Secure Sphere logs {pull}19713[19713]
- Add experimental dataset infoblox/nios for Infoblox Network Identity Operating System logs {pull}19713[19713]
- Add experimental dataset juniper/junos for Juniper Junos OS logs {pull}19713[19713]
- Add experimental dataset kaspersky/av for Kaspersky Anti-Virus logs {pull}19713[19713]
- Add experimental dataset microsoft/dhcp for Microsoft DHCP Server logs {pull}19713[19713]
- Add experimental dataset tenable/nessus_security for Tenable Nessus Security Scanner logs {pull}19713[19713]
- Add experimental dataset rapid7/nexpose for Rapid7 Nexpose logs {pull}19713[19713]
- Add experimental dataset radware/defensepro for Radware DefensePro logs {pull}19713[19713]
- Add experimental dataset sonicwall/firewall for Sonicwall Firewalls logs {pull}19713[19713]
- Add experimental dataset squid/log for Squid Proxy Server logs {pull}19713[19713]
- Add experimental dataset zscaler/zia for Zscaler Internet Access logs {pull}19713[19713]

*Heartbeat*

Expand Down
Loading