Define base encoding in x509.serial_number (#2383)

Narrow the definition of x509.serial_number to be encoded in hexadecimal,
otherwise we end up with integrations choosing their own encoding, as noted
below, Zeek uses base 16 while the rest of beats is using base 10.

CHANGELOG.next.md

@@ -25,6 +25,8 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+* Define base encoding of `x509.serial_number`. #2383
+
 #### Deprecated
 
 ### Tooling and Artifact Changes

docs/fields/field-details.asciidoc

@@ -13803,7 +13803,7 @@ example: `2048`
 [[field-x509-serial-number]]
 <<field-x509-serial-number, x509.serial_number>>
 
-a| Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.
+a| Unique serial number issued by the certificate authority. For consistency, this should be encoded in base 16 and formatted without colons and uppercase characters.
 
 type: keyword
 

experimental/generated/beats/fields.ecs.yml

@@ -3339,7 +3339,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -9984,7 +9984,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -10541,7 +10541,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -11606,7 +11606,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12174,7 +12174,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12590,7 +12590,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12872,7 +12872,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false

experimental/generated/ecs/ecs_flat.yml

@@ -5510,8 +5510,7 @@ file.x509.public_key_size:
 file.x509.serial_number:
   dashed_name: file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: file.x509.serial_number
   ignore_above: 1024
@@ -16160,8 +16159,7 @@ threat.enrichments.indicator.file.x509.public_key_size:
 threat.enrichments.indicator.file.x509.serial_number:
   dashed_name: threat-enrichments-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -17087,8 +17085,7 @@ threat.enrichments.indicator.x509.public_key_size:
 threat.enrichments.indicator.x509.serial_number:
   dashed_name: threat-enrichments-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.x509.serial_number
   ignore_above: 1024
@@ -18897,8 +18894,7 @@ threat.indicator.file.x509.public_key_size:
 threat.indicator.file.x509.serial_number:
   dashed_name: threat-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -19840,8 +19836,7 @@ threat.indicator.x509.public_key_size:
 threat.indicator.x509.serial_number:
   dashed_name: threat-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.x509.serial_number
   ignore_above: 1024
@@ -20531,8 +20526,7 @@ tls.client.x509.public_key_size:
 tls.client.x509.serial_number:
   dashed_name: tls-client-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.client.x509.serial_number
   ignore_above: 1024
@@ -21008,8 +21002,7 @@ tls.server.x509.public_key_size:
 tls.server.x509.serial_number:
   dashed_name: tls-server-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.server.x509.serial_number
   ignore_above: 1024

experimental/generated/ecs/ecs_nested.yml

@@ -6558,7 +6558,7 @@ file:
     file.x509.serial_number:
       dashed_name: file-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: file.x509.serial_number
@@ -18863,7 +18863,7 @@ threat:
     threat.enrichments.indicator.file.x509.serial_number:
       dashed_name: threat-enrichments-indicator-file-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.enrichments.indicator.file.x509.serial_number
@@ -19794,7 +19794,7 @@ threat:
     threat.enrichments.indicator.x509.serial_number:
       dashed_name: threat-enrichments-indicator-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.enrichments.indicator.x509.serial_number
@@ -21606,7 +21606,7 @@ threat:
     threat.indicator.file.x509.serial_number:
       dashed_name: threat-indicator-file-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.indicator.file.x509.serial_number
@@ -22553,7 +22553,7 @@ threat:
     threat.indicator.x509.serial_number:
       dashed_name: threat-indicator-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.indicator.x509.serial_number
@@ -23308,7 +23308,7 @@ tls:
     tls.client.x509.serial_number:
       dashed_name: tls-client-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: tls.client.x509.serial_number
@@ -23788,7 +23788,7 @@ tls:
     tls.server.x509.serial_number:
       dashed_name: tls-server-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: tls.server.x509.serial_number
@@ -25706,7 +25706,7 @@ x509:
     x509.serial_number:
       dashed_name: x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: x509.serial_number

generated/beats/fields.ecs.yml

@@ -3289,7 +3289,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -9934,7 +9934,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -10491,7 +10491,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -11556,7 +11556,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12124,7 +12124,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12540,7 +12540,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12822,7 +12822,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        if this value is alphanumeric, it should be formatted without colons and uppercase
+        this should be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false

generated/ecs/ecs_flat.yml

@@ -5441,8 +5441,7 @@ file.x509.public_key_size:
 file.x509.serial_number:
   dashed_name: file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: file.x509.serial_number
   ignore_above: 1024
@@ -16091,8 +16090,7 @@ threat.enrichments.indicator.file.x509.public_key_size:
 threat.enrichments.indicator.file.x509.serial_number:
   dashed_name: threat-enrichments-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -17018,8 +17016,7 @@ threat.enrichments.indicator.x509.public_key_size:
 threat.enrichments.indicator.x509.serial_number:
   dashed_name: threat-enrichments-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.x509.serial_number
   ignore_above: 1024
@@ -18828,8 +18825,7 @@ threat.indicator.file.x509.public_key_size:
 threat.indicator.file.x509.serial_number:
   dashed_name: threat-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -19771,8 +19767,7 @@ threat.indicator.x509.public_key_size:
 threat.indicator.x509.serial_number:
   dashed_name: threat-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.x509.serial_number
   ignore_above: 1024
@@ -20462,8 +20457,7 @@ tls.client.x509.public_key_size:
 tls.client.x509.serial_number:
   dashed_name: tls-client-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.client.x509.serial_number
   ignore_above: 1024
@@ -20939,8 +20933,7 @@ tls.server.x509.public_key_size:
 tls.server.x509.serial_number:
   dashed_name: tls-server-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    if this value is alphanumeric, it should be formatted without colons and uppercase
-    characters.
+    this should be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.server.x509.serial_number
   ignore_above: 1024