forked from elastic/ecs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdestination.yml
112 lines (94 loc) · 3.32 KB
/
destination.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
---
- name: destination
title: Destination
group: 2
short: Fields about the destination side of a network connection, used with source.
description: >
Destination fields describe details about the destination of a packet/event.
Destination fields are usually populated in conjunction with source fields.
type: group
fields:
- name: address
level: extended
type: keyword
short: Destination network address.
description: >
Some event destination addresses are defined ambiguously. The event will
sometimes list an IP, a domain or a unix socket. You should always
store the raw address in the `.address` field.
Then it should be duplicated to `.ip` or `.domain`, depending on which
one it is.
- name: ip
level: core
type: ip
short: IP address of the destination.
description: >
IP address of the destination (IPv4 or IPv6).
- name: port
format: string
level: core
type: long
description: >
Port of the destination.
- name: mac
level: core
type: keyword
description: >
MAC address of the destination.
- name: domain
level: core
type: keyword
description: >
Destination domain.
- name: registered_domain
level: extended
type: keyword
short: The highest registered destination domain, stripped of the subdomain.
description: >
The highest registered destination domain, stripped of the subdomain.
For example, the registered domain for "foo.example.com" is "example.com".
This value can be determined precisely with a list like the public
suffix list (http://publicsuffix.org). Trying to approximate this by
simply taking the last two labels will not work well for TLDs such as "co.uk".
example: example.com
- name: top_level_domain
level: extended
type: keyword
short: The effective top level domain (com, org, net, co.uk).
description: >
The effective top level domain (eTLD), also known as the domain suffix,
is the last part of the domain name.
For example, the top level domain for example.com is "com".
This value can be determined precisely with a list like the public
suffix list (http://publicsuffix.org). Trying to approximate this by
simply taking the last label will not work well for effective TLDs such as "co.uk".
example: co.uk
# Metrics
- name: bytes
format: bytes
level: core
type: long
example: 184
description: >
Bytes sent from the destination to the source.
- name: packets
level: core
type: long
example: 12
description: >
Packets sent from the destination to the source.
- name: nat.ip
level: extended
type: ip
short: Destination NAT ip
description: >
Translated ip of destination based NAT sessions (e.g. internet to private DMZ)
Typically used with load balancers, firewalls, or routers.
- name: nat.port
format: string
level: extended
type: long
short: Destination NAT Port
description: >
Port the source session is translated to by NAT Device.
Typically used with load balancers, firewalls, or routers.