Elastic-ecs mapping improvements for network traffic attributes #1410

Harmedox · 2023-03-30T22:40:36Z

This pull request addresses issues #1407, #1408, #1409, #1412.

…butes in to_stix_map

…n-name SCO objects

…x_map for v2.1

delliott90 · 2023-04-04T18:03:54Z

stix_shifter_modules/elastic_ecs/stix_translation/json/stix_2_1/to_stix_map.json

    "geo": {
      "city_name": {
-        "key": "x-ecs-client.geo_city_name",
-        "object": "client"
+        "key": "x-ecs-geo.city_name",


I wonder if we should just create a generic custom geography object instead of tying it to ecs. Someone else is currently working on the mappings for the log analytics connector, and there is also a need there to capture geo information.

I tend to agree. There was a comment to that effect too. We can have it mimic the properties of the Location SDO to achieve genericity and completeness.

mdazam1942

Can you please update your fork while creating this pr? it shows 51 commits in the pr which suggest your fork branch is out of date.

Harmedox · 2023-04-10T21:27:32Z

I just confirmed that my fork branch is up to date. However, it's still an error from my end as the PR is showing commits from #1378. The contribution for this PR starts from the 81d2a7a commit.

…to develop

mdazam1942

Few unittests are failing.

…to develop

codecov · 2023-04-26T20:09:43Z

Codecov Report

❗ No coverage uploaded for pull request base (develop@9f6160f). Click here to learn what that means.
Patch coverage: 100.00% of modified lines in pull request are covered.

❗ Current head 3dbc456 differs from pull request most recent head ff8cb3f. Consider uploading reports for the commit ff8cb3f to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #1410   +/-   ##
==========================================
  Coverage           ?   85.37%           
==========================================
  Files              ?      589           
  Lines              ?    44541           
  Branches           ?        0           
==========================================
  Hits               ?    38028           
  Misses             ?     6513           
  Partials           ?        0

Impacted Files	Coverage Δ
...stix_translation/test_elastic_ecs_stix_to_query.py	`97.76% <100.00%> (ø)`

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

Harmedox and others added 30 commits February 20, 2023 07:45

consolidate network-traffic and x-ecs-network attributes

4e52ee3

consolidate network-traffic and x-ecs-network attributes

65772c4

consolidate network-traffic and x-ecs-network attributes

ca9ac4d

add missing network.vlan attribute in elastic_ecs mapping

75fc74e

add missing network.vlan attribute in elastic_ecs mapping

3982504

add missing network.vlan attribute in elastic_ecs mapping

a841279

combine inner vlan and vlan into a single custom object

9eb8031

combine inner vlan and vlan into a single custom object

3264667

combine inner vlan and vlan into a single custom object

9a20947

consolidate the object reference for the network-traffic custom attri…

338ab75

…butes in to_stix_map

transfer network attribute changes to STIX 2.1

177fec1

transfer network attribute changes to STIX 2.1

011fcba

transfer network attribute changes to STIX 2.1

4b14606

consolidate x-ecs-user attributes into user-account

6a8903e

consolidate x-ecs-user attributes into user-account

c05e679

consolidate x-ecs-user attributes into user-account

1162f48

consolidate x-ecs-user attributes into user-account

902749a

consolidate x-ecs-user attributes into user-account

9880a9c

consolidate x-ecs-user attributes into user-account

3316347

Merge branch 'opencybersecurityalliance:develop' into develop

1a9aad8

update network object unit test

b825580

WIP: represent the pe attributes in file SCO using software SCO

03e9b50

refer to pe attributes in file object using the software SCO

1a94ee4

refer to pe attributes in file object using the software SCO

498426c

refer to pe attributes in file object using the software SCO

cc81195

refer to pe attributes in file object using the software SCO in v2.1

ee05033

refer to pe attributes in file object using the software SCO in v2.1

f1b2151

refer to pe attributes in file object using the software SCO in v2.1

3b0c997

remove tests for x_pe from the elastic_ecs_connector mapping

6cb1cde

add software_ref test to replace the x_pe test in test_x_ecs_event

b1073ab

Harmedox added 9 commits March 30, 2023 15:54

map nat ip and port to the ipv4-addr and ipv6-addr SCO objects

04e37e3

represent registered_domain and top_level_domain ecs objects as domai…

0557432

…n-name SCO objects

fix geo reference to x-ecs-geo custom SCO object

f3ed547

Merge branch 'opencybersecurityalliance:develop' into develop

cd793c4

fix port references in ipv4 and ipv6 objects

d25ce68

fix geo references

bf6c94d

remove x-ecs-[source, destination,client, server] objects in from_sti…

137a5b3

…x_map for v2.1

consolidate dll attributes into the file SCO

c61cfd4

remove x-ecs-dll object

8508f75

delliott90 reviewed Apr 4, 2023

View reviewed changes

mdazam1942 reviewed Apr 10, 2023

View reviewed changes

Merge branch 'opencybersecurityalliance:develop' into develop

dfb82d7

Harmedox changed the base branch from develop to release/5.0.x April 10, 2023 21:02

Harmedox changed the base branch from release/5.0.x to develop April 10, 2023 21:02

Harmedox and others added 5 commits April 25, 2023 13:40

Merge branch 'opencybersecurityalliance:develop' into develop

9742c18

consolidate observer object into x-oca-asset

c4953ea

represent geo attributes with a generic object x-oca-geo

1176d50

Merge branch 'develop' of https://github.com/Harmedox/stix-shifter in…

b8eba06

…to develop

Merge branch 'develop' into develop

d809b60

mdazam1942 suggested changes Apr 26, 2023

View reviewed changes

Harmedox added 3 commits April 26, 2023 15:00

update stix_to_query unit test to reflect elastic_ecs mapping changes

f841e49

Merge branch 'develop' of https://github.com/Harmedox/stix-shifter in…

3dbc456

…to develop

Merge branch 'develop' into develop

fb84135

delliott90 approved these changes Apr 27, 2023

View reviewed changes

Merge branch 'develop' into develop

ff8cb3f

mdazam1942 approved these changes Apr 27, 2023

View reviewed changes

delliott90 merged commit cb03034 into opencybersecurityalliance:develop Apr 27, 2023

delliott90 pushed a commit that referenced this pull request May 3, 2023

Elastic-ecs mapping improvements for network traffic attributes (#1410)

a27e2f5

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Elastic-ecs mapping improvements for network traffic attributes #1410

Elastic-ecs mapping improvements for network traffic attributes #1410

Harmedox commented Mar 30, 2023 •

edited

Loading

delliott90 Apr 4, 2023

Harmedox Apr 5, 2023

mdazam1942 left a comment

Harmedox commented Apr 10, 2023

mdazam1942 left a comment

codecov bot commented Apr 26, 2023 •

edited

Loading

Elastic-ecs mapping improvements for network traffic attributes #1410

Elastic-ecs mapping improvements for network traffic attributes #1410

Conversation

Harmedox commented Mar 30, 2023 • edited Loading

delliott90 Apr 4, 2023

Choose a reason for hiding this comment

Harmedox Apr 5, 2023

Choose a reason for hiding this comment

mdazam1942 left a comment

Choose a reason for hiding this comment

Harmedox commented Apr 10, 2023

mdazam1942 left a comment

Choose a reason for hiding this comment

codecov bot commented Apr 26, 2023 • edited Loading

Codecov Report

Harmedox commented Mar 30, 2023 •

edited

Loading

codecov bot commented Apr 26, 2023 •

edited

Loading