Skip to content

[Suricata] Add Observer Metadata #6985

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
efd6 merged 24 commits into from
Oct 3, 2023
Merged

[Suricata] Add Observer Metadata #6985

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
41af726
Enable population of `observer` fields if tags contain "forwarded"
MakoWish Jul 17, 2023
21d8af4
Enable population of `observer` fields if tags contain "forwarded"
MakoWish Jul 17, 2023
fbfecb1
Add entry to changelog and increment version in manifest
MakoWish Jul 17, 2023
f0a8552
Merge branch 'suricata_add_observer_metadata' of https://github.com/M…
MakoWish Jul 17, 2023
1d78981
Suggested change from code review
MakoWish Jul 17, 2023
0365e64
Suggested change from code review
MakoWish Jul 17, 2023
fb99600
Set "observer" tag on only a couple sample logs
MakoWish Jul 17, 2023
6c43788
Merge branch 'suricata_add_observer_metadata' of https://github.com/M…
MakoWish Jul 17, 2023
c69dd2f
Remove accidental inclusion
MakoWish Jul 17, 2023
2c5f6f9
Merge branch 'suricata_add_observer_metadata' of https://github.com/M…
MakoWish Jul 18, 2023
1037571
Suggested changes from code review
MakoWish Jul 18, 2023
e4f8be1
Merge branch 'suricata_add_observer_metadata' of https://github.com/M…
MakoWish Jul 18, 2023
5424a94
Missing final newline in log.yml.hbs
MakoWish Jul 18, 2023
783d508
Merge branch 'suricata_add_observer_metadata' of https://github.com/M…
MakoWish Jul 18, 2023
2446475
Merge branch 'main' into suricata_add_observer_metadata
MakoWish Jul 31, 2023
dba68a6
Increment version due to conflict with recent merge
MakoWish Jul 31, 2023
a24d99c
Merge branch 'suricata_add_observer_metadata' of https://github.com/M…
MakoWish Jul 31, 2023
e28f329
Commit suggested change from code review
MakoWish Jul 31, 2023
6b21ef5
Commit suggested change from code review
MakoWish Jul 31, 2023
ab44513
Merge branch 'main' into suricata_add_observer_metadata
MakoWish Aug 14, 2023
cfe6d7f
Update packages/suricata/manifest.yml
MakoWish Aug 29, 2023
5b339a3
Merge branch 'main' into suricata_add_observer_metadata
MakoWish Sep 28, 2023
e429670
Expected log result changed
MakoWish Sep 28, 2023
e5fe6b0
Merge branch 'suricata_add_observer_metadata' of https://github.com/M…
MakoWish Sep 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/suricata/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "2.18.0"
changes:
- description: Populate `observer.*` fields if "forwarded" in tags
type: enhancement
link: https://github.com/elastic/integrations/pull/6985
- version: "2.17.1"
changes:
- description: Refer to the ECS definition for all fields that exist in ECS.
Expand Down
4 changes: 4 additions & 0 deletions packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-alerts.log-config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
fields:
tags:
- forwarded
Comment thread
MakoWish marked this conversation as resolved.
- preserve_original_event
Loading