Skip to content

Commit cea4435

Browse files
efd6efd6
committed
cisco_meraki: fix ECS mapping for translated IP and port
Previously these were conditionally mapped to the {source,destination}.{ip,port} fields. Instead, map them to {source,destination}.nat.{ip,port}.
1 parent 08dd8a2 commit cea4435

File tree

5 files changed

+149
-139
lines changed

5 files changed

+149
-139
lines changed

‎packages/cisco_meraki/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.29.2"
3+
changes:
4+
- description: Map translated source and destination IP and port to correct ECS fields.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/14389
27
- version: "1.29.1"
38
changes:
49
- description: Fix the parsing of connecting and reconnecting events for `anyconnect_vpn_connect` and `client_vpn_connect`.

‎packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@
88
<134>1 1647479325.755292025 MX100 ip_flow_end src=10.0.0.234 dst=81.2.69.144 protocol=tcp sport=36498 dport=80 translated_src_ip=1.128.3.4 translated_port=36498
99
<134>1 1647479325.755292025 MX100 ip_flow_start src=10.0.0.234 dst=81.2.69.145 protocol=icmp translated_src_ip=1.128.3.4
1010
<134>1 1647479325.755292025 MX100 ip_flow_end src=10.0.2.99 dst=10.0.0.1 protocol=icmp translated_dst_ip=89.160.20.112
11+
<134>1 1751379284.245040794 FW_01 ip_flow_start src=10.140.40.72 dst=81.2.69.144 protocol=udp sport=18212 dport=53 translated_src_ip=1.128.3.4 translated_port=13710

‎packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json‎

Lines changed: 120 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
"region_name": "England"
2020
},
2121
"ip": "81.2.69.145",
22+
"nat": {
23+
"port": 34294
24+
},
2225
"port": 80
2326
},
2427
"ecs": {
@@ -41,13 +44,11 @@
4144
"hostname": "MX100"
4245
},
4346
"source": {
44-
"as": {
45-
"number": 1221,
46-
"organization": {
47-
"name": "Telstra Pty Ltd"
48-
}
47+
"ip": "10.0.0.234",
48+
"nat": {
49+
"ip": "1.128.3.4",
50+
"port": 34294
4951
},
50-
"ip": "1.128.3.4",
5152
"port": 34294
5253
},
5354
"tags": [
@@ -74,6 +75,9 @@
7475
"region_name": "England"
7576
},
7677
"ip": "81.2.69.143",
78+
"nat": {
79+
"port": 45061
80+
},
7781
"port": 53
7882
},
7983
"ecs": {
@@ -96,13 +100,11 @@
96100
"hostname": "MX100"
97101
},
98102
"source": {
99-
"as": {
100-
"number": 1221,
101-
"organization": {
102-
"name": "Telstra Pty Ltd"
103-
}
103+
"ip": "10.0.0.234",
104+
"nat": {
105+
"ip": "1.128.3.4",
106+
"port": 45061
104107
},
105-
"ip": "1.128.3.4",
106108
"port": 45061
107109
},
108110
"tags": [
@@ -129,6 +131,9 @@
129131
"region_name": "England"
130132
},
131133
"ip": "81.2.69.143",
134+
"nat": {
135+
"port": 37401
136+
},
132137
"port": 53
133138
},
134139
"ecs": {
@@ -151,13 +156,11 @@
151156
"hostname": "MX100"
152157
},
153158
"source": {
154-
"as": {
155-
"number": 1221,
156-
"organization": {
157-
"name": "Telstra Pty Ltd"
158-
}
159+
"ip": "10.0.0.234",
160+
"nat": {
161+
"ip": "1.128.3.4",
162+
"port": 37401
159163
},
160-
"ip": "1.128.3.4",
161164
"port": 37401
162165
},
163166
"tags": [
@@ -190,6 +193,9 @@
190193
"region_name": "Östergötland County"
191194
},
192195
"ip": "89.160.20.156",
196+
"nat": {
197+
"port": 61272
198+
},
193199
"port": 443
194200
},
195201
"ecs": {
@@ -212,22 +218,11 @@
212218
"hostname": "MX84"
213219
},
214220
"source": {
215-
"as": {
216-
"number": 209
221+
"ip": "10.0.3.138",
222+
"nat": {
223+
"ip": "216.160.83.61",
224+
"port": 61272
217225
},
218-
"geo": {
219-
"city_name": "Milton",
220-
"continent_name": "North America",
221-
"country_iso_code": "US",
222-
"country_name": "United States",
223-
"location": {
224-
"lat": 47.2513,
225-
"lon": -122.3149
226-
},
227-
"region_iso_code": "US-WA",
228-
"region_name": "Washington"
229-
},
230-
"ip": "216.160.83.61",
231226
"port": 61272
232227
},
233228
"tags": [
@@ -241,25 +236,11 @@
241236
"event_type": "ip_flow_end"
242237
},
243238
"destination": {
244-
"as": {
245-
"number": 29518,
246-
"organization": {
247-
"name": "Bredband2 AB"
248-
}
249-
},
250-
"geo": {
251-
"city_name": "Linköping",
252-
"continent_name": "Europe",
253-
"country_iso_code": "SE",
254-
"country_name": "Sweden",
255-
"location": {
256-
"lat": 58.4167,
257-
"lon": 15.6167
258-
},
259-
"region_iso_code": "SE-E",
260-
"region_name": "Östergötland County"
239+
"ip": "10.0.0.1",
240+
"nat": {
241+
"ip": "89.160.20.112",
242+
"port": 53
261243
},
262-
"ip": "89.160.20.112",
263244
"port": 53
264245
},
265246
"ecs": {
@@ -283,6 +264,9 @@
283264
},
284265
"source": {
285266
"ip": "10.0.2.249",
267+
"nat": {
268+
"port": 53
269+
},
286270
"port": 7421
287271
},
288272
"tags": [
@@ -309,6 +293,9 @@
309293
}
310294
},
311295
"ip": "67.43.156.14",
296+
"nat": {
297+
"port": 38422
298+
},
312299
"port": 443
313300
},
314301
"ecs": {
@@ -331,22 +318,11 @@
331318
"hostname": "MX84"
332319
},
333320
"source": {
334-
"as": {
335-
"number": 209
336-
},
337-
"geo": {
338-
"city_name": "Milton",
339-
"continent_name": "North America",
340-
"country_iso_code": "US",
341-
"country_name": "United States",
342-
"location": {
343-
"lat": 47.2513,
344-
"lon": -122.3149
345-
},
346-
"region_iso_code": "US-WA",
347-
"region_name": "Washington"
321+
"ip": "10.0.3.116",
322+
"nat": {
323+
"ip": "216.160.83.61",
324+
"port": 38422
348325
},
349-
"ip": "216.160.83.61",
350326
"port": 38422
351327
},
352328
"tags": [
@@ -360,25 +336,11 @@
360336
"event_type": "ip_flow_end"
361337
},
362338
"destination": {
363-
"as": {
364-
"number": 29518,
365-
"organization": {
366-
"name": "Bredband2 AB"
367-
}
339+
"ip": "10.0.0.1",
340+
"nat": {
341+
"ip": "89.160.20.112",
342+
"port": 53
368343
},
369-
"geo": {
370-
"city_name": "Linköping",
371-
"continent_name": "Europe",
372-
"country_iso_code": "SE",
373-
"country_name": "Sweden",
374-
"location": {
375-
"lat": 58.4167,
376-
"lon": 15.6167
377-
},
378-
"region_iso_code": "SE-E",
379-
"region_name": "Östergötland County"
380-
},
381-
"ip": "89.160.20.112",
382344
"port": 53
383345
},
384346
"ecs": {
@@ -402,6 +364,9 @@
402364
},
403365
"source": {
404366
"ip": "10.0.2.99",
367+
"nat": {
368+
"port": 53
369+
},
405370
"port": 29534
406371
},
407372
"tags": [
@@ -428,6 +393,9 @@
428393
"region_name": "England"
429394
},
430395
"ip": "81.2.69.144",
396+
"nat": {
397+
"port": 36498
398+
},
431399
"port": 80
432400
},
433401
"ecs": {
@@ -450,13 +418,11 @@
450418
"hostname": "MX100"
451419
},
452420
"source": {
453-
"as": {
454-
"number": 1221,
455-
"organization": {
456-
"name": "Telstra Pty Ltd"
457-
}
421+
"ip": "10.0.0.234",
422+
"nat": {
423+
"ip": "1.128.3.4",
424+
"port": 36498
458425
},
459-
"ip": "1.128.3.4",
460426
"port": 36498
461427
},
462428
"tags": [
@@ -504,13 +470,10 @@
504470
"hostname": "MX100"
505471
},
506472
"source": {
507-
"as": {
508-
"number": 1221,
509-
"organization": {
510-
"name": "Telstra Pty Ltd"
511-
}
512-
},
513-
"ip": "1.128.3.4"
473+
"ip": "10.0.0.234",
474+
"nat": {
475+
"ip": "1.128.3.4"
476+
}
514477
},
515478
"tags": [
516479
"forwarded",
@@ -523,25 +486,10 @@
523486
"event_type": "ip_flow_end"
524487
},
525488
"destination": {
526-
"as": {
527-
"number": 29518,
528-
"organization": {
529-
"name": "Bredband2 AB"
530-
}
531-
},
532-
"geo": {
533-
"city_name": "Linköping",
534-
"continent_name": "Europe",
535-
"country_iso_code": "SE",
536-
"country_name": "Sweden",
537-
"location": {
538-
"lat": 58.4167,
539-
"lon": 15.6167
540-
},
541-
"region_iso_code": "SE-E",
542-
"region_name": "Östergötland County"
543-
},
544-
"ip": "89.160.20.112"
489+
"ip": "10.0.0.1",
490+
"nat": {
491+
"ip": "89.160.20.112"
492+
}
545493
},
546494
"ecs": {
547495
"version": "8.11.0"
@@ -569,6 +517,62 @@
569517
"forwarded",
570518
"preserve_original_event"
571519
]
520+
},
521+
{
522+
"@timestamp": "2025-07-01T14:14:44.245Z",
523+
"cisco_meraki": {
524+
"event_type": "ip_flow_start"
525+
},
526+
"destination": {
527+
"geo": {
528+
"city_name": "London",
529+
"continent_name": "Europe",
530+
"country_iso_code": "GB",
531+
"country_name": "United Kingdom",
532+
"location": {
533+
"lat": 51.5142,
534+
"lon": -0.0931
535+
},
536+
"region_iso_code": "GB-ENG",
537+
"region_name": "England"
538+
},
539+
"ip": "81.2.69.144",
540+
"nat": {
541+
"port": 13710
542+
},
543+
"port": 53
544+
},
545+
"ecs": {
546+
"version": "8.11.0"
547+
},
548+
"event": {
549+
"category": [
550+
"network"
551+
],
552+
"original": "<134>1 1751379284.245040794 FW_01 ip_flow_start src=10.140.40.72 dst=81.2.69.144 protocol=udp sport=18212 dport=53 translated_src_ip=1.128.3.4 translated_port=13710",
553+
"type": [
554+
"info"
555+
]
556+
},
557+
"message": "src=10.140.40.72 dst=81.2.69.144 protocol=udp sport=18212 dport=53 translated_src_ip=1.128.3.4 translated_port=13710",
558+
"network": {
559+
"protocol": "udp"
560+
},
561+
"observer": {
562+
"hostname": "FW_01"
563+
},
564+
"source": {
565+
"ip": "10.140.40.72",
566+
"nat": {
567+
"ip": "1.128.3.4",
568+
"port": 13710
569+
},
570+
"port": 18212
571+
},
572+
"tags": [
573+
"forwarded",
574+
"preserve_original_event"
575+
]
572576
}
573577
]
574578
}

0 commit comments

Comments
 (0)