added source/destination port 0 check to community id processor to pr… #10205
Conversation
…event pipeline error
…event pipeline error
…/integrations into zeek-community-id-port-bug
andrewkroh added Integration:zeek 
| Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
There was a problem hiding this comment.
@peterydzynski please do the following:
- please add a log entry in this file that captures what you describe in the issue and then following these guidelines run the pipeline test
- update the changelog and the manifest accordingly
…/integrations into zeek-community-id-port-bug
…dated manifest/changelog.
| @pkoutsovasilis Let me know if those updates are what you're looking for! |
| /test |
🚀 Benchmarks reportPackage |
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
mysql | 30303.03 | 10638.3 | -19664.73 (-64.89%) | 💔 |
pe | 26315.79 | 14925.37 | -11390.42 (-43.28%) | 💔 |
smb_mapping | 30303.03 | 23255.81 | -7047.22 (-23.26%) | 💔 |
dce_rpc | 24390.24 | 13513.51 | -10876.73 (-44.59%) | 💔 |
To see the full report comment with /test benchmark fullreport
@pkoutsovasilis Is the EPS diff something to be concerned about? |
I think that it is just a hiccup but let me invoke the testing one more time just to be sure |
| /test |
| @pkoutsovasilis i dont see the new test results, did they get published yet? |
| /test |
💚 Build Succeeded
History
|
|
| @pkoutsovasilis sorry to keep pinging but really need this bugfix to get deployed. can we get this merged in please? |
| @peterydzynski, @pkoutsovasilis is out this week, but I went ahead and merged the fix. |
| Package zeek - 2.24.2 containing this change is available at https://epr.elastic.co/search?package=zeek |
| Thank you so much! |
…lastic#10205) - Added a check on the community_id processor in the Zeek connection pipeline to ensure source and destination port are not 0.
…lastic#10205) - Added a check on the community_id processor in the Zeek connection pipeline to ensure source and destination port are not 0.
5 participants
Proposed commit message
There are rare cases where a Zeek log has a "network.transport" of "tcp" but the source and destination port values are 0 which breaks the community_id processor as it requires a non zero value in both port fields. This appears to happen when the "zeek.connection.history" is just "R" but otherwise I cannot explain why this happens. Since this pipeline calls the custom Zeek Connection pipeline, failure at this stage means that the custom pipelines are never called.
To fix this I added a check on the community_id processor in the Zeek connection pipeline to ensure source and destination port are not 0.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots