[cisco_asa] Improve ECS categorizations #9616
Conversation
taylor-swanson added enhancement 
🚀 Benchmarks reportTo see the full report comment with |
- Improve ECS categorizations for messages
| Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml Show resolved Hide resolved
| "304001": | ||
| type: [ connection, allowed ] | ||
| type: [ access, allowed ] | ||
| action: url-access |
There was a problem hiding this comment.
On Google sheet, event.action is firewall-rule, but here, it is url-access. I don't think this was noted anywhere. It would be helpful it is.
| type: [ connection, denied ] | ||
| action: drop | ||
| outcome: unknown | ||
| type: [ denied ] |
There was a problem hiding this comment.
on google sheet, it says connection for type.
| I think the table of mappings I had is a bit out of date. I think I need to do a run through again and make sure everything's up-to-date. |
| /test |
| A few changes I made:
Overall, I think |
packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml Outdated Show resolved Hide resolved
pkoutsovasilis left a comment
pkoutsovasilis left a comment There was a problem hiding this comment.
except one question I added, this LGTM
💚 Build Succeeded
History
|
|
| Package cisco_asa - 2.34.0 containing this change is available at https://epr.elastic.co/search?package=cisco_asa |
5 participants
This is part 2 of a 2 part change. This PR improves the ECS categorizations for various message types. Existing messages have been improved and new message types have been added where necessary.
For an overview of the different message types, see this spreadsheet.
Proposed commit message
Checklist
changelog.ymlfile.How to test this PR locally
Related issues