From c307a2c06dc9a831e13f5e8840dafd9d4eba744e Mon Sep 17 00:00:00 2001 From: James Garside Date: Fri, 31 May 2024 10:36:56 +0100 Subject: [PATCH 01/23] base intergation --- packages/endace/LICENSE.txt | 93 + packages/endace/_dev/build/build.yml | 4 + packages/endace/_dev/build/docs/README.md | 171 + .../_dev/deploy/docker/docker-compose.yml | 13 + .../docker/pcaps/amqp_channel_error.pcap | Bin 0 -> 2164 bytes .../docker/pcaps/amqp_emit_receive.pcap | Bin 0 -> 5317 bytes .../deploy/docker/pcaps/amqp_publish.pcap | Bin 0 -> 2406 bytes .../docker/pcaps/cassandra_create_index.pcap | Bin 0 -> 3771 bytes .../pcaps/cassandra_create_keyspace.pcap | Bin 0 -> 1314 bytes .../docker/pcaps/cassandra_create_table.pcap | Bin 0 -> 3735 bytes .../deploy/docker/pcaps/cassandra_insert.pcap | Bin 0 -> 287 bytes .../docker/pcaps/cassandra_mixed_frame.pcap | Bin 0 -> 114224 bytes .../deploy/docker/pcaps/cassandra_select.pcap | Bin 0 -> 316 bytes .../pcaps/cassandra_select_via_index.pcap | Bin 0 -> 338 bytes .../docker/pcaps/cassandra_trace_err.pcap | Bin 0 -> 285 bytes .../endace/_dev/deploy/docker/pcaps/dhcp.pcap | Bin 0 -> 1400 bytes .../deploy/docker/pcaps/dns_additional.pcap | Bin 0 -> 350 bytes .../deploy/docker/pcaps/dns_google_com.pcap | Bin 0 -> 452 bytes .../_dev/deploy/docker/pcaps/dns_mx.pcap | Bin 0 -> 532 bytes .../deploy/docker/pcaps/dns_not_found.pcap | Bin 0 -> 297 bytes .../_dev/deploy/docker/pcaps/dns_ns.pcap | Bin 0 -> 1479 bytes .../deploy/docker/pcaps/dns_tcp_axfr.pcap | Bin 0 -> 915 bytes .../_dev/deploy/docker/pcaps/dns_txt.pcap | Bin 0 -> 757 bytes .../deploy/docker/pcaps/dns_udp_edns_ds.pcap | Bin 0 -> 461 bytes .../pcaps/http_10_connection_close.pcap | Bin 0 -> 23972 bytes .../deploy/docker/pcaps/http_basicauth.pcap | Bin 0 -> 5156 bytes .../deploy/docker/pcaps/http_get_2k_file.pcap | Bin 0 -> 4821 bytes .../deploy/docker/pcaps/http_minitwit.pcap | Bin 0 -> 17512 bytes .../deploy/docker/pcaps/http_over_vlan.pcap | Bin 0 -> 1946 bytes .../_dev/deploy/docker/pcaps/http_post.pcap | Bin 0 -> 9999 bytes .../deploy/docker/pcaps/http_post_json.pcap | Bin 0 -> 11211 bytes .../_dev/deploy/docker/pcaps/http_realip.pcap | Bin 0 -> 32074 bytes .../deploy/docker/pcaps/http_url_params.pcap | Bin 0 -> 9925 bytes .../docker/pcaps/http_x_forwarded_for.pcap | Bin 0 -> 1530 bytes .../_dev/deploy/docker/pcaps/icmp4_ping.pcap | Bin 0 -> 148 bytes .../docker/pcaps/icmp4_ping_over_vlan.pcap | Bin 0 -> 156 bytes .../_dev/deploy/docker/pcaps/icmp6_ping.pcap | Bin 0 -> 188 bytes .../docker/pcaps/icmp6_ping_over_vlan.pcap | Bin 0 -> 196 bytes .../deploy/docker/pcaps/icmp_2_pings.pcap | Bin 0 -> 272 bytes .../pcaps/memcache_bin_tcp_counter_ops.pcap | Bin 0 -> 2149 bytes .../docker/pcaps/memcache_bin_tcp_delete.pcap | Bin 0 -> 1793 bytes .../memcache_bin_tcp_multi_store_load.pcap | Bin 0 -> 2912 bytes .../memcache_bin_tcp_single_load_store.pcap | Bin 0 -> 5780 bytes .../docker/pcaps/memcache_bin_tcp_stats.pcap | Bin 0 -> 3942 bytes .../pcaps/memcache_bin_udp_counter_ops.pcap | Bin 0 -> 352 bytes .../docker/pcaps/memcache_bin_udp_delete.pcap | Bin 0 -> 221 bytes .../pcaps/memcache_bin_udp_multi_store.pcap | Bin 0 -> 454 bytes .../pcaps/memcache_bin_udp_single_store.pcap | Bin 0 -> 1154 bytes .../pcaps/memcache_text_tcp_counter_ops.pcap | Bin 0 -> 1778 bytes .../pcaps/memcache_text_tcp_delete.pcap | Bin 0 -> 1507 bytes .../memcache_text_tcp_multi_store_load.pcap | Bin 0 -> 2101 bytes .../memcache_text_tcp_single_load_store.pcap | Bin 0 -> 5695 bytes .../docker/pcaps/memcache_text_tcp_stats.pcap | Bin 0 -> 2668 bytes .../pcaps/memcache_text_udp_counter_ops.pcap | Bin 0 -> 288 bytes .../pcaps/memcache_text_udp_delete.pcap | Bin 0 -> 204 bytes .../pcaps/memcache_text_udp_multi_store.pcap | Bin 0 -> 428 bytes .../pcaps/memcache_text_udp_single_store.pcap | Bin 0 -> 1147 bytes .../docker/pcaps/mongo_3.0_session.pcap | Bin 0 -> 12090 bytes .../deploy/docker/pcaps/mongo_one_row.pcap | Bin 0 -> 752 bytes .../pcaps/mongodb_create_collection.pcap | Bin 0 -> 1760 bytes .../deploy/docker/pcaps/mongodb_find.pcap | Bin 0 -> 944 bytes .../pcaps/mongodb_insert_duplicate_key.pcap | Bin 0 -> 1767 bytes .../deploy/docker/pcaps/mongodb_inserts.pcap | Bin 0 -> 2376 bytes .../docker/pcaps/mongodb_more_rows.pcap | Bin 0 -> 46491 bytes .../pcaps/mongodb_reply_request_reply.pcap | Bin 0 -> 1281 bytes .../deploy/docker/pcaps/mongodb_use_db.pcap | Bin 0 -> 545 bytes .../docker/pcaps/mysql_affected_rows.pcap | Bin 0 -> 359 bytes .../deploy/docker/pcaps/mysql_connection.pcap | Bin 0 -> 2021 bytes .../mysql_err_database_not_selected.pcap | Bin 0 -> 332 bytes .../_dev/deploy/docker/pcaps/mysql_long.pcap | Bin 0 -> 183149 bytes .../docker/pcaps/mysql_long_result.pcap | Bin 0 -> 3922 bytes .../pcaps/mysql_windows_lineending.pcap | Bin 0 -> 757 bytes .../docker/pcaps/mysql_with_whitespaces.pcap | Bin 0 -> 5398 bytes .../_dev/deploy/docker/pcaps/nfs4_close.pcap | Bin 0 -> 584 bytes .../_dev/deploy/docker/pcaps/nfs_v3.pcap | Bin 0 -> 426 bytes .../_dev/deploy/docker/pcaps/nfs_v4.pcap | Bin 0 -> 642 bytes .../deploy/docker/pcaps/nfsv42_clone.pcap | Bin 0 -> 580 bytes .../docker/pcaps/nfsv42_layoutstats.pcap | Bin 0 -> 744 bytes .../docker/pcaps/pgsql_extended_query.pcap | Bin 0 -> 1561 bytes .../deploy/docker/pcaps/pgsql_insert.pcap | Bin 0 -> 355 bytes .../docker/pcaps/pgsql_insert_error.pcap | Bin 0 -> 650 bytes .../docker/pcaps/pgsql_long_result.pcap | Bin 0 -> 3496 bytes .../docker/pcaps/pgsql_request_response.pcap | Bin 0 -> 503 bytes .../_dev/deploy/docker/pcaps/pgsql_rt.pcap | Bin 0 -> 3012 bytes .../docker/pcaps/redis_one_transaction.pcap | Bin 0 -> 233 bytes .../deploy/docker/pcaps/redis_session.pcap | Bin 0 -> 2303 bytes .../endace/_dev/deploy/docker/pcaps/sip.pcap | Bin 0 -> 6632 bytes .../pcaps/sip_authenticated_register.pcap | Bin 0 -> 1654 bytes .../docker/pcaps/thrift_integration.pcap | Bin 0 -> 21462 bytes .../deploy/docker/pcaps/thrift_tutorial.pcap | Bin 0 -> 6363 bytes .../deploy/docker/pcaps/tls-version-13.pcap | Bin 0 -> 14332 bytes .../docker/sample_logs/ipfix_cisco.pcap | Bin 0 -> 4358 bytes packages/endace/changelog.yml | 16 + .../system/test-http-get-2k-file-config.yml | 6 + .../test/system/test-icmp-2-pings-config.yml | 7 + .../test/system/test-icmp4-ping-config.yml | 6 + .../test/system/test-icmp6-ping-config.yml | 6 + .../flow/agent/stream/flow.yml.hbs | 42 + .../ingest_pipeline/compatibility.yml | 32 + .../elasticsearch/ingest_pipeline/default.yml | 101 + .../elasticsearch/ingest_pipeline/geoip.yml | 103 + .../endace/data_stream/flow/fields/agent.yml | 196 + .../endace/data_stream/flow/fields/base.yml | 12 + .../endace/data_stream/flow/fields/beats.yml | 95 + .../endace/data_stream/flow/fields/ecs.yml | 144 + .../data_stream/flow/fields/protocol.yml | 15 + .../data_stream/flow/fields/protocol_ecs.yml | 23 + packages/endace/data_stream/flow/manifest.yml | 67 + .../endace/data_stream/flow/sample_event.json | 86 + .../pipeline/test-netflow-log-events.json | 3373 ++++++++++++++++ ...test-netflow-log-events.json-expected.json | 3587 +++++++++++++++++ .../_dev/test/system/test-netflow-config.yml | 9 + .../log/agent/stream/netflow.yml.hbs | 37 + .../elasticsearch/ingest_pipeline/default.yml | 115 + .../endace/data_stream/log/fields/agent.yml | 71 + .../data_stream/log/fields/base-fields.yml | 17 + .../endace/data_stream/log/fields/ecs.yml | 712 ++++ .../data_stream/log/fields/package-fields.yml | 2689 ++++++++++++ packages/endace/data_stream/log/manifest.yml | 95 + .../endace/data_stream/log/sample_event.json | 123 + packages/endace/docs/README.md | 400 ++ .../elasticsearch/ingest_pipeline/endace.yml | 52 + packages/endace/img/endace-logo.svg | 12 + packages/endace/img/endace-screenshot-1.png | Bin 0 -> 10982 bytes packages/endace/manifest.yml | 100 + packages/endace/validation.yml | 5 + 126 files changed, 12635 insertions(+) create mode 100644 packages/endace/LICENSE.txt create mode 100755 packages/endace/_dev/build/build.yml create mode 100644 packages/endace/_dev/build/docs/README.md create mode 100644 packages/endace/_dev/deploy/docker/docker-compose.yml create mode 100644 packages/endace/_dev/deploy/docker/pcaps/amqp_channel_error.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/amqp_emit_receive.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/amqp_publish.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_create_index.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_create_keyspace.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_create_table.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_insert.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_mixed_frame.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_select.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_select_via_index.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/cassandra_trace_err.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dhcp.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_additional.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_google_com.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_mx.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_not_found.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_ns.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_tcp_axfr.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_txt.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/dns_udp_edns_ds.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_10_connection_close.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_basicauth.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_get_2k_file.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_minitwit.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_over_vlan.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_post.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_post_json.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_realip.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_url_params.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/http_x_forwarded_for.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/icmp4_ping.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/icmp4_ping_over_vlan.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/icmp6_ping.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/icmp6_ping_over_vlan.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/icmp_2_pings.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_counter_ops.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_delete.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_multi_store_load.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_single_load_store.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_stats.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_counter_ops.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_delete.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_multi_store.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_single_store.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_counter_ops.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_delete.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_multi_store_load.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_single_load_store.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_stats.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_udp_counter_ops.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_udp_delete.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_udp_multi_store.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/memcache_text_udp_single_store.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongo_3.0_session.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongo_one_row.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongodb_create_collection.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongodb_find.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongodb_insert_duplicate_key.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongodb_inserts.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongodb_more_rows.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongodb_reply_request_reply.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mongodb_use_db.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mysql_affected_rows.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mysql_connection.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mysql_err_database_not_selected.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mysql_long.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mysql_long_result.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mysql_windows_lineending.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/mysql_with_whitespaces.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/nfs4_close.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/nfs_v3.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/nfs_v4.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/nfsv42_clone.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/nfsv42_layoutstats.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/pgsql_extended_query.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/pgsql_insert.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/pgsql_insert_error.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/pgsql_long_result.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/pgsql_request_response.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/pgsql_rt.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/redis_one_transaction.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/redis_session.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/sip.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/sip_authenticated_register.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/thrift_integration.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/thrift_tutorial.pcap create mode 100644 packages/endace/_dev/deploy/docker/pcaps/tls-version-13.pcap create mode 100644 packages/endace/_dev/deploy/docker/sample_logs/ipfix_cisco.pcap create mode 100644 packages/endace/changelog.yml create mode 100644 packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml create mode 100644 packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml create mode 100644 packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml create mode 100644 packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml create mode 100644 packages/endace/data_stream/flow/agent/stream/flow.yml.hbs create mode 100644 packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/compatibility.yml create mode 100644 packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml create mode 100644 packages/endace/data_stream/flow/fields/agent.yml create mode 100644 packages/endace/data_stream/flow/fields/base.yml create mode 100644 packages/endace/data_stream/flow/fields/beats.yml create mode 100644 packages/endace/data_stream/flow/fields/ecs.yml create mode 100644 packages/endace/data_stream/flow/fields/protocol.yml create mode 100644 packages/endace/data_stream/flow/fields/protocol_ecs.yml create mode 100644 packages/endace/data_stream/flow/manifest.yml create mode 100644 packages/endace/data_stream/flow/sample_event.json create mode 100644 packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json create mode 100644 packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json create mode 100644 packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml create mode 100644 packages/endace/data_stream/log/agent/stream/netflow.yml.hbs create mode 100644 packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/endace/data_stream/log/fields/agent.yml create mode 100644 packages/endace/data_stream/log/fields/base-fields.yml create mode 100644 packages/endace/data_stream/log/fields/ecs.yml create mode 100644 packages/endace/data_stream/log/fields/package-fields.yml create mode 100644 packages/endace/data_stream/log/manifest.yml create mode 100644 packages/endace/data_stream/log/sample_event.json create mode 100644 packages/endace/docs/README.md create mode 100644 packages/endace/elasticsearch/ingest_pipeline/endace.yml create mode 100644 packages/endace/img/endace-logo.svg create mode 100644 packages/endace/img/endace-screenshot-1.png create mode 100644 packages/endace/manifest.yml create mode 100644 packages/endace/validation.yml diff --git a/packages/endace/LICENSE.txt b/packages/endace/LICENSE.txt new file mode 100644 index 00000000000..809108b857f --- /dev/null +++ b/packages/endace/LICENSE.txt @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. diff --git a/packages/endace/_dev/build/build.yml b/packages/endace/_dev/build/build.yml new file mode 100755 index 00000000000..71f48ba2a9c --- /dev/null +++ b/packages/endace/_dev/build/build.yml @@ -0,0 +1,4 @@ +dependencies: + ecs: + reference: "git@v8.11.0" + import_mappings: true diff --git a/packages/endace/_dev/build/docs/README.md b/packages/endace/_dev/build/docs/README.md new file mode 100644 index 00000000000..6bb259983a7 --- /dev/null +++ b/packages/endace/_dev/build/docs/README.md @@ -0,0 +1,171 @@ +# Network Packet Capture Integration + +This integration sniffs network packets on a host and dissects +known protocols. + +Monitoring your network traffic is critical to gaining observability and +securing your environment — ensuring high levels of performance and security. +The Network Packet Capture integration captures the network traffic between +your application servers, decodes common application layer protocols and +records the interesting fields for each transaction. + +## Supported Protocols + +Currently, Network Packet Capture supports the following protocols: + +- ICMP (v4 and v6) +- DHCP (v4) +- DNS +- HTTP +- AMQP 0.9.1 +- Cassandra +- Mysql +- PostgreSQL +- Redis +- Thrift-RPC +- MongoDB +- Memcache +- NFS +- TLS +- SIP/SDP (beta) + +### Common protocol options + +The following options are available for all protocols: + +#### `map_to_ecs` + +Remap any non-ECS Packetbeat fields in root to their correct ECS fields. +This will rename fields that are moved so the fields will not be present +at the root of the document and so any rules that depend on the fields +will need to be updated. + +The legacy behaviour of this option is to not remap to ECS. This behaviour +is still the default, but is deprecated and users are encouraged to set +this option to true. + +ECS remapping may have an impact on workflows that depend on the identity +of non-ECS fields, and users should assess their use of these fields before +making the change. Users who need to retain data collected with the legacy +mappings may need to re-index their older documents. Instructions for doing +this are available [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). +The pipeline used to perform ECS remapping for each data stream can be found +in `Stack Management`›`Ingest Pipelines` and and searching for +"logs-network_traffic compatibility". + +The deprecation and retirement timeline for legacy behavior is available +[here](https://github.com/elastic/integrations/issues/8185). + +#### `enabled` + +The enabled setting is a boolean setting to enable or disable protocols +without having to comment out configuration sections. If set to false, +the protocol is disabled. + +The default value is true. + +#### `ports` + +Exception: For ICMP the option `enabled` has to be used instead. + +The ports where Network Packet Capture will look to capture traffic for specific +protocols. Network Packet Capture installs a +[BPF](https://en.wikipedia.org/wiki/Berkeley_Packet_Filter) filter based +on the ports specified in this section. If a packet doesn’t match the +filter, very little CPU is required to discard the packet. Network Packet Capture +also uses the ports specified here to determine which parser to use for +each packet. + +#### `monitor_processes` + +If this option is enabled then network traffic events will be enriched +with information about the process associated with the events. + +The default value is false. + +#### `send_request` + +If this option is enabled, the raw message of the request (`request` +field) is sent to Elasticsearch. The default is false. This option is +useful when you want to index the whole request. Note that for HTTP, the +body is not included by default, only the HTTP headers. + +#### `send_response` + +If this option is enabled, the raw message of the response (`response` +field) is sent to Elasticsearch. The default is false. This option is +useful when you want to index the whole response. Note that for HTTP, +the body is not included by default, only the HTTP headers. + +#### `transaction_timeout` + +The per protocol transaction timeout. Expired transactions will no +longer be correlated to incoming responses, but sent to Elasticsearch +immediately. + +#### `tags` + +A list of tags that will be sent with the transaction event. This +setting is optional. + +#### `processors` + +A list of processors to apply to the data generated by the protocol. + +#### `keep_null` + +If this option is set to true, fields with `null` values will be +published in the output document. By default, `keep_null` is set to +`false`. + + +## Network Flows + +Overall flow information about the network connections on a +host. + +You can configure Network Packet Capture to collect and report statistics +on network flows. A *flow* is a group of packets sent over the same time +period that share common properties, such as the same source and destination +address and protocol. You can use this feature to analyze network +traffic over specific protocols on your network. + +For each flow, Network Packet Capture reports the number of packets and the +total number of bytes sent from the source to the destination. Each flow event +also contains information about the source and destination hosts, such +as their IP address. For bi-directional flows, Network Packet Capture reports +statistics for the reverse flow. + +Network Packet Capture collects and reports statistics up to and including the +transport layer. + +**Configuration options** + +You can specify the following options for capturing flows. + +#### `enabled` + +Enables flows support if set to true. Set to false to disable network +flows support without having to delete or comment out the flows section. +The default value is true. + +#### `timeout` + +Timeout configures the lifetime of a flow. If no packets have been +received for a flow within the timeout time window, the flow is killed +and reported. The default value is 30s. + +#### `period` + +Configure the reporting interval. All flows are reported at the very +same point in time. Periodical reporting can be disabled by setting the +value to -1. If disabled, flows are still reported once being timed out. +The default value is 10s. + +{{fields "flow"}} + +{{event "flow"}} + +## Licensing for Windows Systems + +The Network Packet Capture Integration incorporates a bundled Npcap installation on Windows hosts. The installation is provided under an [OEM license](https://npcap.com/oem/redist.html) from Insecure.Com LLC ("The Nmap Project"). \ No newline at end of file diff --git a/packages/endace/_dev/deploy/docker/docker-compose.yml b/packages/endace/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..645c7f1a81e --- /dev/null +++ b/packages/endace/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,13 @@ +version: "2.3" +services: + network_traffic: + image: alpine + volumes: + - ./pcaps:/sample_pcaps:ro + - ${SERVICE_LOGS_DIR}:/pcaps + command: /bin/sh -c "cp /sample_pcaps/* /pcaps/" + netflow-log-netflow: + image: akroh/stream:v0.0.1 + volumes: + - ./sample_logs:/sample_logs:ro + command: pcap --start-signal=SIGHUP --delay=5s --addr elastic-agent:2055 -p=udp /sample_logs/ipfix_cisco.pcap diff --git a/packages/endace/_dev/deploy/docker/pcaps/amqp_channel_error.pcap b/packages/endace/_dev/deploy/docker/pcaps/amqp_channel_error.pcap new file mode 100644 index 0000000000000000000000000000000000000000..313bb20e09266b367aaf3f6621fe9e730c489b5f GIT binary patch literal 2164 zcmaKtOK%%h6oAi!JRB#=BDhhgDi{!w9ZKvpZE1im5@NRv%CmVC7GTEXYx^qWnaRwZ z1TPRMg78w2Dk52tB2~~<^*Ye}fg-U%CW|guB7_86vZ1SnbFOEsG#QfQjP9Ms`ObIl z&CH{RJKwcHD+E6W2LLNLx&G+>672NAB#tQno@s@4Ilw~%G60ur>!UE*zIo|m0EJ@X zW?$m=?mwmNt@`~>`jw?8LwHh&MB$}(|DqV1nwtgaR4Dgj%>BCpGLGj~_Nrr)`_7+1 z?!LsvP0EY;ZOVP{)6=;z6`t6HDE@Zh$m-TLTg!2S3(njtc=7vQ+shf;EiosnTV{bf zWmhPt*@t>bGm9+S9OSr}=VlQvMsu3W^`xok%R=eHhg`2rPiv;mjI3!1UZ@DA7cZDh z7u+(FIm6PISzaj5Ht)6_ZaK0Fp`6h?QDUaxx<=#u{L251X>yP@bYSNKQi{TRL9!3rrtysuT?BJX?4fp=q{ z?~UKy-H%D{%VFN#=>0tAYr(&?zX&*~OVx}tFam&YkVk`z1RU!U z0U`*X-QHlF+wB2{6N->7E!Mt}68!%rtrX^a)acBu^o)t4Wio@gRYJAh3WFiV)yZ?JFsGDggRjT}Q!N z68QF0!2JgBGy-FX1#QE!C80s>?gv=MIYkK7sa}(sZw6Ff^A>8}l~gR(|I(7CPkjxU z31#!_^vpu`%FN<)S{+nPOAS7BYMiQwtK3vqOO`9tcq&eH%03jaBK%m(2&rha_O5ya2_^3%nq~2SY+=NFaud5h2zDHmvc1Y(nZ2;i`i1k|5M`&Rn|P4pSd^@WF;} zv$M1N|DFFi-{lNHemih9kL5G-Z+MuoZn)UG_luVIhl|*Hc#nfIcRrgyZ{VentzxV; z^L`zxo51_~7<1vcE|iu(I2l_VSTz0jJu_S_k1F9qSD}Z^{qi!7Wev?uj1{?1`v>M> zKe-r`;MtyT7F$XUC?ht?cocfwLuC#_yklvtO(vIlLRit@lsUMBr(1k zZhl@8OYl)C-Y%*kL6O@ewJWZ5ydQQ=1VMMLw%9ikcs1Nhy7YG1&& z5Z*k6^Z(rnXnFk^8@Swzy>6Fem=uBjpy?%{U& zxvuV5f$4V=izLLjX1tQ`+B^^23K8P4@x3;=1bz3#P2c)FpV<%d{66`v9pyWv`?h8=(VXrH z7UvZ^KZW3@+~sGC7`)rVnn4|h4P#ld78!lLCd0_t@dqcnOUX-(9ispk3v|HO;{Y-T z$i#dTpeL)l6if`*1F$RwY$_ng!C(2#SxPP?2bu{m91MVic?1}fB?J@#0B5_-m|x&w z0$kv*$x<+LkW7@A48z1cFmaw3YjU%MjOnZ#OtAc@5{XY}<76eFVexh3VL-wTPQwOS zmwb(E^_WP*)_JhCoRF|h7zY9_VwlW`%m-vKrR^H%<3hn4H z7uRg-;6go-V3i`aHt(q7+kz1S!V87*a*>C<0~a`K!iZ)LVHn(>W*COumcXJ}E(+sq zyD%ytjH!%`69^TUxOyySJ>!(Nj#82^W6@JG%LOUf?^N0Vn?_!%i#_Zc;Nh_GdMfiV zc|B$78(#N=*U6-R+|Fx))&2{w>jaI9RQR>7m_MRa@ChjzUKj|}R4-guRpW=VuZxqz z6;VkRD>yX*C%ml1{UL?#@Qb~oUlj#W+98H;K~z+Ytc7!6=rCBpVPoinNgoZ|KcY)>_yAhNeBicvC!_y&`OPj(yyx7%Kmq8LFOpwHR_ArckXu?(`vC zwuNMwk#;A{8z=4La!NzamM|*}X_zur`}84GTZFjTO}C?Vx)HTIJFU3GrRBGSZO!`{ zuML5AR{wdXjLkh$X7-<`{n;(IWB=K40kyAirZ$u>jJlxTirORnr>>0~&Hw!;HH81U z{uArnciZjQf2NzT-W`|CdSBP)QtQ6Pp?bv^Id`CIEYch`cDL0{Mk869fRcHW{!g+;J`{1px+8X;IKK<>(iUb(v}=c4Zt`{`b%>+3A8jB&h&DlrH0NAL9>5#GZAj# zumNpOw-9Ju4v4ov^`k*~)JV?+koi}zhj}!ySM$STy(AO#d4M`SR;9NP^sOA|UJIHt zt=$AIXcwbVg#bMO*a89IuyM5}y_EnhIe>!};MLKt^v8o@=7ibe!#%&}TY# z5ub(Ge#~jMPh|@zkLN&tJA{eDCXbEjRw`HS0zL-ixV;Z+P#` z%=h!Yzuzx2`T6nvuUc3u3qSQbWAiYvH@~^^+jA<*!5D+FW3B8s4d4)G!;JO&*9O?Y z@nQXA#uSX(_qvi>x9t4(=-Ks^rR*b=s@iE5Q71UN=QrYhcqd2Io zY}LL+?N5rKc31NDJ=6vLNz|^dH??D^4N|c1IZME|9Y#)vsaJGESV9W!y$2`1?yOV| zOL!&j7EH&U5pLO&%CmgQEa~Jm*?T%F0{m^y1=T%GC`+$nt#3bjs;?#nL6}phRNW zwIC_!4=#_jRa~c7HEBojOLWJ`c-sPZJuraR#`;pdsn=m}0_&R_%#Lbw#8ccZOyoDQ z-m6gWKVS*tV7=L|{&lSP(BrV)K`%{ikEW-g-cvh2?x}Z->dn4{YOA34(e7Qoh!#EY zI4fkSYLGimx?C?V>dR@pJYU(p{g%!92U;cd|7slz{dTa~D)(e?B;Sv~_chodMuhM8 zYmd

Yt(SMxUprq0j5&yFbcz2l##-^jhFIM4as-IQ}GZhA)MjAis6UuRNUd0z49c z!xF^#7dV$;h7sXs$p4Ty6MH$%$tLH`C_i!VlT^}-5yR|O**K_UL@)+x>&RIBCu9UU zlUui(Zt`+2iV*`wPXn-X1i-&RCa#8nMzWl4FmW>)fbAG#PXU4){B-*8EY-dv2Y-ct zz`;#$kRiZ3fQdWA7~G#FWIV}w!32wy zxMew{Ooo1WMP*Yk#fX57*1ji0+aWA4bO#J&3HELjtP^1BE)+-;EpbL=*I|MYLA&S| z$XYI>1=g})ZH;K}MA1&LewGBi07#_MK;p255kZ>pr-?MMk5p)qvU^D_43qc_kit)F zg(W0kl4*Fp3Y(yP06na~eVw5BebALAbYFiTBWS}G0X_r3RoDPVgsTg_5t+YFn}E0X zx>5+BLi;7z25Ax|msAm)+v;S}Q0l0Y> M?FOY=f!4SAA53Z=ssI20 literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/cassandra_create_index.pcap b/packages/endace/_dev/deploy/docker/pcaps/cassandra_create_index.pcap new file mode 100644 index 0000000000000000000000000000000000000000..5ea3accfc936c3ce1cb7a3ac0be65f288c7347ea GIT binary patch literal 3771 zcmdUyU2GIp6vywjyX{iCu#^T+3t1$wYRD?m6e~7R+eJvqw&_P82))eC-0qH@k7Z`I zbTKGkZNz6au@3|ZAu%zA$O|SKl^VphK*Ul+WhN4ZQ57d>T4?2FtX!{%S?Pkcj-l0^_NGh=_-Iv;%7)U1y zwy^BPi<%+n;-#%D)PYV4i?T@P@W|}wCSvILEX;CHllTnEzDza4hM^lVvJVdX*qTj+ zxxE3ydE%G`Llob)Ln5qkbg&N;eJnE4^HzU~HR;6(QMB`tELg-PBD>vZ!t4b4llXSu zpSoLZ*Ppu$+w+)v+ng2Hy#TxCG4}&B_a4X_!>RsM??@sqgtakY!VZ<~b}5q$!p;~0s=Cpv2US(E68fap*a(FG8V5z%%? zmrt~adCin1EwN{3YABV!8g;k3igq7p{m)@`5(AO=Kp$PcSPkU6X1?uKx&f{^G*=9O zE@O!WRH9P$=Lb%tn25|xyHx_40E0ztf%c{v)Gro0K>h_&5o53@Q4|d|~ zXf3d7g8|rN0CojnmjO0LV2F8l3<3+4!Q6$YNkARrU#)$&>zOxSUw5{B+1&vQ=Q?zR8x5om2SA-dhHY%88O^jlcXbM zG+~!r=Y}_@JWF&Z+RG8&p6E&UCEVUYtD6HQCl^6IgE^6S)S(l~(VEmwiF&@gmPCCW z)CY-r9Ksi)mQAgo8&8W3bJ7!;Qw>E-J@qQVT!zeLAqN+monxulEET*Uq5id3X5p2y zut(y@(&-())$+=~m6BKHKCOx+@`_B{GGzZ^+>@#}{KU}IxppL-oDZ`UQi{Z5j`nOl zSIz8|i)*LaZVe_;E_g#{!2AtJXbyK& z9oQz<)JegXuqH9(2!n>UU32v;o|Spl!e+*8A)AI`qgS0f!qB>?`cNkPDjR02vc= ztRmK_`EX8Hg3FqOa)WnVa4v^)>&GgbyYgY@Hh7h7p?90gMGV9JFI^WI*QBh?o(KP< zz4+g_3pod`R34RZlyWx;sH5AakKB3to7VU6yvcW7n6eMg^*#OlxV2d3VVi=8=OxQg z-Sl8AoE}Ki220mbNIfKikg(~?ZKjn?O30<0NXk%2hGI!cC6g>?SaMiBB1TjMlF}Qb z-LPXxj>zJm!D1BJP7cYJGc^T@y3Mb-Y6Nek+C6x_L+y|jIae?yxF(FOlcRv2$WTis z9ZmzdWKB5Lbm1u3ll}WTh>4y}oC~o?zvI`tqT9avg05M-hJ9V>9>+Vab(E%Q77W4; zv)C)tEq+f7pYD#Y`1R6E@1i40l&a3S7-yU4yBi-c)*ISAS|6 z`xQ0Pens;oV=z!%L!+h5>T!wI>~|~`*+w%@&h@HMDXkB}Ug+Zrd(nsOp@OO#)rtL-F5*Bufd9UI0#x9wi^MWW?qPe>F|82`p~omE?t@E_>mh0#FCmJx-PbGqZmNq=g?l`}WQE{rB+(xg$yxDSWXvBBNh)`V=JbrBQW6`E28kq&jSL6; z(cy52^pR^sP?L(T3#69_kwhw!q>-$qWa&gs=puqfGs%RiWE1Hr`J$p`(;C~@O=eC3 zcO1LL!2|9S()YQ66(**Ak;f&rToQBs#~G)XPHD}{gmmNwhi2QlUl`Gn7=sDAgJL}R zekZ~Wyd`GPngzQ*0FqTb>WzqOlBouO?MFotdg~fvB)2zYaHwQJAd~lonputHI_L!Rh z8Xs*ves`eiWccaamfZ7;Tfl0~tXi<5nyXyRaxgn&PHYhwCteCFXk7G$tx z-kX2ulxd%Y&7G#@X*>yEjMfR<18?!s2%<5a4zxa6=Ow|MQk6&H=IuvReyYwI?L r20k24YZE>Nr^_VusW?ZJsko;2*lEC7;d2fY+`g}(mpxE$mFxZo^^jr0 literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/cassandra_create_table.pcap b/packages/endace/_dev/deploy/docker/pcaps/cassandra_create_table.pcap new file mode 100644 index 0000000000000000000000000000000000000000..adc90767d8edfd04ceebbf67cd7b41871ee0698b GIT binary patch literal 3735 zcmdUyUu+ab9LML{JMJi5JxYT_Nn9kcN}AL1r&tJ~wVYBYg}Zw~ty9V9i7G-Dr)e9+F?XEF8)V-b?e(&Eg* zE9<*&Hcs3eS@7iP$zy1YBF%^#bh+co zkJZVdrWm?xSf0Ek)3vE1vqRpP-qDP%0ZYwu+2eaWdNaefy2n?u$a2i7vjmH^_RjzH z_3eZlaV3^RGf9A~7xil7#hJ?z;R5@@$by#lC%1>lX9#-~$O(Mk1c|Y@5511X1U9S7 z4-fKTx1egA#l#-Ox-U!Y5XO@P>mE4tR`t4psxI7YJhud@IyLEp>yBgHGf>r1QdI|J zRd2dG-PtD>ICq+5r=TgSt~=ayn`Kwa@w}=GL3@U6$vVjdodt5z$@{ z9mGr|0nz@k9n%qYMM9#Ns))uxw2X+_A#DNC49lCgrke7$_32DnhK|-WiH4>CsBcta zuVEsR0O;_wpQ?d;)0|tf@JiPPnC9Kd;SlI7R5T9LEG5&d59WxVtYx$O?X#G_|0oqK z$>vn34X^iAle2n!D>U`hQHdQvog@G|G?tkbY+ndA6oO3v>@2{R5g0;5%t2t0GMG@r zv;;IT`KUa&K+Cj5POeVHA2_ziCi{ImCb3V^NfJ<u9a6%lP~tr!H>=iLkGII2| z#QwmZNPOzZZ=e4-E%nzW>RZ25QJ)9(3Zfo>C^J!Owpq+u_lk|>TL0E^hNbg8_pBu> zx0062LUzrxJI^t)SxS*%K>aJLV7;ekJq_~0OzRC9eD~j8j0R8d0WXdt6JkLU-vix)_xT6dd6fLJ($lY-k*HkTMSXs6R!z8@g`8>BgngLZLcn|qC z=$u0>lz+=jNzKtP8P^8OQ$DC`BGeU!t2%xPs^OG-8+AUQ7EMp_j67F7TQQ9x&StYZ z9B&LEsG79YSv|sfF+sLl&pi(Msc}jTe^!6Y78Cet0AxMQG`?C7n>VWP4qpK z=XqZN17^|9DFyBrwvG`>o<42Jqc-KEhG}`{x&^KkP1OS?Hsd+N;PI_dc?#l`6gdE0 ziM6A9e}49h#(k)_K*)GevJcAIj_z(04UWCrB`T$$I-VhPj6pq{dnk9(vma6miD{-Yfv${mGyF@!NGp&X{CEd2$z}`&aed>c}%MNx#h$} zbsI-Ml=M4({U@>Zn=yKh;}wxAo>G~_8+m?$wrLkF!j3ZO2^y5V!Fx}vNzT3Y-K%XU z4j#GjgXqIu$SFerFk0LdoGjbIjr7)X+dzi&UUYHtX zv%?esr;z$p7amQg2rhE)&HF1F=orD6|79TFIr`=qmSz@puBfJ|1Sb(x{@(;;{q7uG zUqQei5=D?Q7A(6zy#UK4q%eLtH5;nvgo<&ZgK#JbN zLnZw`KzXOR#NP%QSDLHT@XzOpQ>G&qFV9xdB!wwWLDHi!5PE8npka_!3PlrAiniDk zg9Mk1yBVa;PvJpmmDC)!3zSd&Q-o5rxZi#|?>mJ&R2QT2(OC|z0ZMqeKcEcw$^?!N%2>;_i= literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/cassandra_insert.pcap b/packages/endace/_dev/deploy/docker/pcaps/cassandra_insert.pcap new file mode 100644 index 0000000000000000000000000000000000000000..74c6ba51da31af3eda54b7f49d3ee45af36085db GIT binary patch literal 287 zcmca|c+)~A1{MYcfUs}e$PYiVl7nFpPy&RRfY_CRVIK1|2L=Z=28MbD21XD*^HDj7 zDWmE*=h5gZ4HDYB|4jl4GIDSQ7u-w?F7V?6n)Zhss5cRaeLVewU4udtJpDra6-tX! zi;5LAKvaBYijIOpT3%vqs*XYqh|=UzPzZDM33Uxt&@ePNG1XB}&&topQwP$;xtS#y z>YCOJj3z)MQy4fHSk3g(`g)Z>E@t}90dgf6LtX4>RD|kc<)AYkL9S)Ws5WenFo^wU U3U_e{$ki=C7jpp30EGi1020SV=Kufz literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/cassandra_mixed_frame.pcap b/packages/endace/_dev/deploy/docker/pcaps/cassandra_mixed_frame.pcap new file mode 100644 index 0000000000000000000000000000000000000000..a0417059a942ffb1d94b138be12eaaf4df06ed40 GIT binary patch literal 114224 zcmeF437A|}nfEJXUrEwY;$C*Z1=HQNFHx2lB5Oz_VG+c#x~jUnNOe_HOF99=ridGe zxS)*dprei`j(`dZ;yNya8=#Eh_=z)aaWv|L|4dAWPQkt6lI79wKk^)icjyx= zp{-)UIs0QKjzilOLR&YSkAQO%w8+Py=f?PnCXPYRYUsJ%r00Z<>yHZ$g-_VFZOc$} zFuHWn`c`wSRxe+WZSE08|6ayC1;-2%%7P^ZQ8bRr+k(!I-%BRt_xRcg?wd9 zzGh>Q$kIg{YSm_`+8j8gR2^-Otqbd>YN?>XwwFp11NlmMM``JzrHe!qw_8Nv~gBdgYvoSOcTdL&yRd^ZsRPxAQ+Fn|1%%XMQirn@xU3M$KJZdqrb{A zH+EcV!MyAd6B8aUdiSeN`EPK)&?O%I6`B3j#k>wozg_)m(!|`O>HGq?zky$GJW^O9 z|BqO3-uZqL$D!>vLR&YSITwaPpN41oI8J!;FJ5Ef81zUy`cT^m6+Opq+!h|nRcpmk z<8cd0N5Y3+u76!%^3jpUnJ@JDM_aCUUla;`c$NNWd93=tk|+1TAtT7^QX(HLpzpCkElrBv)+7umhGzffs4 znx%TKnjbIquj?;W@{MM>&?x2Wg|Ys%{Yqm3c53F#a;}s-VQZsYEWPOD6Km(!k1wy6 zBhHmuDy>m2Xx8)9#zd{&%;k&4I-LROMUawV35OYrdI2@Mhv=sBr zJb%j7(GujGig|b)pwK&N(>HW=VG~ftX|3&Cu%he@527ce6uiy==pkntJEsx8s!Uw zjA%q@$oUl$Z8=~g<((MnZjg3Pl-@Mx)8s^^=fVz@b0ZiKy}9OTMEtx`if{cGZ>d@3;_SV9yn zXANvY%HdPJvWLrjr82CfZ#`kR^KWf`P074o8X+Kz<;oP3^&R;NUvlH+N~O$EF#$YE z2cb>*LU{Am@L3`w2}1}nlggzM{O&}BDDfmZn38jL5YO_%NN=KElQ>tagP7nzMG9Hi zH4k7-&WU0j`=+W)s7z+knYI1n;B5!Be;uqhN&ua=13h2ZKhZhIL*Za%Fp^8hgzRxQ zz;2!>RZlwZftjs>61Da$C88T*uZc!=^m&Sm2TEw(5i&D?jnSZ zH`azvtQJIZm@fghSspJLGEJl-@kk;Y&t%g{h%YHp$4dDL&MG(M)ZtxC35u~)CJ|32 zk|{!g93Ic_^d5~yW2tB+k>zl;R?S%vlF4K?g3Q||m>4LxSgtc*=!%UnM+-Sju)b$=6RUO~N1p5XaUx0d3u(d@{+fl2x8#ip)8s1zfhL0~*rQ246$O5S@ zX0BE*maBOvsSTeeJWkY<87k@^Z{^Ho%yO*?V;({bey}aY4}ZO#lH6g)abnN4U6_bXi3t@a z%Z2W6E-}%VUn=p4gmy25O5&6GI@;!rgr9SS~GpSbzj zuI;H2Vj5Dd?zP4)8t@CuZbswzDk;028+EzT1(Db`1;ZRIc`F}7V6HZOrsW81xK&Yw zhs~P1T$vP`Y*h0Tjj@`y*Def9Mb-csrPwgFPO($(p3{HMNGTIpw=R0FTV$W({oyOY z&m{%6hVj+04n(j_CrgenQXq_7C?%L%CHCrC*V<0k`iG}$Y1miS`Xb35lxQ;Rl&h#& zCr?6(MiQB1I;A{+f?-FwD$&0^5@}amoownYs&P+7p@n*RLT0ZBWE;I>p72I0P0Fca zSXDey)Dw_poJ87i>XTZ1)GZUWCl0FWbnq;>#JOTOe2&+OEj{RH(?(onurV-NuWbi( ziUgjhE(*7+8>+W_Gu&!0mKLBeBMvI6Y9rjNg&WLfHN&a~+!xWBmO+6S)Lk6USC{^^ zZJI0j>gYger%IqAu_@DiN~=IB2zM@Rge5PIQi6gLCW(a&+3!=#T5E$Hz(KSnc^$Ye zbi-Y3$F8Z_7?Vt;~x6O)>=gV127Jkn!zm&SwX5NN_7g%Jmuxo zN#4@FCanEA%)~|`T*y!4hs*fdF7Y~5xrE8K^)gN=e93nXjg=aucKa}PHBl;*M|R>m6M>WDjlrX+SoQ$3ZJGgGI(3RI6sDG z`8YQ$e)z5LnK%YLa>L?V?Fo8CkG^5y%#IH+&ha4{CBt0wOPQ3zQu#}U; zA>*!mBd7ai`ZF@f1YhT0O68MBF&Mw!zuKP%wBO(Vnk()Y!|=Z9F}z15hKS#9y*7yR z$v2vY=lH9}Sz*Vy*n%_spoya$;f^ulhukRkI)c#isL=Cz3(n8Bnm7(UKkCAl!ueMV z&Wo-yaSVD^*y%as?Lqmx`EnD-Lr>WvXGPCh&t4W-kaPBvd^ne^+51mp{e+Zm`DC&o z$K2R|rv-Dv1tumuUh?xhhil+oW6vj(jl}q5!^ONGOut=y)mInn(R5w|?gadL@`=V0 zJ?^pKoO8UDwh5uF8&2Xm%K{5>R=vc;G3YTC|8- z+Hwu8TNYT5bK7=P9tMuFAZKz?bUodL>&$|jnFTrdxVuh7-zG5D_Apt)wBO8voS6kV zGYfKN7Uaw<$eCG?GqWJ4>#Cxe1v%@cvPi_gvTJ5Rj8U4{KlRpI zesd2Kpq>ReYT|NICYIlRR1l}{escoUnV{A<#)6y<&c9o5;wckHPo)0l9wuZz?VFI5 ziBv_;&n!6aI@ZK-==rpTubnQ=vyKk(bO;uNv-m*sC^Em` zq-B9sIG6pt2ad4{XYxX^gXzARF|!KCx6&@S%(j+}*__jQx=iqnGu|K^waa9&9gx$U;^ zN}}j;*PC5VI!WXL3+9vGWn#kPE6;jx&C|fWyGs(;jqG>3N#reH`t9oepPHC^G@W;Y z`*isACJ}`tcJ)3B&hyurI1X)37uvev{1u$lQkLAn9LVhxv$nS9*w~KmOkrKrogmieWr5OgNM&Y@ZavNW1JL$T_l#i`J5n5 z_UIlsE9^K|S#Un|Iul15!r}9ex$QIKK0|2J^G*xS>t18xIDC!w;_HVNoDZ)taSVFQ z2->D6{L-L&Uh*ds$3xG8ZgT!sF&IG~@vZaR^Qtv_Z#?w}mrIoF5arghTZE`>M)VdF>OmTLSX6Bzb81WNiNN#w@^H3# zE|f6Ss*cN}Ma6bt;^7*ehu^*XToo>!G!j(nD<3e$*ipw1FGn5U@`Q`FS})qZEc6ek zLOzZ6no4a|x1 z2pAp77CS7G9~(GQR^&M5!L!hu+kY+^S1SJ^s`7hs;rXV@wdefs@|7RB{{~e4ZyuG4 zsxB2zUSAF3+~BYMROE7SR@iZ_wBXzn93&F0?!V#2Q-3HC!E1tTdfsip89mm@7ZIvE zU!S+&ME_#qXqRy4Sz)K=VGGW!{s|T>AED=?HaXvdoIi2eg1}1mA^%GE%h&Av^4RAN zmn>k<5W8=aV-n2;Gqg2`dA@HII6PjS{M*JHxJTGC#O~V?zE!Xv%Gm zrt=7JNH?6mAh6Q?6-#>H7%SZ!Q9Kqa-G#|2#QE*! zwoN8+j-K9&&ToN9&r0_Wli@RiIQ>WVz%f?3@BWO~ve5H#3(gMT6Dp3-Z$aoXHuef# za6ThA6${R?v#j*I&%#$5=ff79B`ZxFgC1kzSn;LkdBlQq=t(AyBWI!KlRi1O>G^*z z3&xJu`k!!m^_sn3e_QoGalLNw=(BRnjUCU;1ux>?CS>nmB304TwBY2wXr*Vw!k6IOA$;9p!TI@Y6Gu-FJM@@0 zEZR7Kw&2`&o{8hgS?KwxPtI+erRN84E-e0?59f+Cd*g5Z%fB)=-|dFQopQ{*xlplS zp7j$G6CSVFdF_fXg8S7jH!SW%W_P-nmw@TFtN(nZiMdD9`BiYg1i#)J779z`{{{=r z=U;8&IJA99XzPaa6L4hPN%=T8EPlA4&%`n4ksB86ttWRYdh9FR|L(S)6tOL+2gUz& z-+joA*dDAQHqWAW&930w*<27<^!}86RfN7H#9xPO3OPd?FDLfaQCIIEv$;yASZL1^oS^BZvd z3vz}(V&WL|7z=VVJ&)sp91+E=p9V!bc&EuiM-+E%MHHU3Asvxk{h#v!3v$9Q=z(J_ z$ZKNp%f4qw|We6?}jZ^3!tZ%rJ79;3ch zd?|WHwp{dud+54wcmy24v#iL{8m>WCpvS1$a zX_Gd1eC>Vj-zd1*F7fDCWPhxSc|VwbyGr{P4rw~G;QkJNz41t4i5`D$!P)K`7dW*2 zPH5|fv-~&n0t<59>mSE?=`j}MT&n1Kycgt%JfiU7m+No-Y}J*><5r)4wB?);RMn*s*+^+S7c=?#zOmnFTqf zMa(S7nOTt2oLP|bIJ^s1CP3fK#HD`%^d8?6ntSv_?ydK||LkEVKs^g`)Wqd_!8!L& zL7Y=gGAB|E9AiOF2WPhh=d-?d3F-;zvxk|Gz0EfvD-)@To+~Uk?|Pw?p4)oyb(00> zO}@Qz40_BP7HxWdWx@Hqf3F%XXQ4;l9c7jC^3eRi4b<0M@8j!rQ1siko+URW>^mA< zdYl|{Z!Y94m;-4O6U5gIeygtt?n}Ddus9CcALn9@gXy=c2mWAU?$LC<1YCL2)qBH2 zVToPswBS7NSQE#gtt7N{!}%aM{;el}?O!0|rAKa9e93)+_)FO$JUb~tIt_v zb?#@n%Ic5E%Cq=D^C&p)m_0wR3g_Z$df*tVa5T-<$O4pz(xL2^xR$ zIfBr$QRsQ21?SE)OdN-=KXu_t;oM}wd4X>`3xghG6^`Od;VhgNl+ROrcW*uPY_`Z* z;kj6hZkmFTS)b@YgRVgUm9wp4^!;1!dqE zTTfnkf*8ScXOO?!ttUnBA4Xt)!GG}^robG_`Vf}B7Yp@lJ*fnCg5V7I1#xz4=z(Kw zJ=wvz*n;!RohFW>K#3B*&3ijIue0E+^KX``J@~`D`1*nc=gN2VpvR1$Vo*vx3swc? zbIUy@jw5HGN7m6;<@~m%2P5eBed{XsykX7W2X5an&?ADL?2VwmwqV{K%vx_4`T3_d zgFDzIf}RYoC%X~!Phk4(>T5M0znacLaJTp(pTZKmdc=ZrZ*ZNA(6&Wr>xNT&#{9t6 zlk@yrqk8Eff)0^<)Rq?K561;)A{sG58OT}5y5MMVmgYRuUl}A z{IQAS&_jgk&ezW^IA0$%aSVElttUHtt$0>YK5skT#PQH`b2mAE{=S8QiJG7KYsD+q zoVNIDl|?-=#KYbU@fQo`)w@mF)||HI$}e8?FW&}tahDA7FtUHx%@FhcePO_^D*l(a zYdRN$`yKf8*4PS5?CMYp&L!Ws()JyptsBm}ey}jK9;W5P0{_s)Q0S=dztF_l}WefXx_MPE+6%Hz=r|!JI(`(O+ZIzLfEQqgx&v>g`pOh@^J_|KfA35ju2LA6ZWVG z{Z(8$k52-G#Tzzn+H%^)ty@prd@4WZHL7ejyel-jazTP)FFqxA#>Ugsv00(H@xjDk zOr*Tn7Q|n=NLphDmeH4=fcpL5F#IknXRY#p20J4R)fQM zPwzQ=sW9{C9Qn!hPYlg63GR^lOS054NGPu;UHR0mT&jvT8;`s+z; ztr|zU)a7j+^lUcRU7=8DCF|RVx854 zYr~DgSZO@(zIY(~qSH2S3O9B&nx*kU0czj_BE>r))~}7L?=_irv=K%d--YS#bPWD7 zA@&f#`35*&g;@DGOn>QUUt#75@4HHP!t|#NrVoMXIl}Z6d@gaAE>v33T+hi{&3ZCF zk*_z)O}0!>aw%0x`9{g*zNa)QwL-oUKJ$c)r)>;xFYP+&*{b2$j(omjkZt_$y9r+yhr-h*#;7dM^d_Hu^Tf4~_oYmmGvn`+5B4@01_5!Zo?qEnPn@1d0 zS`E$BYMmp0Ld!#oJ%$om8k!@f!ryt?SVH}LU+gg$u2^Q8OlS%4%0|YZ-ESjrKgXn9 z>vnt?-M+Nh1phTO{ToF89 z4tu#KHneIW8cE05r9Bpjr!uK%GLcLsIZ@iPkyJ91$tDxgSTY?+Mg)NNXgV6p#4}uz zNF}n#Y&5IeV{#yyi6j!4OfnNoMjf1ZB$|#z6Pai<9!W;yv1nYMACG51PsO6VE+)&D zjA*rQAPRJf9%7MbG#TYRBME(aBAQJkQqT#d*-R`OPdn|&cq9RS0&=41csv==?a5?1 zk&2{KnMf=diD&q#+o3rV%_h^ScsiYpXJcuHoK!LvjYc_|%BF?0cub$4&Lm@5s7uCE z(J0bLIqYWOD3!^^Q;~QgnMtOiLO$ZjB-61p{}50tmF5x$CkuQ!o=V$oPU9f?6uBra0sxat=a7(n`wbR?6G@gt?% zV~H%>rZbUL0`W)EO3bSUVxsO;Jef+OuQ)%H+WQ8eE*?koSvpN+vr$K!u|z7J;)+-- zn@%Q>TiWS1kw(Ah1Wq9y`8#ByX|x`VAs+sSf;2hFL?#gt8E{=Bo1%N#=@#`z0HyC( zJer{+eL5yd4`9b)anv7AXd{eAQEVb1%dxSEG}71P#1mL;CXW8(3@j$8wa&F!EEq#W ze#irXD*SjNBW4@HRHO~DIqg^;a!7C-6T;jasbK@zcodt-#uHhLGnUlW6Gt|YC?=SQ zMG}x3i90yyXqLt#eWT!1B$;*2PeVF#i{o5E5Z5a)#BnSvDwR%SYMDelu8kR&Q0FGG zOghc*e@%WSn@+{DNz{SQW#f^UZb!n{I5fqvQA`4BSMbULa5(HLh4>R`=X9Jk6H8}d zE1Qa9qcJVD1npT2BLP0Xl|nPBTYMvqeJ4>0CK6A^)7sUAUVx={3>QDmXl@Yzb`wcq z%1JCg9(O{3#F|Jfh6Tpa0G&J1L^hzKy99oVN-#a$FD4j?adtGGLSz}#rQ0*~8OKcG z_$Ts@Cmi~*9^wW3MhO{&Atz=?fPzsplgwgiC|X+^`it{D2~rjt&!BdVpG`qGmKBdl z*hmrnR68Lto*~X51UO8#eJhD!$A~+4Q9Oo|WfIyt@d?gFDnbt|qj`-J%@7&DNl1`L zrm*UEJCQeql_BW_CgijuO&lnhB3`Ex5#qBp6G9ZyrGpd^0LGD&#=$@$a1@Q;7g-`< z#5o`5N+C)toFIzZrA2OiyuS;nXS1;+K1WD#og$gRTzUC9XdES?WVJaYGg-Jq*6ApU z<5<#Ri{Pq+rRb8>pvB3>2~3Q>3Gi4u-K%cp8$l0o5h1fMrKwMW32_)}JWUcvgQK{@ zQqzQKp3_5x=!&qU+r^M*gw|M$*VS;PZWr?;s7Zt%U}sZl9g@I6(HL0-tHYQx5p7i| z&P~NqaWO0cC?4qIkn#xDII4J!WHgPRl(>LCh|iH|GNajAHIPao+-x>WTU4&VRyesU{8ATtjlu)dX&e#(A)fdk=?F2?v%u0=X{Bpk`{?k^i240y2UgJ zY>FW43*~BCh5$?tYl7p1(CWB~C>on5o0BuCDCkFVi*bm0k#hti!ls?bMra|=6J#=^ zZgNl3@fB<}hK*BaA=6kqi-0r^MB}pLR6;pHUot}y&h`1!M+8$5HpYmcQd%!?g570tBO)-2xlTvfMeriH zQz&4j^snj9MlnvJQ6!y4f`kIcDQG8<5@H~o!U9lbZD?F9jX**kkz}H)nFkQCq~srIuZw=%n+}FBvnE7QQ?w6F)*pP$vU{bIy*@bN>!?I z1h$UKRI}7-giQ(w(l9bpg71ssKAb{!CC8vb$l~l3xF5li`U@iw!D$H8OWL4;bWfHc zTygG7(x%j2@FcktEs1-tB+&9kKoTQiRH_~AeNvF37*-#V={Xa=gg7TK2o(@c&7r)e z4*^giAwYs0A`-o-v*Y9?sfMu_EQ8RZo5^mRE75^kFAJkiGf7SAFzi{16Zldf#5;@u zg-};X@um!-k9db`0!pfrDv44-oh|xGOQ3-aEEI3k&6I5v7*a+OsmNkZb4H@0gj7N> zrMkloewE>LiGWn9Sc9a$KI$xy6DQ(Cl&hp4)vTNhK|?z^nfR$Gks%7Tl$Z(eE{$QR zv(Y%pCGy~Dl(0HF_L1MPI&_Tn2$2+oayID)CK-%~ousMNmG|^P1N=xqLnT5oNBx|= zf>bL-9Z;AX3Q{T~^f3&Iq8BA)6nLG3}cfEE+5=$bI$ znV2gzE3uBW45U7rKp>`s2#^zHvXY2Y*y5pdhjkNZRf6f`G?E&*mxv~Vsfe}`8ZdT= zVpQT8I?kw)S8_2{N020~##6*B!Cr}sBpFG`C4)mk+j7lVGmoyc^K9Sv{iQtunrgAK*-sd{R(p zLxVxG76Kq9P+~|as<5$h2HjL~q*1~v^r&XW31ksM9WjuI2jRMz(Fw#zz(a&_)S#N_ zL<-OpJ#s2$sX;JG@qW}3!GduU=WH1zOMIr9m5NN2rF{(3)KE`EO0FfvD8Hc@;-q%O z#i+FCNxEe4A-|<=pzt6Ys)4CA6MZoTNWel+us$0>QBBYrlyF?tqF9h| zk&dlNsW~Z)Wgta%bgBW)ma?8mj~ZZ-h^)Aj&Zzz<8Sw?Q>0&1#NewO|42~dNrI3{j zS;=OS5D*i!i&i}LNb*3PV(?1V|`nSWfM!nyEL5!vp|CNU}g_su>51 z;3a5Fjj=H>X(kS%14M;O;*m@gDDOkB$O(z_o75%gPo2%I1R))n%9v0_bjn^a8M=~~ z&HsreYJl1YTbKf(lMZCGr3sPV7>SS%@IEPkRh7~wDGjq{?ua3))Fe7e(M(-Rn3T~J zH6;Rqkd+dM$u1NRRG-*RR#^ky$N`eJ2vv$XRVef^g2L4?dI}jLE48&!jf@4TNtiYv z!SkKKr+9=#l#Q!O)g^YM?2_RoCM_>9CR{KArutH6ll+;BAQV&Y;>jFS%_s%KMj})o zX*@@jN_~`%$eoBtmVyw-)gZ(XSc`y8{U-LW!W4;(Du6ly@4(5$yaij5v;=*+#jHqp zYM@OsN}+~>ZgeW(`fMpY5|n6+qp))3GZdG|Na|>!D3M9#HIk}JaRQl=qr#Ao=@il{ z@l7HU#*Q^pOA-SWAtV%1fTTW&Gr|zfoGb%GNJn}M(m0|{#y1&lAUzC-i3zMqH)CRq zuS7%?##pP6x00e=QX4A43e|v1pPZHoR#l7yegc6KAA*J(NtK9z(2kR70>K3i>23#B^Z94v79tg+UDlNX@3jhv{NEM0-gHadf1) zVbYFBM+Jx?$mA593R}kG6tH+1Lukp-T7EK`k;01zi`_HSR-TGQiI+-#CrSx#nr=i! z?IHyUG$koJHQfXTxWi0{{%F$a5*wyA6jLMYkR0$uC|Rje7Q{*T!LyyQJ%bt`&k+ug(fFtKn9_mvMEh1z|0-;Rv=^zy261u9Ubd= zgFY!l87&hp2quV@;zFIx_=mcVqE@mhSxc4NoK3Qk0h9E~IKxpT&0-F)fn#B;2u*=x z2s*?rNpa+SLXwh{bVhlLOk^a=G=wT$`>@ainUC;9-aZ61Ci9Gkd1`GK{ zBVR4n^Ml2)=HRAQeY{nVZ|U460%Uf4Pz-MQ)!%r3@xE`zPrB{LJ2yXb-O$_QX2svQ zSs{v&k8{H&@qy*$&5F)VkFP(-O^;=s8)NO89{q4m#;s_9hYli z;u{_&r1QlhjN`yLkIv=eFfsCqtcl|YF>ovGe2A@ zxg4Bq;ouEdm_2(q_!=C1&BnoL;K+S5_ud(+G)7;$-o$Y@_*$ETa{?U97Y>f(v!)jZ zg<7RGUUgYG%fiB~CzxG(Soj+({Hu+Hmx1$cx|WZlgzK)zm^cm#e`~YQxqYUTi4qnF z3(w*6%w8-wLE?77v(;I133v&C_<$BD*_4;?2)ONV8%8k=6*|@HPQ-xajI9#81 zhi^rO=DNzwN5}MD7Es(GVPb&KvwCrzA04fiM)S?K`86zDeEH6rrOk9!>lk zJbd29!&|`dyU_E7O&o`Ze{1s)bRiyXn1TzH93njLp^P>aC89X1A%&s-Gx zK9tKxGjPb=L+AIvSslGY)?_$#v{VB6tB3*ILJy5NLXex-b3#k?G6E-)gy!l1u++^c zY5@j!!52!q`(yD)xl}2tUyV>$ZnWzLeXTU`kM0&qcQ^78lBK%^{_Ylb!bhOXrS37e z+hzIsXltA$FzP+`y5~-ttQ660bB1fhT@bN~1s;`BF;}bRgyjX5e08*y zA1w*x^-{A{uPVeg-HU|o5B8#aktbpV2w&Dd*o*Q-Bjswok`pHBctN>ZZt}+XVvwdq zyzaeOa!+)AiKyH3E)jY^=b?A5U(WMgzX}k$NTpqu&_(Jz_t%{5{G^xpwFw>KpUDqV zuIO^n_%7E-_%*l1BSHGACg0|& zlcnA`2Q&BAE#KZ_nz;@&wa6E*xr?wHdC=o7V&+Q)XG#B}P-`|zAo*x_nSK5#|7GH6 zx4Y}@i@%23;V!fA3y-@j#eU}^*V$5xy7oKUFV}^x2pXY)WS13Nbt!3bll8J>mN{Z< z6P0oyFTxDDvXq#z*m1&qt2xF`wOa8^r{B4S3KcCs>_u*cWlYUleQ;}ee4H0xjcLpU*oTK3@*=X?J*}wW@YIJVn+|dHQRMLV9?tIauiktXOW4 z^@dx`Qt>hFH4eVJw!|meSv>dp!L;(eHP2b)^vKY@xKf*h`0HL8A`R2Lakx^ejps(n6yIZ+2+;XdyQ$#+YlAB=I#k>k!3ZU%ARczG5jy`p&sysyU&RY=TD) zr#|HWFuEgO;gY9}m&UbpMp%kBmYd*hl(iyfX=%+Mn1+w#>k{B^Z zayx%#uRrA!{;aImCL3~XuDxVbPC9k-smv*aGRiQ+wUKafI4r$1!jt9Z7>l=6Ut;%R ztR1^8hHKSuKJ1djwY&LHsB{wVG1kOe93JfWEcyO|(zY_DS=`WeWKT9;D$ddzqnEK- zMRMaIYUR~ZaR+bnEGcgotSOFH7RFlD?YT;+I@%l)7ur57N7M{-yDAv85?8J%;v{?w zo^p0VXp--$=2&pdUSRY;3BvBbInEdN?{a>tQG&3^cF02ZoY0OB%4y4UL$`nQO~1>& z==LM-{lU7ICV#DtF`!U?Q@^=H{|?DtZy!st*)1DS+pzJ}Z6}^0dh%Ju5@isCkYQcD z9<&`iO#s6V;8=O05hgTmZ%u?%IDmi|Wg`Us^;GtAIN3Oo_*E|9- z9V(xzLNQne?bynA!c;dhPZ^Xe=i^s%{(<z5SWp23;XxF}dOrvABq?a_PTx=T1~`8B7Ue#PLr#5w=6 zWaS@T@stm}m9}ZoIHMPRe`Olfy;5V%sMk>Il+=6p@~0m0j~`q2=PN#c^Rl1ZaQ!jU zrQSn}_1eS)^R?5c=EEG!u%mA7^2m&l%#Y0kZ>9P!g_z^YFKfN>mOuQ@y5C)w{nSss z_s8EoW4d(hnfIRtXMUy;yWQIcGrp}9?E19(w`b^n+X?@$>ykT;UiHCQBk#TS32)gl zUHWd{f0zbsKSj?MBU{kng9>iN(;XWkHfMrP=?@v9HNd+x;0bm_T$ z6F??T4!Y)E<=$PHab?l){;BvQH=J?VfBaMQ%eN$N`rfx5KJ=6N`u!e52kLHjVsjew zyFyKh%qVyNm3!ll9(vbjpB@>zfi=>CcNt zw$F{d_^t1Y-E!>QhfkO;1v~3Ira`+;Gm0)*k1(U>{nzu^uYc-?Mh-b<^1U0cY23Zw zO&3g?p7p)OY0&d>L7GwR{;T%dSKsi|ADtDO^})M7dU|pB*DgOm)wWA2xi7V#Ag_rm z)z$Zdy=NsXJ?^96)es>!edd>{a>KO9*SRD43in#YcK7ms{cpiBx4uLEUB^$i#C883 zN}IxPq@zw*Dn)H*dHVL@_ntkp;%A>rJ!Q+e*BmbEjkwGygX9bicL{%0qcrf(f8WT^ z!a`PLRg3w0aYhXyD_0Gjzpm`({9^eu$lku#=Ly_~m9>D*3WPD{b!uv2=b(oj%T7~^ z8p0jO$K6Z*uJ6!_4d7}2@saN*ZhhDD-+9e{J$%icvp=_rwvMMw{SK{N+skIu{CMAp zS6U7&Z@uTyj}D(4z4Vgb{PnuizVoMNPpg_&sHIQCtuo7tW!YV(# znu%ig45?>S7vXjnGY;-(mp{QJ7|yZNFT3SESDl*t$*q0szW#$3?~!nSAP(MHMY-@q zS^03%BPMS%@d)m7A}Zzvrce<~^6ko_pP* zEpNH;y6^n-pcT73zaw9+sKw8$c^Xw}IB5Nz+6I;V8rAb|LmEBIN^2H5hKFmlCUF9W!>b6BYJ*lDHGn7bt~PYO>J!pgsO+M;^D4ou@af-?s6%Bf~Con5w^Ce*8oG z{}vq|a&_nh*Itx;#SKS4{P3Mm8Ii{YSY~ziE>54=z>DoyhO3O^c&HrCc4DsMpvhq0tB{)G$9MY7OSOymXD z$3)C$SWYSJV7qnu11$d=s^?FAYVQ{wUX)n=hPg-oY1L<5F>ui8S}dFR=a9-YMd!mb z6oVq3YGdk)@vnYcz>GgmDe=DK$G`g3m7j>Of75T5zoU8Is#hJff}NK&Ohe3F8;rTz ztF_6hRxlA+g<$7}2+%zfe-Q%zddA=MpP&5o-CxK&|AX`Dr@e0Prp=sxaPfDsnxM+< z9GSMq%hYrl4t;)$*H7TmB;GJnUeyL&K<t6h~Xg{7;ox2ykaDwhpD-p`%@hc05b z5k68nZwxJ3{K?lI8#;DgD0DHEh{3BXVF&&>qx-<}a7|Hex% z4CPWgKmGo#e|Yoat6mMl!I{qT1~;K(mk@ate@D3~Qse{a(0ETxpZ$#AkKXYAj#+tm;aeZe&;ANqiyfqW~m&~7ap{GZZek2PO*-*pxqU9e#Gv1exwdeN7=_PxDl&b;Xxnk^Ghxnb3Y{6D2x z?TqUGZr*kO+BK^$SpJ%4{oj9n7uA@QzbiJ$b#3(cH@NlGbIvqzbeZ|&otCYq4t2JknosHZ($B(-l&Xq(|87C; zN1OMtT@ZUT$s^G2=1|L>@jY=QSF0Bp0WJ-#@SKtx-X#^^Z1%EYJq!mIFkz>*FJNn= zIqf|J{{&gSjZvnsWezieYEvCiQkC~_@^^u!ZE1U(oE*zFidc=yunz?-cHjjr-)0NrWbAM|!rz2jevmz`){$H zZgg4IVZr@vquQx@0uJDT>r`hQNN<}3b~Xz+_8|-JhLdfTnvFq?g4r&idXcP)$PT&g zZwski4aBnXi_hYm;=|V(q*@~L{&cgX=xjM7yOqkdPATPYw{WviE@A3+e1hu&60)!q zuspZ3z=8cYNlSO8f*k>xjY0Xr%6`eu)wauu``aR~u4*y1g7I(X-cd>Lh^3P$X5}tj zN`#j2zay+pkM4n>!1kjQFgn#+)OWaZe_ME(n&9kv-FG_ZcHGjTrydU2wZVjMgZ{SQ z0_{P$^)xiI6L+n@9`klMng+KqI_kU?pwox9%_6C(sm52lxW3|R-XD0+ZaUr#``ZdI z8-vpC874j80TH{j2M+9i$ntdKW=$8}{e6HUY466}(W9ry0(zKJ%a7+LR4KnUtj5UJ zg5E>68BC`m!nPkWmMG+ZeL#ns;1LT`J-yiVDd{JmOIHnn1N*OJgCPvQ^Y()dH@;>I zEBm9L&h9kbcGm9n-2Ds-5%Y?*7Po0dVCEZB)SE2SR^L3t?ryi<>BQ4yK|L_mC>ixO z?%r(?{|9bcHGimw=spsSUkJ=ce?QI@sBSA=O2T{B15^Ot%0`FnX}t`r=NC% zrHd6#EN{e}{Vh)$38qX*WJ9mL>B@T0($iFu zgQI*rC))rkvqA6$Aj9(yc}+}n?*Ds?J1*5qrpNNb9NaeqhdVB1xR@oqV5TG`)@9!vXbbK`koURxzb zTTmZ89mIKA5ap-m{Xa%t2^_HKq-%<4!v|h3)KR(Rkgbbu6P@iYy4T&V&byys>99v+ zYOS{R^OV?1_hBOOs7u9UF03Q(fzVh4c%-1|!z1a$H zw@ceGOTSameD7-8?XdS*2iSGDlH2XH+i^>G-AbvBojmpxdAl!LUF`B?J9Z%a9Bj$l zCf52gu})0ua@az0uL+fQZ;xqeaUYPk7vQc2>_;sO?bD|AQFgl>?&Gur>DgX>yB*q( z9#B8l>bu>K^{Azvsl*{`_3id#J!t7@-}%Dx?!ZpjA%^2lpC4%1VZH~i<3RrQ9#pqy z1N}Q$9rea_F#_`zFL0Oj}^yx4!1F&sQ zu9LSLEcWFxZQq@;>t3YJYlcSh~(qj z+2@?z{m-LT+c6942jfn%RmkaGD$157G0`Kf@jI?;^vb&w4t7Pjz z8v*S*B3%_7++){SlIICu9${M#S~c#SXteVl?3!5zo@gjn<>mICPJPW5M(32PC2{qs zc4Q5KZRvIbSSNVeI&~(!rrK$@z~}bc?f5iw?F)TwkG^J0M^lK1K{e`eyi*0}ANKNc z-w`1QKJ_?jHA{@7eM4fZiZjBSD?6jnBDn+MZHan(rcj>XozdQ!!QXD_PK7t|0=f4& zRmPm1Du#JMp7-GiU$dpR-uWu1w1p~!XK~UMYPiFjc8r4+k+ezw%uT{)w!kd z3AH0d2h6s$^E6sc?~djL%AZb)g?tqV)e;i~(?RxZKx~_4?kZVt7`LJ=9B;{_Rjuj` z*hZs;$VKWAqMlUFXA{K+u#&Hwfaz(nU^-K~9U{Hk^3Eydn|TkE``d!!j(Y7t`z1U# zAlacj>`ViPize&kX0ufF)#yg6g~-QHe}SjXLiN1iG8Kpv@ExM<;0rYnyG?q~ zjmCq5w+?SyMbmu1feetry*&NqDuJpHCy69rHc9|Wd%i2Mw?hzL9rz)Yv_1a{E z8LaxK;S9cJO9#tko&$?o8`hR3MR7+R?VWJv%iguV8mryndV%aM5N1z+=+i>#qqm-V z+Q0*^u3-{IlnkHf4u8BhOqX3pk!?IpR{<=|Sq4 zKt5=LFK|;9XSv4hZLcxfg zD;`5|L4D2pi75p^uE2&-#>4H4&F1~XTrpZ}G|CgX(NeXm@cjYXTQclW_fIS6|*l6r-OouTK##Y+0WmvPu1|Jp^=y8gzukKtd zZg1RSnuFQAf0%RF>`1+Mz$std-}{GhDEru!@{N*(d&{By!(LpUC|DHdYqnu_*V;0@ z%YlX5;1L_LGeK?%F3Xx@_3}v5h8#FzL+-BqdCl5(-Vfx7g`E})k};KTA(U09t*WYE z&0^f&Zh=-eC`1HgZh1@qk~|%_8(YsUj2KzF{X3Wm0SH;*fQz)!vn5|{IA5vMyoIIx zsDB#@*Gdu=*4=}(u*YtyFEN1h+)dU>j{>A_QB1QEq!&$6gM>Y zKFiW;Fz~y~Eg%A_O~*Y3>TR=t^$^veE?Q9EmO~coeTZjy8$T!%+c8TI-9<5Y3xQ6Fzw$K|Kezdpf_7oH@o~Ox%6^z#|eJ*b?{p~giyGzi`$S#`u+lCU%9xk7jH0%Oe4(%VdFBQAEzGfR{cdmnZ*o6%qu_1TY zcqePRh@BP-QkOjH+dq6s=iaw*``O=a>%e;h+T;8BZj8G@`C^s*oo(YfrsZqyZnc5f z65JVk>azviy9pRzu$#Vdw)D!iYu21>o9%IyE{83GvrR|^yIbDwsXBaW8O%b}+_Sq{ss>oGaVLfQ+G@z1RJw7I?>DA$)ip*50@GLIj z=*VofFctLsUY!_I|88)Z`s(p6`(7_1D~#rv<)+#`p-sBc+Jp2is0(CNIjUdz?qYh| zEQpSVy8yCkl^HN2a(kLAaIS2-;4KELzAM1DuX+D*=Z-kf-MU=28x8=g;>U6u_8)7G z56b<$|40ia@{PtM%fCF9?rqzD#D$C*1B>>IMhm8KXQhjh=gE$s#sbJri#7Pek{kTp z=lpHki+kP%;i`For_DmGYmL27)n4PqbjbowlRf)-hqyhk7dd-fYjl@pv$d;0+*z3( z`11mr4R=~>(r{}29*D~{VvcuXO*D)f3&A6n9-Ls(ql0-&#qru{j}doTEP!1V=-r!q zUZGMpV^pWbhS^OFUQD9g_;}t}kL78yp*r<6Sd5x!;{`c!CMz$?G~w-vl? z7Tj(M^Af#?GCn_E;zo#f2Gne|KwH*Q_mm9~>ita~)9^G|I+&7en9k-3+-%){7c|6k zu#2DN2I?`~K=p6V{*M1KZ=iNIXP-RklI734!LvEL+(124a9;4iMWN%6pnUX=*wC?e zJmkZY)) zq3tT6tsBlwA6^t%56|*(`x!0zx)<+hF z&V&&8ILvIl^c_8LR)ceVo0&mJ%ClrV`b1tDU=Z9P_tkXcCpY$QW;c%PzkyLa1i9by zkSpB`3fq4G$8Qv4hxWi(4Nk`>6b`bVC9Eo=n0G^vu<>h6Ku3-bA;)`sa%>ZJ_N|LT zmw_oCM~)Xg`1+P~;c+Xxya85&1nwT=mh7aCWyx z}KF7mC43ak$57R zNv5JgKK*8r=~$Y72q>0HbBTkK1wI{5BBMk!6-RguU$mz(h$o$nfs&27{6a-6mWV`B z*+g1|m(Vz|Xe^$N#2_dV7b$aG^$Q9NApJ->l1az-k<#t4L>6w-nMf*u_#Si~1vg(swK#&CroP9h0O7uw$_}>W?S1 z5yqn^HjzlA5k90MeN9e0fz@W>=ughTVv<_xT${y$F*M|dJP@eDk0&x>wh>H4+7O%5 zj^!bT1jjKU%*~M+Hjs@+v6*Z&?@KaqA$$5}J6bQZR~WiNs=9U>pt5 zxg$+v13J1(;J2s*)6@N8f{_?!N8>3(mO)**Jwu;y%p{I~BL8^8p&#oZUchgZkUnqRp{*02;9R64^uRKj*ErD(kpY~91c_t{t8TXwc~e*!l1^YkPCL@X zfs!fWbvh9tK5H`}L?K-|ND%>G97$;$3?u?a(FlH#B@#xQ^Kq^eqQt@pqPSgJ()ie?uJB$$hNV2Aj-LrzNUCK|zk zF+-xFBTZ!c9>CfisHPl2aX=H1rU_B>D0Mi*(zC7E(o*UeUO(B7SUJg2lBQO544kf$Oz;v;+|VhzzG(ZM9M@Ok{nS>!_y9w z#44f|5g;mB=^H>?l1P&zVr-4Cnya)hiu04qh|UCgC;f>l;7=F<;YEU$gPumANzq4? zszGWKZJQ)*@64(?$*cZyxwhRH79@YfM38B?- z6;U)cPc|oKQc=*4;uhl&^&;m8Mubf}k&Vzoo+rp;NZsU~q~j~tY785v&O)ZKcoqR^ z9EijhkrsiB5XN!cjz)lzNKGggFzpj4l@OSYaSR{{&TczNi>#f*)FhcggM*WfVDu?s zuh@&!Rk}S*Oh`!yKwU>ZBr4GoztQJoNLd)b3?nhIB*%C#x~PP5g1%&i zB%JH>sgDSzB5aHiL8Y`_-~_wN;zmSZ7;~MDvWwtFaHmkfOzB_KpN(RiM59PLjRXk= zj#JQ1ASJ{=I)w$G%G%JlSQ>$ZJR-?NS2s~~f`8%=350|RMO46(;wU2_4b7rBj82TI zk8~ssLYX061xc!c?4!aZfns1%ag%j$dv$h_B9y9B`IP7g^YDL%8DHm84Cnz2Hf5Ct4EsUP+*h zQ>0;MGEyKhDhMe^QA~mooPVn972=%0AXGp&HHY$=J_JC8ga8S0h)DFR&W@9pq#DLz zunag4lld-OP zBScaV%GsnJm}D>_c9N!6SKiYH4e%oc4V4JV9QAYd3R0~UbwFWmC`j2Vp^sru6!kFB zNW-rRTzxWzL)PguN=s575b;!p32G0j1+>PWqV+5FVUz@+2A`M_1)w^c z^nd~&nT#f8tBS}zKv5)mK(Z1%h=xK4(!p|ZungkB{nRM3kEAUg347Qo&cm=ypk;7D zM5I`kV2dH^vL0I}WG0vJP6m#j7}g%0v;laqXyMXCsKf>=#f(~OAUfiiua?Q2o{W+ zIA_Z!S>iL*tW;#GEbU{MriOYVQgSURM)?iR5GS=GE=HwAPtqlW5BV*11BD0KPz_9_ zndpl#Kmrzmg7w)5ifV%1poHT(FZ2-yaU*KC6vcv!i*#&FO3g`WECVUBqf-rVwv_cm zdei`uL}bOKbVl_@$%rqYO&2=}NosHzVQ>WDDut|M$VxVogn*c+U9{q{N0JBXB)`f~ zl?bGmL}b+DBtSwr!*Xg*)l9uf93}uDLXrhaQ_VP71TR5bYK)D6Ni%U69Uv-P5|3n} zKzSc}MNUYZ-=r={f9h;zB?#%rRK|odqEq&Y$KO`lEYjEqvy zCwU>J10!}o^k*szYA`@*HZ49(7takjAazX}V5ZWo5($oUX+#zoTLe`)w9GKJ5v7R^RlR}iyGVy|7f@mo&)Y*)GsOuXeP$5Xu6mSex-T!@_WTUTIpO4?#1xyxv#CUgtpZdoa!wm zjzinULR&YSv%t9tp5^1n?Z#E_HgWc7xoLV7wzCf)tSr>j`zELiOUvlPY&HR~()TV74cgkn!q7ztNwl1u08OqK)>!gxj zx@d!5P&jZ(sXE#mTNl<%Rc=3WOJ^N78cP!c`3lchr^ev3#9P=8igj+lvM=ozp$cYbIX~aehD9^bwOdM^CTEZsgAJJsm%}LWpaL zu-^CEAkM&^9ylxPIA5{gEPcI+;|Tp8?C%Xep||O|$AWYE^(KzP*Bg5A^*0O7C!S~G z81$_0-e2y>C%!i*pIzTJaXj?g+fB|d{&O%MU77XaT)k%R8$NQuFR{07@n}+xxv}E| z7R<`qOiXyZ`tlRM`2%o&)g>NHVhfWl=51j5?do%1HZk{TI)4T358>Avj}(^J)mJPy z&)8w&IJEsxXzPY^=wFDv@GKw432*NAIiW$1#G?+)`9T$<+ca#fC3=U@J zV!2u^9Gp{iV-o2kSE*t6_f7{*hqONhPoT1ofE7X zkt?gUW_d*Rk|JTt??%NrkT0m`)ue5_RxPvLD!Np^^ls6)VreAbsx*~)%RD1NU&44} z-O!M1Q&lbuOioS?I@%a4)P`8RUurgnhAT~mzLC<%a3)eH<%f%jw5ziL6jVDR7I{wW zxr2=zqsN?o6udybEXe|X=YXObc53|cQr_UCe3PxD$HrZi$YUkBO1TP`ZMu8}jk1YA zX{b~k(!fKgsm|p?yH^R=-MWtf6IaY3j zy#x(%CHryI&`$rFcq*Stj0lzxMax+OTaa@2RIlvelD!3nmGrGA>~{XG?XM}B^RzF! z(~Pl;7XHVc_P5DB2^VaZLA|nYy2r`q(r4sz^M1?5vBs!Rq zb9NBV^1QiJb`_ERg==*X6C7ac1HEN~aR6&_ev5VNo2oLQk^y~YZT~oU+d=JL2kVUz zKftjs>61Da z$C88T*uZc!=^m&Sm2TEw(5i&D?jnSZH`azvtQJIZYBe(t=!};PnaWxdW*B6Mn}qn1 zB6X~kpWv)An;TX2^RfNw7!b>ShGdFRAcx2EJH1C`O$@{TEQfhqD`!PuLXNo>&j}_5 z$}N`JETY*J8)1$Xc;vJqs~VLC&*^8`*r}yS7-RtA*!re?ef!o)1{@NwVTtFaauQ$A z_&Jv3yK%#& zt>Mj;V)*z{Rl038h%B<_1rM+jB8oY^!84T9hR+ioCu+*Zp^5m}DycZCBB3Hx48{`* zjZgkT|3`FJf5`j3^V4PFTIV<5k zFpUCZIYOsHiwlJP%Rn!u26}Lo9OsMxwB9*L2YDM=F_$sRwJMBx2+`5sAp_e|{P5S? zDT6u~a-7(6Z5Jl!ehN&eI9V=qhjWQxve*Y0k4R|uQm7<8nXj|uTX#TL$Wx=wDbKoS zKJ7?~zg{|A(_z`Cs!ts49F(9;L#ow{Lf~M`h{t$%!9zPY>T;zEsl>J^>C{{KOvSVu zfep7Rs_?K`vug)FqfClT$}0WFSk2pO7Y3%HbO4P~Y?x>B*}GqF&?T|&oRLx{vTj}U zT(`(R$NR%qf}cwYFXaOx9T?Q9h7gQ_|mJWDQduGkHqMh?4^S~w*9YA4598^@*Mz~oEH<-<8hE)x?FQPRqg90(A zyEvY&F8yoUG*@_4!$4`LN_J9oPnqshTC626g*%rv!jcz9^#gBVl33V~{XWI4wKmuR z97J1^gCVO6-Eddiv1{ryBLdD3JN8i>ogRuc6@wbQ3#H>M$9GDXDcZ#*=Zfj3)}@5i z`(*G~+`hB7ZqOe$b#wgbq8bb_~3VWVJ zv>`THkU)%ofVrH?!E$#%;ErEQWkPJUptaIinix$aM`D8%#%N(e1IEJQI%%-8Ac61A z%+9?xJG(X}l3X!A_PaN4-jU+DLm81n3}3SP*f!L^xwdNt`Pq88~@A&NC0r;R}hQ3F`Lf)7MeeA!MyQ z&pkMWj}pg>tC}^g4<4Ma4<(L}MH6{x| zhgcjS_ITjhEh1fTbNlf1|CiU;^Qi4qQ4ZIBbF=M5Bv>rY$3>! z6{o&AjYuM#n1*x=;}HUiWmI`ui5Rt_(~3uc;I^ueN3?;^tJK1Y$wo=V<*JqXDb8)N z3~}%vI%!rQrd|OdhE$@3gW|68yt#u4^yk$81YhTGNUbMr7>w)py?>;^>}$Vo<+g$V zhWD8n9vRFk`Tei%Bu>w422S3Ob2*>Hd3#>sXh#SFIKrmm2v(jO9-K3GC5{=_X4beK cdvLa$qw_+Zyl_k_&vy?_?@+2d1)rXe0h`dyi2wiq literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/cassandra_select.pcap b/packages/endace/_dev/deploy/docker/pcaps/cassandra_select.pcap new file mode 100644 index 0000000000000000000000000000000000000000..3181a4b938f213136b9f6535f89f92f5cbc6e2ac GIT binary patch literal 316 zcmca|c+)~A1{MYcfUrN^$PfRd%FB=ilmKBSAa-S7NHbsMz~I2fz);V?zzD);J}L(> zWmFq-9*ut3AfdhcUldS~k%KF^(Edws!Oaq&X@A*)dNqMqB-qu*)j32#OTjJ3-&diu zIJKzQnt{;-D3!v%!N6*!mmz=PJILmy2wsL+Kw%Ju+B~hW8P#UxpfevqwgPQWZjdmD z{?`Sw*?|FMdkfHJ4xs)>s2Pkvnwfzsw=z4mvbZ2IIhBDG>;eXM5EY-9!obPEnwFQC io65k;z?uVP0L=vI1NwsPB8bk)&&UJPti`#RB^dzn4@leq literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/cassandra_select_via_index.pcap b/packages/endace/_dev/deploy/docker/pcaps/cassandra_select_via_index.pcap new file mode 100644 index 0000000000000000000000000000000000000000..48600359852d21292d520d70617e80d46a6ddf36 GIT binary patch literal 338 zcmca|c+)~A1{MYcfUu=*=7%r6%E-_FlmKBSAa-S7s9FBmfx&@|fuWv(ff0nyd{ho% z%BYLtJen%sAfa9OuK*~>$iWp{cvCXCaFQzv10x$dP_I1@YX!UdxH^X@Xeqb_`THuA z7N-^!D};Nv2DvKa9|GMDrF#)-$1?V0Qp#Dgx8H_-hnSm>}GCQ@h zxF9h(m4OxPE(UfG6`z^Hz{$Xx267z(F9R#snLq~6Odtk^6x&4*ot2-F2c%iSjt2lB C`b+}= literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/cassandra_trace_err.pcap b/packages/endace/_dev/deploy/docker/pcaps/cassandra_trace_err.pcap new file mode 100644 index 0000000000000000000000000000000000000000..8d006781352516aa49eeec2ebffc10020c52e795 GIT binary patch literal 285 zcmca|c+)~A1{MYcfUsRYEDFEL#Ke#flmKBSAa-S7$bKs3z~I2fz);V?zzD+Ef|Y}k zQ|Gka+b>buAfeCvFCHk!$ibz@vVcjCr6`MqiBXsxs8_^oO@Q(#3>*xsmX`lkPdoy$UOkqHp$sSt!eHx}7>WX~qgt;VbS)TU zHP8ur8YB!_{-wdK7Y8|^g@I8RsGY%-fkBypLEkwsFE77DA*Cq4Kp`(bPa(A;v$!NP PFI@rV5(RaHtJL)XYQ03Z literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/dhcp.pcap b/packages/endace/_dev/deploy/docker/pcaps/dhcp.pcap new file mode 100644 index 0000000000000000000000000000000000000000..a42d6102e8a27868cf17b3da7a31af47d3140f5f GIT binary patch literal 1400 zcmca|c+)~A1{MYw`2U}Qff2~*h}-PQdxM3+3djNB|6stt-Ng9EiG#tFfl+6L83V&F zLGf;oPLL#n3xhMGM5H_;BO6e}Ru&|V0l@k(M2D+aba9{-kBM@^jI5W5~nkX4F zp@k$!4x|Qb?63?;CPo%eO0oh5BRhvRkmT_*29kUNW-K6&!-5nNuqY%bl;^x;#g|^q z!RfUNqz#c?=kJB4S2+~pV4PtY%FIaV6_lnRfeTBuppd-wiWOgab;Fik@85=|S9nN* a%!UOdG}XhoL!AN1`K-87DkL4_Nv{BdC3Zjn literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/dns_additional.pcap b/packages/endace/_dev/deploy/docker/pcaps/dns_additional.pcap new file mode 100644 index 0000000000000000000000000000000000000000..0e8962e9a3e317bd2e88f6c4051c99e2e50729d8 GIT binary patch literal 350 zcmca|c+)~A1{MYw`2U}Qff2~bx^pjd?lWEn7a$viRZ<0?tjk{#m+)$>B?p5m1A|$C z5(9&S;F`Y&R=jfoV#eFQ8B7_JHrzay3DgfV0ti?$QZtKFnNm_gB8(t2vwrh3JOavq zFvK*7$zU_D?4AHJGvOo1Jdn8zra)5<^c_2w+1LOwfq|8Q5!K8CJYaDKmU0G`gUJ&D zfP5yP2m|9W1|g=rVxEHh0^N+nyuAFf)S?4INV2Rz*#kUC0(?LLj)I)h;+)L9R1~FR k%z4E|C?+xIrIs)t>17A%Wh_3BaUcZZ8df2YYbL4!0F@gF5%T$OAZEC1_lem zLHX8o|8vhj<{{tHTD;obJ8vi#M{|XxaDH{JB8vhv@{}up^vvLst literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/dns_mx.pcap b/packages/endace/_dev/deploy/docker/pcaps/dns_mx.pcap new file mode 100644 index 0000000000000000000000000000000000000000..958f38e1349b1eec7a090d6fc6f675a1d6652b9a GIT binary patch literal 532 zcmca|c+)~A1{MYw`2U}Qff2}gb^Kna$zKKrHy|5?RZ<0?tjk{#m+)$>B?p5m1B1oB zA_fKr!MN22R=jfoV#c#o45kb!=KeST0QG~600Q>ZoW$ai%w(qId4wFHQlmEt&I+(m~e3lt_Y<7#SFt!<3j>00V`oG#gow5GzoT znHfxpfyDt!BqPMwfU*|GrZ8y}1LnNc5{9?HFx?o$!r%l9ZxBWgQwEdostyc>Z27Bu pE-yC%hiSlBEwj6wzLjojw;Kc*HZ0i#3_C^+uDaL+Npt;G?*YF*j-vno literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/dns_not_found.pcap b/packages/endace/_dev/deploy/docker/pcaps/dns_not_found.pcap new file mode 100644 index 0000000000000000000000000000000000000000..07dc1169e4dd3635f9dfede56776559dc930a0c3 GIT binary patch literal 297 zcmca|c+)~A1{MYw`2U}Qff2}&Idv~|_fi%HKOh@~RZ<0?tjk{#m+)$>B?p5m1A{~7 zDIg(e`0T)ncP<=2@b?dcDT9ta8`DalevlDBz@C?1l98F0&Yqf+SX`2s%#@rDl4As! zE||{Buo$QYgdyfa>;RiSwZDvk!C27ZDad4y4GgA0^Ba4_nN~J7gG~q8fXnm)A`EOG zHOy`dp6q$Wx`u`p#+-@e#VH`RC3AjJI)fmTn~`5!k_&WNY7tvvZemq_9&>VjF39CT R?J^2LBU%`QN`bt<1^@u{PY(b9 literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/dns_ns.pcap b/packages/endace/_dev/deploy/docker/pcaps/dns_ns.pcap new file mode 100644 index 0000000000000000000000000000000000000000..c4b1761c474665afb35832432f3e2a98fa09be0a GIT binary patch literal 1479 zcmb8vTS!xJ7y$5Z)7{j-88s`aCDInocG2k!s^L;9(@tT%gymS%t`6Nr)|OjE7itgg zA)ms?5`wACB3zNf*h>Zr6saCE2zm&KdI_u;t?%=+(`X^vfj^wFk00OpF8{gM!#jM) zht!iy0`Txh=Zp7;nkPh1kMDHKt0Nyp~s5L!``=a7qxEmc;{`2UU-rkuv!<8^zj3N^B>mIDyfcK1>db zy)lxaF3d(bxQCS24oNs{jii)SDpH;NWDt85x%gsnyE^ew1)~Oej ze%X_3l>dB@i+Y7U8=+iGPgzCvE5|Pi(k9?WC`g%aW0iSHL2lLc&{pDhj+5fyv&!Xl zIVyJA1l)*gs9aib19W4j2fj+65pM`O8MlO?aR*jL>O4nX7UMH306mm9tnX;TdyB3v zd_>kWX1n90g>SI|@PS9F`bPoG;D2;7<|lS)44_Kd<|A=we)Q-*h)#DjUGSs2bV2^B zP8E?2(0UAHqAq)-R%@t|n0xKV>Afz`*3$`TA!{f^r_t1=Li7eqkMBI49<)k;K{Yk0 b5RDQp{T{}Y1P`s&yR2$m~FHCch3_}emq`qdJ)^bqVyQ@t> zo5)>A%Y?+Gn<8CA6wOkdkv2o&1h@0uc@yZwY`XBxAMX8r-#O>Lx4pUc(t$=}83QQ( zc~L$yetAmcDt}9LVDQS93O}D-8|lCZkiy<|6x*wxl~N8%=>)uwzczY=6gY=J%AWv7 zx4q?#BedWs&2s8Yp~Y{3w4p#qTn;>)$W&jyBe6F~7*iS$TI^Yawwuuy<|L^mZAt7~ zZQq3?xJX+siR->wTX8*6i6>@El)cJoaJ;Q1)(w;`YvZ4+zS>ILG+X-xXM^LH&V|`R z?C$(5@EdB>&UkZAqsBd{Mv8ykSK{O1KDj1Zxf<@*>E84EOzHUtwr%oEku&UN9i8$1 zB-&;ADHj*wVLm%EH#2wtVk&hhK(HWbxT08Bml$i>cTK5_U83k`*phPFQWolvW0Y=F>f|dUl=F{U`Z}<_zKRYZ TMZVJXwd}j}b&g_yJ7(+;z{TAd literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/dns_txt.pcap b/packages/endace/_dev/deploy/docker/pcaps/dns_txt.pcap new file mode 100644 index 0000000000000000000000000000000000000000..e9916bdb02b5ba5e090b102ceefaeab310779fd0 GIT binary patch literal 757 zcmca|c+)~A1{MYw`2U}Qff2}YIC(GhK{_9U8;}jcDyf1`*5xmWOL(=`l7qpOfx*Ij z4N#R}3(tWS?_4;5;KM=&QwEh%X7SxX{U9TNfIT%QvA85NnJGD+fkA+Q(Gh5Bgbo9P zK2RQnA?88M2ARsJc(I*nKP07zq%*@j*OD)Pw%S=uz$;{8Q%`qy^vGDd!Nr`f+^!9SAjQ4Xl zj0$y233qYz3^Gm$F?P>3@;8XLEDuI9wY{y(wzwe8P$4rfIj1xw)hZsy(@W3KPtQr! zOU}=Qix-y`6yz6`=vAfWrKA>TqsRf>l7n3$y9DIW92C{XsYO6{7whFF7nkYfrIskz zC+6gUg3o;xAA=Jx6hIg~_!vw+S2Hk}v$6ZEJ*49c4!(f1X3MR)r^?jVA8in1jJt9T z7)*>DTpNNTFPaylSIkXQW&r@0TJI46 literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/dns_udp_edns_ds.pcap b/packages/endace/_dev/deploy/docker/pcaps/dns_udp_edns_ds.pcap new file mode 100644 index 0000000000000000000000000000000000000000..7e16154ea33ac3a42d502ba6605cdceff76d52a3 GIT binary patch literal 461 zcmca|c+)~A1{MYw`2U}Qff2}=?EgPt=0rvYe;^x#876QGO+3gTb6~RZZw>}m1_sA- zQ49O5`9AAswLyJT9&$o9->Lq~c887_( zIql+lowIvSI&IL|pld!&^AR^tjULG1Kr^Q^XtOghFa|aR3ZG>O_`zSY*beM7Zj)l! z`r8J#_az>aTO8o29@-(k*mnO)pL_jVL!8=vEczTYQOVjZ)ZpmqrIrtG@7Z``&5^L) zt*gQh?dta`G|~ zVh47&!gtOf?tZ(jyT9L@Z=rbjs@TBW+q0^vipjyQ<$!KMmEC%D z>l^GU`h^4qR8^};aupW`y9R*+@S}i0Ki`0!{8!Dz1wVE3^Xt|RKd)G|BK{*JxMyIH z|4`px|G>VkVx7P~{e1fl5iu(MKb%K6&f{0LF=b_K?EhZ(@u+*szt!fg&#%`>%36-; zog5{D`ouBl&cD*iE6TPz*c>jD-!nxLGitH4Gc8U2C?F3!Wgh|50 z#GHw?f-H=N@PW)mdAEJO+mP|doDITAAoRfPz_Eirdumc;Cd z)`Bgrv-yQQLN+0vkQ>*~%z}-OhAA`@?1fA=f|a#kCs;5-4gsf%pJf*c;k9;nkAlXl zv%r@hW7uMhyn>Zr4S!A{7se_Df;q8nSp4o|9RxpH!8ra|C|j?XKo)A2lu@YftK?p2 zWPh8`LRKAZ8vH2K4DJ>d%GFvB6dS9yV^U95Y3JC*YPL+jJVrVWPMRAWRkPI6 zq!hoAZv~V{$bnPBNo7n4cI!lY!Frcqy+g3x>N3W9lgk*Z$R#$`R@T_BJz{LsQcH?&cDmWgr_QbAU-w+^mbFUOY+h@3 z&0SH}`@;G!mpfm{KFGO8-s7oFwB#{$ch7sZwpcm;Iw$AN_)8nfllu=m=u)Nkw0T=G;Cu7tmSc6>^^5vw2BSFns*wtQ!^g~P7PnA+17|kQ*Tf^L(CUt(ZtOX5$o)x;-CI8oIXoj)b{|!E?lj+{-}1i9oVBl0-+9(x zYqi|L#oi?wYVDLaleLTR*Mflr3T7pYoRqji+#2rM{@}doZQfL`e{E=wQk(4WtR8wfWA8jhw zBh3Fr{BL^0#Qb$SZ`g9dvwIbJf8NC(=N0h!{oI$3Z7-gLx7qY1^SwWW4q+zyIuGsy zKXBe~?&9UM)w*Q8Um~T>mcYtG=Z;F*8`$}J__Y$17neM?Yo*u3BEE&2)r;SJKR$PB z-D_{T&G~)u*1S0R&P{iD><;De9Ct^@6`@H@X07;mrdFNOU3P0(k`u2Cw{O<)_=wmc zQFT}Ar>-1wkL}&!baMFfQEzRK&^|VOi-nl22Ivwa@&NsIc7qLTj0qZsN?WAvQ znl`+4O5C#O-pnjYZz(`?sOOY(_@vE6hqtdB{{GFeQi*k5#&EcaQdQi~4=|?y$xs3zyxwc3H;*Egw}Ke1w;Y(8_*IyYC-gWc;SWV>+Hc_fIbwsWvrp=Zt6fW)v%9)D1U3>rS_wnqyUV413+frtC)cdu>o&cb(y-y%ewpemimkBT$7%HJ zhzVT7p(GSaao7GrEXcf6dk*5 z=ztM-JqjQ2A5nMYgC+H%_)_gckXxxPdwwRxCNm0nT{_oNNad~U4h zQGeU9fE)XceZ6wqHdFigWs5Z4|J(h=ZqqA#b84`q_>TD%*4}!o&OZ3*=CV3l)r#|i znmUiEdR*v{+@V17QjatFZf0HlVTxW+v~AQ_Zw&0A6x8s_tnbfVv~rP zwfipo)Vt)R>`$9MuXLr`yJIDeHg251cf_o1PA?;xR=!d%c@wXSnR4K=%S-MdTylST zzuU-5u6OQ?OK$r8uD^{_wK_JTxolhhE1{&^V}KBvTSOs_^i z9kUR|eE#DyK8s^=!V_`{!Wbd6Vds9UytRJUr{{Dm;uR~HEwwfd%RZ$;kAXv6#owF8 z4(Zy-as1S9x5p(*KF_@*M|*SHnqo6ui@Mf0-6X$rr46A+Hoxo5u^#!7?%3yvKOE&-$0#F*&y%3g_Qxx3=wfy{x_rUmyfd1V zNPRRu=j}T+Seft@4nh@Fg~vZDV^u7sA1f2lBcn3uH#k%}vi~vM;CiIx`B9nKsLU)* zWKAYPSb-lq3rn_J9b4$vQ+iCj}{f}N)Btaw_2Pf?32gd$OmDKXI{&(xm$&} zMq_Kd-H|QR40oyS*4MY}^DHZI=IN=R(YJc2t5P_)iTxb?p5!cx%xHtWA(PKbP(2~Zan^3Jz;UmCSzU2WK{3_ zT0Mrf`Yg1Nt$*sQ|Eu2Yf~cOjt@?v0!FfG)v@P`J+L<;_9S5y#w5#v>%j1);Ehsc; z)a}B2QLRQt!(Y_S^T)i1Dh`Y4OqdiurNQB{UF*07mw0t3w9|-OskQvcTE9Y?@xfx6Nc9_WxL|zx9Pw zqt+7&-*7)7Orh|8iWLs{Z?{)dZ?fjZ2kLuogpU<{(iODN+t}8um=9Gb@7oQxE zJaN!rtIExkwBC(eg`U^nernT}v(LH7K{$;)#^ay0w%QXD#M#e1lrj7CT4UysL5qxi zw&^FezF^%V_1f*0e{{ut zKH~$2uZS!2YVR|@rwt07^*U}J{h`R@QESWO4C#5sajvUd=`MH0?{c>zbB*Y_{evJmhnYqP{)z3;xdvn=6D5 zu2?a!;n2(4UDx`tU8ee!Yq+RUxicT$e|Y5EI+s(fJ5%l-3kq?}f27fnqGh+qv#)kN zHuT{`kB;+Z=IY-2VT;0*66SULkgxN@VapaD%iC$4r(>T-TbJFda;K%;h!z2LdbOSV zbWY|P+2$^*A9C@0HSd*`mw#?xcSPRl184NMJtkE<(=~F}nD~S9YG)cT?10C%{?fBUxoyg~llPz7 zGPAB$d|Q^~9m<6?T5^8g{HLy*{3ep|1*+B>gS04YQD~wFpVyw*r8Fas|%|%Yt>Yc;d9GM#Q6T16GFC5cE zNou}7r&q|1{#RENzSgWwttqbEkKA12TWL{B0j^E)^{u&&azx1PF~MQCl6vf)HX~o@ z6Hj%~uWP}%VNu;P1#)&(w*1FFA7JeBw;8ibUwfEYWYEKZ-RI3i9vq)g+^J7!iTsIs zq63~h-aK;NYNvu#KQ~%C;?aY;J&b)G``X!|d8;lfQaY_`b8_;NY8QuYm~y~>uGgzB zQAgfRb#3yy$K?x~-biI#LtTgG)*Ef)Y)AgbY*XTmT5igi?e|(fbgEXrl2OZ_U6sOa z+|KEIJ)(sczS`pBwzSmru+1wMdR<+=;p4m4uZj&XYs_|QZKs4C*`}PBpX>RWq&{b3 z>?eQNI?(yFw@0%!gIcwyJ%7!RDRKK}jrA!~GxF)Fgow(V?VI>tUzK8ljoRMLm~DD( zG1JHaZbohYyaUX^{WJXz&}ByArZ5}R(;SOklInW(d@(y)i-zGfb4j0M^CZ8w>ZbM5E1%8no0#o`M_~JDL&_bzyQ97kTdLdRLSOO^vU-(i zcAhOu&-*m8gtZ8N_*HFQ^a*F*a_g^GM#@&B)^QoLPp|a=H`IFW-)ha-&oP!{ffkQ+b@@n)cyo zNoW*td>yLity9POTZfMWhI&Ay(%1GH} z)OJb6Y`@obA!_@=sO|r+jP%-8cv61!%+aqO`JRkyUfl1VP;g$4K5>pu#gm7cn%5uk z6pfX!v%uT8DUSou+)#UUbpS zSC7AV4#;|>;GTZlX3Q>E&v(a43uk{Cvwx0j8IPY_(Qd>HG-|yxWA@)`{US6n*w(1^ z`5#xbKWqJJ!^7k+6)wMW4r)KecWjMOkKgQhXWR7Fq3s?~lb_qWxO4WQZrAr*Q}6WH zSaEvhQOjz0gld(BoHIeYcI=55z)yH={4 zr&Vy2?VzSNd+jdvc&Y!6)?Phh6ZSRV;@*a5Ke&00Uq6Fv=h=H_%Q*XVcEPqz)!Y~0 z8D!R9ovjPttmTgW=@w9fma%ofEh^kqg zFLbQ`+f9egr5;U>_ZyZhu>u>T$63V|?H*Xhz47eoVKc1zo*ZBDNt={2ndVNr-y$xy z%Ka_HCOU5Gb;s?}?XymG7EIsJ-LXI^;qJgnPlnW=T)gN^$LPD6d@88@+{4bFm@__M zi~EGr{`2O9JsER1^5E^_kZDL3*y zE?qPHw9l1*uGQ+t)tNN8lvBS_iJ96&9ru_ttfE)ln`;LazP&0Y$LM1v*MEMr|A=Z; za@33xZ~vInYi=ZRlVwc4AjS4boGP5bMm zbZEHaV~HD%O}@^q@^qj5>5t-7+m0a%m*0O-qF$-V$?qb)+Ki7|-J$Zj&C7k-eEGCM zo7Rcd3JXd9*5DNG1uN4w{a9P9R{FMn(7Qp)D@t_v zj%|0xd=bkH9_ZP}?AE?`4b61#)#O9*%}_0?&NI6YK6&Ls|9atthhA>8=(Nq%_2vEY zUd#TlzkRldLvy<1NxLQY@GiLK+b|FJMtir|MqDeD7_se){pS*%y{pEL_AOW;v1ZID z*KrAR9>nd6(>-3ynQ3R8#nPedn2~{}7M_@QY9QL(sOYM+cPad412JXJ^I@Sasmet1;(Rt#?`w_@G~61Ho$Q@WWf~PKhS7n?nG)CTrus1G+T#b2`BRfi$Iidy96IEgUqb86!uBqgT}m%0*U7$N)rwOchwnRE zab6%Y|uwd|r1MbcZY?E6Ic8!R-*$U28F5{gmVeS0BWrHj22u^vaTZC&Ft*JB5RQbz>c{#yInA4ej*zlJ}xo0jjv+LG&! z-g(k>UrPQ~O%tr&xAiV`%DutUtMO*rIS+QsF03_e{Hegv-}4--bg*~qHm%m0nQ#1a z%{_ls9^0vnaC2>Vk6dG=!xMYYU!aCw+ugd*fd}V$9_s&iLCEcMxeln|lA@%v&K#re-c>n^e}+cgnySpEp*W zS#JH<^EGNU30Rgi^S#xOY@aShuRith+?62*PcJw&_7BJ9CQH=2__s?dZD?7d%);(+ zyX9-z)~i@8o4H_6{^fnPSKXSs`bp~}_Zpv%_P!QSKCDuYM^!K7+wSa@_GnSbl&Uw| zt}QUc>>B_3{tDMmN!yw(Xg%uF(+Ep%$4jqI9JaA7qfJqN+opS=Jz(+rZ1c}rPztjgHApB>>D%d-r&;%ckeyD`q9zfl6~q=`y-|M zx_dh}j(r^ddQ+XaDf_=P_FkCx+Y6`X%|C>{%=RdtLS)Box^u<+g*ydW?-wKY|Ix`g zd)pirw}?xJuD6>x;cETTl|P0T9c;5MPfFiqt(%@r^%I5UhW?jZ|DI{nupKs1lMNjg zbQq9S<>90j$#X+elLYVTp6dpcarfPDp>O5>!K-XmpF0wDwS#>buFh5C1);A^`ti@z zY11)fH&>_U9~rAN{n|5dvs1Ok1##_3u=4u9)fvx=u(-3#u&(v{3YY38R7edk+5A&w z&szca5-cbiH#UuK;b61LB4U-#|v!rar|E?azZ zO`m%O@@H-^{@Bp3`j>On<+f*Eb(~lueB3afh6Scxc3tQY^7hE&Gd&h>Ej`YqT|}d% zjrSZ8d;4Zv_+fCPPentEp7luGI%nG6N#+l}6>29X`tR>P(az~=o*D6(ORpN*_|n~a zjh9Ege2{wOWXp$XUnhy4pT}3e(KKy+e*NX#b;{;los&o8NUpPNr)P;)O9QTb>U?QX zJ2}K=?en7j#d_JIypOMJpJaa`ZD-DgUX@z4E9e*-l`wdR*0Auy=ToXx58L+i)f(@6 zd9Mv$`q`?s6ko^7dwnU}+|NCCe@y6~>&fE1`=|EWVyRO%BKw-%%dcvw9ZvZzdUnP( zV6}6L%v(A=?Q;F`uFlmTjGTJ0LbuAj5=u_KZMUX*?tYg-o7t~FmgMqT`Pw^A#Xs6U zJ#)QzbHB&e7IuDrxcZl^!#d6AwCnCi=c(;oqu=iedE&L_x@+9tqi=$TOnn%JSn%Q|_B*Dny= zoj7}vJnY&avn=v9bP92%{;oJ%e~^M!5Offb%)m6n%ky>OO) z^l;~v#SZO=^`CKY%&DNnom2kUY2`aAaKrUOB|a_R(ZI&;LDXztrrcd6Lo@%w2dL5>ndBELQ zYwx=*O_j$UCETr_IUbPSz0KY>dC~61M+Q{?V2N-jlJK#)5L|w@W#HWE)*h~cZ8@pe zeWgLnZjW_EBddQ|eRgQu94G6BuAMgdl(SELWlif_UE^MEeP(hIe8S(Kc|U#5kg$Sb zrzZ3puse6{?w_5CbZp%@q5ke=+gC*&-MeAuw6S?om-lY`q2=sLO>@01A-8QcImc7$ zZ5QV{%&R(h>%1A+-*;bnzkTxss~Sh2detT0)vHH31w44(;DPn)_z=fdLG31XEi|qF znxun|>z`V5bl?%S_@UP&KA-KFHtj`Jhp6k1vgB&e_jpub`2cCq{##c(r#bs}T#?`z zdv|oeib^fdTZ{R79X}N|zfigS)h-29tk-R4u7}RktJJ(X!?tPg!$WT)8z!9^ox{|8 zgW5SU|Cr0`T67v-x>dV;Z(kqTwZEU+kmbH3=MA1d!QOXm_`C6S7WiMWZ+Y~$G51&6 zPp$ZE+=AKf)VhD%Y*uyI>*rpjTP93B9*{NH`mtkgUR<`OhkeaIJl~kAn=ilWac;$( zrYHNq-D>5vM_m?ND7xX-H)Fba?A|x3N42I+@@tP`ugA~ne|b*M;3{5`lHY0h+k{He z+47sm%~bB08y9l9bf-w<#MPCjM$3*TFEy+mS8rmjzJ+pcZCz|vsZQBy7Yy& zk5BFiaelVN|CHm5Qw8@W@4vLgX>Pan5zhmpFHU>k^<4Wd=-Qg6b=*QrU;3Q0{EAhj zuSr9z&3WTrT$#Ll#BW02j_6Fuaej3Ng>2trdH6geym5=_WyAY!>>b&E&w9U9_rN(m zyD#<{UH7-*!)tW=W|x|;&XU2(#?xZhfmHciz^0Z%`tP-WEYDo)wM-RreFWA~=tJBK7YRcksL_s+9_`3=c#?B1=$ zz4L>RXJEo5q3)u=<-Z+maWdBA5%}VB=O?`{o&FeCKHyd`U*ytyONaV5W%rMFFw@APDz7zvo9%96wjGkXjagN*)9it_R=&Ad;BCp^CKrocc1v=1D}883R+q;m zjoF6I=y0Q0?KZa-FFNEMcVbUOyZ0l8x}1nB_`#-9z7wI56>_H@HkYl^rAyM_CFPpe zy5+{%p8O~XEpbic@y{!xP|uW&v$bE9G28D=i|NgC>_I|%%=b^ttnIY#Eq^W|T3Ezp zjUDXxCeQFDzxrize=EMpiNuUI`QE*lg6_qLzco+sO?Gq4H=hK-A5-S>lZm%A*%=d` zoiXP3iANY+f1G%e|C{*ky1v2PTt%;tzRseHNvz+k3(mkKLtJIa)od2sn|P<6OwP~$ zaWdA%$?VN|&_S-%lpt-%iG>TM#-hUB%X3?hVuby{bzU zlju1Fos@m6nyaW)l=PFC`(GzxW1P&7IP5PcbL-zu#`a74uVUB#oXlcVcH?9`{&q6A zew@sok*h(wm2VJ!i=W;S>iqqGE7$Am7ueOmZx08%I)QzI(N|j8dq_V34DL2KxN6Vf zJ^{apem#AI26PLq9unNWvW8aCfPlb3t|Gcrokh=PUeE^h-0C`u%{;vuHf!p|Zc?r* z5wrj0TFqosWOv5w|E$QGM*mikGaOS)KmNH^MT^OSV?NoEF=jg6HH|VVQmn%Nuhn5C z2L$^DhYTp`DwZ4&f?nAH14=rJCA<0t`|?LFqDeH1l4ucSQ4v*96LryqADTpySu{za z$s%H9n-tNciY84o=~(5W86LA}mPE5fG-KT>qFEKqnrPNV$wib*qJ$wOQL>1VEJ}(f zsiLHbk}g_YZ~~&mEL!l67SSS$7DcqEqD2!ex+uGdvPqQ9qAZCrCM1ipBFd^LYoe@+ zii@b2M8zyBlBifj1@l!zMHLlIRCG~w5ml3@nnhI-Rg0*~qKeZ|MO713UDRAe%_M4O zQIkZ?B5JazDWZn6)kIAfbr(@LiMmumVz3%02e!G%1qE?IMO;u4 z7u3WBMR7q@Tu>Glyv`^aUdO_*ax5Kd$KtViEFbD;LIF*vpa~^3p@t?D(S$0RP(~B# zXhI=PsH6#{G@+Iz6w`!inov#?>S;njO{k~|B{iX@XbQxE*P*N?)YXK-nowC2N^3%G zO(?Dj)it5KCe+u20-I1_6H07CjZG-B2~{?s%qG;?ghHE8X%k9qLaj|Gwh7fXq1-0a z+k}FfP;nDVZbHpXD7pz%H=*n%)ZK)_n^1WZN^e5#O(?zz)iNd}!NUw5 zX7Dg$9hxnG4!j(Rdx#G#52jHJ3HlH5WE`n8Cvg9%k?` zgNGSB%-~@L4>Nd}!NUw5=*q-_*MWx_Jj~!>1`jiMn8Cvg9%k?`gNGSB%-~@L4>Nd} z!NUw5X7DhBhZ#J~;9&+2GkBQ6!weo~@Gygi89dD3VFnK~c$mQh4Wc;kI`A-qhZ#J~ z;9&+2GkBQ6!weo~@Gygi89dD3VFnK~c$mS%3?63iFoTB~Jj~!>1`jiMn8Cvg9%k?` zgNFnj5_m}9A%TYk9ujy+;30vB1RfH2NZ=uXhXfuHcu3$OfrkVh5_m}9A%TYk9ujy+ z*dG#jNZ=uXhXfuHcu3$O@k+x>4X-uE#RjkA<%ZWAUT}ED;Uxz=B=C^HLjn&8JS6at zz(WEL2|Oh5kibI%4+%UZ@Q}bm0uKp1B=C^HLjn&8JS6atz(WEL2|Oh5kibI%4+%UZ z@Q}bm0uKp1B=C^HLjn&8JS6atz(WEL2|Oh5kibI%4+%UZ@Q}bm0uKp1B=C^HLjn&8 zJS6atz(WEL2|Oh5kibI%4+%Uh;9&s|3wT(-!vY>?6vlx|EqGYK!vY=_@UVb~1w1U^ zVF3>dcv!&00v;Cduz&{|jB)U)jn{#P1w1U^VF3>dcv!&00v;Cduz-gJJS^BB7Vxlu zhXp(=;9&s|3-1BE3Ggn!+kkN&!0UJ?;H`l70^SV3!vY=_@UVb~1w1U^VF3>dcv!&0 z0v;Cduz-gJJS^a00S^m!Sir*q9v1MhfQJPdcv!&00v;Cduz-gJJS^a00S^m!Sir*q9v1MB!9xZQ z89Ze0kikO+4;egU@Q}en1`ioLWblx|Lk15SJY?{Y!9xZQ89Ze0kikO+4;egU@IVVV z4!jOL&>fBguLBPmJY?{Y!9xZQ89Ze0kikO+4;egU@Q}en1`ioLWblx&KVdp@WAG9y)mF;Gu(u4jwvq z=-{D)hYlV(cdp@WAG9y)mF;Gu(u4jwvq=-{D)hYlV(cdp@WAG9y)mF;Gu(u4jwvq=-{D)hYlV(cdp@WAG9y)mF;Gu(u z4jwvq=-{D)hYlV(cdp@WAG9y)mF;Gu(u4jwvq=-{D)hYlV(cdp@WAG9y)mF;Gu(u4jwvq=-{D)hYlWi9>jx+3y47QsNw=95In57fC>bU zEBJ;M1rIDPAcLnzI=}`(2k1cP03Qe)AOxWUjPR^U2Pi@404E3?AO)cVtRQrN7M@J$ z051p~AO@iW%pi1t8iWpT!*eVhAP1oX>>zZ29)u3?gU|tjc~gwO$^5IVpVLIzV=m1|lf71cN5IVpZ zLI)^A=m2L39UzUTbvnQrLI-F==m2jB9Uu;&gUrE^0tc#1fde(6z=4@l;K2A4I>;RV zQ0O4@^hkir(?bC=Pmcx2+z1AYWWb09jBLON2aI&UhzE>(zz7J8gusXhjEukt35=A$ zhzX3Gzz7PAq`-&@jI6*23yieDhzpFozz7VC#K4FQjLg6Y4UE*lhz*R~zz7bE1}!3Y?Pgu#dyjEunu z8H|*{h#8nO00#&%X@Gzrvjzy5Gi`u?Ir9bxm@{zzJ37dmp#y{t?sMi25IV@5(F24I z?sKLO5IVTe89+ej;67&t0ilEYoG}E14(@X%5fD1K&lyHQ=-@tQ9)Tr92lqK62?!nB z=S(Faba0tGLI?Lb;|T~I+~-UvAarn_Go*mf!F|r00zwD(Iim^)9o*+k zE3lI3;67(y0ilEYoS6lL4(@Zt77#kP&zW36=-@tQcmbh<`<(d&gbwa=Mi>w}xX+nl zK4l-v>0-=M<8I?fjAakZA z5IV@5fe8c-MkWwA7@9!fU~B?`gTV=e4l-wU0-=M<8J|GtAaf=t5IV@5Aqs>JGG~qg zp@YmBr9kK)bEYY{GSflk3{)U=kU29I2pwe3SOr1{nKM~|&_U)FGH1F1p@YmBut4Y_ zb7m|MI>?+c3xp0bXVLVmro9c0en1wsdzGkby1 zLFSBKAasy96Bq~`WX=!bdWjI7ziC?&Oio22bnXI!A%VgrZNyX zn9D%mU@`-NgV_uO4yH4>1JXg}3}_&9kU29N2pwe3m?;K4n7aiLFNp1Aasy9^Bo8sWX^~OLI;^M z<$=&a<_vlubdWi-9ta&|&bS9c2bnYRfzUzb41FMUkU4W7d@O;3$qxh$W?+s5rhshXI2EEgUlHhLFgcJCPolC z$ef`Ogbp%iZUmu&%o!a)=pb{ZNBBfX2bnWKg3v+c%#a{-kU3){2pwe3Bnd(XnKMj+ z&_U+RlOS}EIU^+q9c0c_2|@>%GgyMqLFUYs@WB!erb`ewm@h%#V8R4}gBcS94yH`_ z6iNq~GiZX)LFUYwAasy9<0c3lWX{A1LI;^Mbb`=9=FFWSbdWitCkP#6&h!aF2bnW~ zg3v+c%%JdLm<}>$32bnYEg3v+c%(?J5 zLkF2N>VnWg=1jXFbdWg%F9;oE&ddu!2bmi^HUHJ8U~BX#?8@jV__I&pIQkU+?+-Nm z=&4D?n0K1G*YmB+GGR>p@Yns z0z&8@a|VGBI>?+^AcPJwXB-HjgUp!-;`yBpGG{0Vp@Yns3qt51b4G&@I>?;qAcPJw zXFv#{gUp!`Lg*lK#)J?$$ec+bgbp%iSO}qm%$XM=M!+x9nHNIvt90gt5d1Qoc_9S9 zPG?>S!7tRA7b0_@1I!_GfH{N?Fo)0q<`6o-903I#U=E=J%pr7uIfM={htL7$NHgdF za|j(^4xt0gA#{K_gbpxA^g#!hL+Ai=2pwP!p##hzbbvW>5<0*fLI;>b=m2vF9bgWj z1I!Vs&;jNUI=~!42be?X0CNZ(V2%Wa4lsw%0p<`oz#Kvcm_z6QbHp`tfH{N?Fo)0q z<`6o-96|?}Bio?^%pr7uIfM={htL7$5IV@5c_9Q2=7kVAm={9eU|tA;gLxr@4l+j? zNTGwwnHNInAaiyRLFgcJWKI-1$Q)r0g$^=D%0i)o%n@%u$Q&UAg$^>u(?5j{GRI># zg$^>u^Dc!BGRK1^g$^>u6CQ;QGRLD8gv{{(M4^Ms@#I0FgUs=fpF#(j7w zTnZgzj!%~qI>;O!>mX!~4__2I$Q++~D0GlHK5kIxAamU3DRhuIZm<+O$Q*YJ3LRvQ zOErYdaY3cfLFTxUQRpCZTtX;xkU91)1rF>m3LMx66gaS2DR5v-QRpCZz@*SY=BOft z4l>8|DRhuId=xs!JiT9u%+ouT$UMDgiOh|zC8KT0=vy)xmyFIOqjkyXT{4=NjP50) zeaYxwG8&kS4kn|8$>?D+nwX3(CZmnX=wmV(nT$>*qm{|%WipzXjBX~Qoyq8DG8&qU zjwYj}$>?b^nwpHRCZny%=xZ_>n~csTqqWKCZ8DmhjP53*y~*frG8&wW4kx3<$>?!1 znw*R-C!@{D=yNg}os3Q=qt(gibuyZrjBY2R-O1>8G8&$Yjwhq#$>@19nx2fVC!_7j z=zB66pN!5YqxFe-A&Ltg%nKpl!MqRx9?T0N;K95Q0v^l@L4po4XI==QgUp#1Lg*lK z=7kVC$eej0gbwa==7kVC$eej0gbwa==7kVCxX+mvLg?T=XI==QgZrF$Ar=H3+~>>- zA#`w`GcSbD!F|rW5JCs{IrBmY9o*;43n6rHpEECn(7}DqybwYM_c`-I2p!z#%nKoO zaGx_T#JZ$|`?-PA%qSxXI==QgUp#1Lg*lK=7kVC$eej0gbp%iUI?Ls%$XNL=pb|Eh1k+`kU8^0 z2pwe3ybwYMnKLhh&_U+R3n6rnIrBmY9c0eD5JCr;GcSbDLFUX0A#{*A^Fjz6WX`-0 zR~9?-P zA%qSxM_yQR1fQaEfBlbc@65(i)ZhOeG`^W|8Gk!CoA+P-#Ke!Ms6zO&tl{W==kd>{ zDEt|sy&ThPd&ZMl`qx#4s`$FfHRJ0lfBuOHV@%@ogzH%YqdF*)8(n+h07kSm%GB>7#=Ci_oYRzK5uZdfjd7oR4td|P>zVS_ysGtKU zdB*iHyI+0PASKb5-SxlCZuF1Y{q1`b`T0fE=o(HX{qIjutzyhwI^7!>ItW7vPP5)mWdhk8kWP{Oyfb7;l^#-{Sf6Pgwsbb+*)BpG?efjyX@v z81wsgZLZ zit){W-1rvDPl_`4KgR5zg=3!h@%OO*Oa?AL3eElVH68ySW14aq^ZfDWpuW%Z5$5^m IXWxqW9~jQ}3;+NC literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/http_basicauth.pcap b/packages/endace/_dev/deploy/docker/pcaps/http_basicauth.pcap new file mode 100644 index 0000000000000000000000000000000000000000..e84969977dd8b540988306467dce82fc8cc9ae84 GIT binary patch literal 5156 zcmaJ_2S8KDAASK@DM%PrL9NeN=AV$TAq0wS5D)|kSWq9yBRt76c?rY`RYa?ZxS*|w zlmbenD%wI7sf^-4v<@8LqFS&;T8pJxMfu+)fDCQmAh~<@-S7K;<1Tltsk%f1nSzYG zhK3M?0zR1DdJq#Ht&Q}6_pp6*rQStkLcb5Baj~-y2{O;7b(^xx)lt@d!Jtvyd)U& zwL<1>`#Z``xvlA^X}TTHsw3|(+rK#4?74}M-Yz&%cXZaOR~H`&R+w`)7~X@l2Y%EU zrL88cCJ$(%$Sv_jAB3)5R{<$Q>XehW&OpjoO#vly29lXjtEP?Sf3h1=SJ8fWHAt4U z&V0YA^H5NPZLAYZ(%ayb zcfxUQMeaq*nU^exgK@geRoXPqeD|ppE7)J@I4tC`1k6J~_1CTeLPkF;P$TZnmirlpq;sZgQYbY0?tPD+ zaPkh+t=m$zyNX#Hxhp@dO&XK*>w?{X?ab+K4)Ef(&2=?owhIkb@1O@{FSoQ z@BH@W&)?reUNsS-VM{%`xh`7+ISb3|ay!1_-=FKb_##3*D?86=+Gw2U9_}jdqUFbSKFzc?v)Vrk^}e$->g<@SlbT}W{K)P_=PRXB*M?fX-M3;Ov1Vg$(6@u~{4yeP z%7HRg@44ipT{d%n{x#l9-}p$&#n_*h_1v?KsLt_aTzFQeb<;_F``G%f!?89+jM<8q z`6+qM^+FK<0Nlu0RPLx7G?u45hwxjB*l6oPe>jfa9Kh-Z0`g z>Zed@h&Y3xkA!I;sx~ncG`wlQKtzr2-iinkKcI9JaRWpIjzdrdezJ6Me)WRDBbDLB zzb*fh)~98q7`(I7_K9U(_R;I^(7X4y=*iu#9^W#v!z$-SY}OfWv2~)+A^OG#L&w{X z9xS$!JnuGI`N<{QJ>IA6B2Tr5%cpaC$SlvE#vOwiF1wdEPiu?q-sGEjh|4X$#5XpH zJEPb-wCrY}RZ;&;Np=0#KAKNNuCMb?>Md`Nh-koi%7S;^%ZiLG)o-rty0EG8#*h5S zj|xZ)@#2@&Pj7}y_l*`EkN=>57rSP`tE9}i1zWY&KGiEKH%mNihscimQ;T&z*~V~w z%u5|Ob9SgF!+t1bzfNJu24>kGyn%qJ{iU`@w4r&j?$X+U+NVNo-3+VeHiP%ic0>vq zpT2LlYGy~&%)Sk^oXU$&7yB?Q9|Snq`Y=lToxQFYc3x{y^p=&GM;*z@pXaV`I$J(Z za9j3z-X-Jos&Cp(nR_m_`n{^w_=yE;nL*5pSO1jP2ja~|0|pG0vMg4H#taveE2~kxt|fzUiMCGbn>21@=waGt^oGa{ClA^z4m(yKryp5H4GvfgllJN!TVa^674c`DfSwmrSa?N$>DQA|v8n{RAFHj%W-GeJel^ zjVW5kDVmyE>J9k4G&nW|WHdx~2KgBZKEpPN6bGn;x+6Ag}uiDWw1I~Y*s%gI!+lvs(8 zgjmEzeK8rqMY)awk{gsEfd7*nom~^+LYFW04^W0HWnKo{{$wj?T zG%i)(QZ^dk7mZp=Fr4Y+=HY5%K#gap__5L85MWLQ1Lrchav3QWGH|I>3?=}Vk5CN5 zMSL<9bUC^K;s#XCT%MRq0^TTO>`mp2{KGMxHx&gh4oQ##+&e&Ba!`M<5Fq%xfJqRYt?hC3Z)4$oH&rjn$Dfv=Dg3NQMIEpS;n%2kW+MIY7Oa}?@r zNFq##d(jmHo-Pqf$uaZO2_Bj1#lsZ@7iXwG*r9}oAPG#skZ~~q?&a{tC>f~~;3%|U zcww$gMpql0EaoZERVreTe=^2R<4eVI5s$$Y3!t3yQdr=}(R1_>AtvP$ASqdIx+EBn zM~FaNjOj}OOc^PdkPs+AyeyR9A~YHk$>??{Js1}#aFXC+Xap|DLC=sj7UWav(L3rNGGH>`HZ*l$xMR6%rhY zcT6fFLwTx{MZr5kWFUXQY_41g zs-w&vO%TfgXC<73k^os9c*E$TH?z_Suvf`RR3aq+GFL2?!pgrERQ}6gZ-i}PGR7l8VV2`xtFeRfp za46g{2NmA^UpJh|+**~e;W z>wJ9=N=-!xxw*w}+kV5Bf4*2RE?PC~cOpzfvoo_M8gCaD3(EvS!C|!=}Hx z&GVKVID9*3TR8o3UZ=#hVxX`N-7CaDm|LMo4-Z)Hz934tHuCd%ZBI0(o}PO0r`bP# zblUcAVxrV7a-~N`$q&ZUcho=3<$GQ}0cppc`p>(ZORBq^^6_^$t)bv9rySnp6mC@0 zM)Q}fHx4zeRne}xwbS>)+*d(Gzw9%Q$~t>?Ve5%(`yyok&sNuO`t%58Yxb3}yW83h zEZNu6oo-m-lwR5Qa|O+|uPf6(AE6bQ+|Jo~Du3kHwm+T z@L5()a$j9>)Lucqli7#-%&1&FNc($0``uZSaRPdKPv!(~mxH^UKjB?YYvqWyrms!1>=i^@Fv(5qKkq}ip(g%mI}1(KId#VLw!IjWm|lxP z$2R7Ru#P=Ue9#Ad5?@9szK9Ogf)qCd+0coy$=FLLj?VvzBz{ls>Fqt{L|)52-*Y)R=eMcJ(@s)N=01gjd3C$<#?~KZ-DDeXX)QzTuABLjtgcmYY5zFvH@J38 zA8b}H9;qIp-%mI}Y$3#1U31D&RaN6~EO7aLeA-B#RXYix}Il8=+=Wsra@cDxGSs#f>fzV$6ke<|}4Y62X zAm|UeT^rJ)h9V`?iFk5^UUtZ`>~;-|YFS@+SWDqq;y^YTX!p0Q@#8@_ku(i`x) zU2Yd`vLI;kmo2>9e3LI#H2I+@tXGfRWFs1+#hQ#q)|V`WWLetW zZ3=oGm(J!&FAp};d#PeJ$KIF)3T~o}2Eo|{Ia*9``|Nq1!x|kMzko)m;3u45Q@@rS z)3S=xukXtwwW6-ILnL8MGaiwdm2>E}nYS)YWp#}=z)y$hV3Fs8+< zKV8txbC~r>%et4hUKcksMT(6aSS`sNQooi#zQHyrC@X7P6}eSf-y1Wfb%FHZ@A$!N z(w8BWR3aBj$9%&qVC5!J+>Fw3y|d-f^D8EDM(97T&TaK5F=S(}Vhut__Oc4Y^%uT|577 z{4B8dsQjq&8GC)OUnsKwRgm$DLp;Z{_xddRG8xB;@5UZI70>3(jBg1n^%p$dX4wVH z4@8!Cz)_GdEtYZH?Mpm|S$0{LUOr>f=nsKWevBvCj3VWXo`G|(h7`**s<~S`$#a-d zq-cb7y6OgRgk~zAN&=MxDhX5)c#jjH8^}D?`|q*P(=yk4=eMC(qV+!TVD2A?d|g@Z z-{Wch->A{|v+hahvFvl?;h8{akJJ)%>(H=f5ICP891v82d*d UM-yV;uYp^oTDgXcg literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/http_minitwit.pcap b/packages/endace/_dev/deploy/docker/pcaps/http_minitwit.pcap new file mode 100644 index 0000000000000000000000000000000000000000..c096cfab46832772f102df672691f558a137b0be GIT binary patch literal 17512 zcmeHO30PEB`@aLYKvE>-XKH#GDJ_|OMurg(kX1lXz!kB}aA8JE|u6>+?o43zu$S^ z^PcTJtsib~@FM~U=I72Gf+&YSu8jX___5aliEQ{C75L#09rYup?Z}o8L}wz2AmY}n zk0atbb~*k2zd0%>+9OAa?5?eClhBtp`rWyc-#`$40Ufq*{QUzsoX$ZZwY7uMX90c| zeE$W3Lkb=is^4OIaC)&&R~)j?z*Im)ZoxO&rAnt47e{bA*_s;#xgT2;$3w2!g z#a*)0J9qzOi2LTNEcZ4dyZp{i(ApO6Kcso*t_J*jZ1=Vo$DjED>S*-EUAsMyNCY0J zz>l-fNJpMR+$X%la<}+QCD`>+O$a&Qunu0b_(}@0DYE5~uL6mU9MA^E6_d04jROd? z=R~)d-N^y#Qyeih2 zNg)tHC3-TT()nqbW>9&IkRKKCtl(Mvn>;uu&qy11@g=ktz%q5!YK?{x$oN9Cel7VFZ^wiwUj0jSr zE~Uv7T3M=lh8&_Y=*nn;Sk4#nMKYm~A1NYpsA9^Xw!X!v;U#I6x+1l~u{?r$x1y7W;uetb#tCf-tupxAS4bKY-|neFOf%u_-$BC4_lZI2B$+brJKpnwP2ji`y_3NXtvk~2Nz1I0fX`drwT5uP z2Hp(z0l;S4!j-o)bvEW5$zWS~^8o);O-P9U?f$m5K<$Cr;#YBPiap?R(T7@AQYpz zU-6~q6|6_f)NRvK*TcyWtezc!ITnio z5?a~6>x=zd%wEFOWXE3UiT!23R0D5R+^`?ho{HJ$GMHBOLYBQPpyL+Fp$!$ZK|zk9 z4W-qzxkMo3%lQ&AyUL`3kyFfvam-?h8@|N6ip7YTitWVYc@o3B;X_Os7USevb$On| zB*OTJ#%*l`DHfAM%^K(&A_*xPs1QdfBvE8aX0Any1Stm#bP;>xtMzC9gb zj#fA^oy;)pNINo(4lB|rP0*c5G|`F;iZ-cD8aj3qtx>{Mhn!3%m`li91Enm5*$f#i zuzVa8tx;=BNdv8k;Tla<8rrC$X%m-3Krvh#7nDXLmsA<(;ux;LXoAU{68?j4^3exS zPm#KURB9-rF@~#$Nf0~=w0~BpE2=`z0;5%;*c^2k%+DOCL<`_~5c=E>$TUf9D%4ft z_uxfw>?jpwA`3x*imIT=DxH}u)|s_M@Uj?T2Syj`3}qyR=c~YzDk_>#MjMTY4_QV- zH!6zZW@qK(S`Y)H)mpvTWT%o#YN;|%Y=)^P`i)EKHI$N8=`=;OA%=@)q?X4p-__t4 z6T_7YeWBqtc7n=9W&u*}a8P?w2AU!bx=GNSQic_7Lq|r5v{7kL>(SJj8w=L7z8OnK z7aB-GEQuP$QKr#cSf&QkR!|x`?1y2~s6Gf3CnL;d9h$Hzjd6Y~T1+U?6THaDgVo9qjm78fJY6Jj=ruE5(8C+g6!Ss zDbs0TJ$83Su!@l>WDr!c%xozpiDZiOi3$Mz0RP$k6gj6EnJ1-fl@b~oj^gzc5!H1 zgN~#OX0_=)H6)OeE2I*>TrQJJMXn7wgswpT(oY_!I5D$#6mr7D57B?B@>||qrWLN zZKC;htr#sZYhnXoKxN{x{UBMa)0t=kj>>MvRgwv+@nkZL&ZT&3#JU;70$Op=EWh5@ z9A_S$;|Q4fh;3?FzunUu=YlWH`52S$7V}YuB^KaV5fMP(;<{-X&?_kyVU|&D zH&eQIT2v>q&706>3bPHyF5#HTxVA*Ct%MCS*cA&7x~oa;-7czN7N#{8!ycDyb4jT( zYfI@OFWYX`1)J>^v>z256dWWG6$S_OnFCWv^yB|_Ub^wHFeJ9=y~4}WdQRD=)_hmF zdez}j|7Gfil;lkdM(2E78or~f`;_Rldo$;+j(ek_-|+$JTQL=*_ATi#VAqdw>Bx_N z`S->>LkkLwV;a7_6guqYQ~BzVU)NOxCT$!O`|L`UF3uQr<>m2d+8&>-@5KMSrTO<0 z9T$jtOBV}@3!aN;ZfxxI)77v2ZZ&n=mYr7I(sI6SUXE%@&n3#;hE2miPdu|Kd)evd zvuD?Qo1%T8-#>SUR?NL|-e?l?H}ou~hIQ#tagdrB6R}ZOs_3<=eMRB4v7EK*-e0KS zyz}96g%uH?kNvj^8^?jIiZ)&Ff96cM9(gS&tCsjqfdeU>)za!2~mwU(Qk zg9lUys&;KT)RO+;d-S-{-@}hAXr37t^ZJ2vhomLTFV8)l(K~y+tUblFKXX;m*3x}n*@&h+tU-sQ&NCAIX)H<7dM6 z4GvOr{_$x@^V`qu?!T}4@DKSbK4}n+RPKs6wQ^s@s*RDkl|wZCpY?y5{_n^mEz*l& z53jhqOaB}H6LRtC@}&oIrp_y#FI=HKzidg)q3yK|uf2PtUH)i)QBvf=@m2eIpbJsQYn>zdX z^Ao3x32W~4Tem3@!y9JKep^O9{%+!Tss7iho66U`!EOHb^-IIsX3yT;Qai0B{LPnd zX%?^i{Azv6j&AAkPbS=%+IXk$t64GSkH^iQ6?f(J<-Z@87`A-)qFM8!U;aHJbAILI z&R6%E5+rk`CIE_^0=}QU%CnWIZ zz1lQI9`kA8j~_Oz__5c__}#BwnqEvDFdsU{ohg}EbmLIKw)Su0#{}$-NHI0Uww(Do z-7rnHqaf={$$k(2Yh#Uvcy!hWX6kD=#_^nD+{RB@>UX${n^z$g?^wa{y5UdP zBFwDyo;Li~eqf1lA+<9P!ER53!-nRA4gdSP;g9Th0_?{gzPWDr$0g+<`;|vKj#1n; zwBf%IZTOF2#;E)!kPSJU4ngS94}FgC&CUMa$H0*Yzifgdes9Zxg2Nb?KM3JJ7y}=S zfe*&OzyBDBV#oBL&R)lsi+E1HZ<(jDWzBz>v1QhK55|_i_AnXQZzb5z>)0|1k1Yzv z*zb01nI2L*>pkbOW%WNEvf+cN38$o&Z<-MP(Q~YSI3-`4hC^6ChoqOfS!iK`l3o!1 zy?~zqf1~2Mek0r^y?9B!$lt;wy&&un;oiCbb_H?YW%F&Pq?gs(y>q7l{~oz}NqTYQ z9<{8?pNW0QzFlVCJGQqrXR)tAo4+sgvzt@9_>1(1lc>!P*%DqXZGIh+fxbftFP93K zcrrT-#S?@X5bGUt!)}Dx@uZUvHbRolIfNNSxnee_d&kVgeyzIBV&cS{W2br5+_svK zK0kd_$zpQR2`b{*>I3uU5yW%n0r!|Bao}@%%=|$J^Oz4z1wL(^9KvE+`X8%ZZarHJ zshtfx^S2<(uYF)9EJi#{{w$`GjV=y#;E6F$`M~V*Gs0Z6!6T-~0rL>zd18cj8wK4! zm}^(Fn9kb8EM_=p$Cz7R@FRLc>_G*7oZ^|^Lq}&I%o7PLroG*}lSJG+7Bdnsr{lGh z^EudkPNssBHa0&BmTzgrykR;m&C8@rN;vE0LQ0aclqZrzO2yJBp+w4;%6Z~QSrktq zmPCorM(#i^ek&7FnTpkP5idurRl*@HY~M#f-k04WE$sFS6%wiCkoNyY9@YpNcFNG< zxXNVGD+B_EG&KR6gXOp{cJFyw$o-CjtFYSxuFE!Q(rDx=C; zfk+J79{S8=~TRQD)T;N2g>{ z!X!c|IV>xe%*;wmOHNBl3=TqlAYhhv39UHkMP*BR!ToB^Vvr&CBtZ$76M;M`ZX}GA z#bOBsP7>s}S&)QbjuMPkQ>)`QaM{dVte!ka>m=n;kd1togFX`V3=r@d%I6~j zD%&ZXO;ocdQ50Z$%Yc)`V^R4|qMBJzYzCagNM6s^>@8I4OAOv_SJ}4PZDL>=Z-1m{ z3jwPEa}-zy6*nH2B1^zx%ACZsv0?@}S_sYo+0=P!{x7n_MqktyU^_TX1#s6t?}_>~ zUv?ORsgHG{ex9Z7WC!N((`zOo5_8L!n1xu(0H)$2tR2)Lp2UQ`??U;7;#5B(r<|2&wj9W~HgCv_5mI5Z9L*U}N zF~aGcGzMYn$GV+;cJJJKW~9vv(d?7m)OQ_-7%SiX5jWEX?Oof;tq>1G#@&YEdkS$D zD+^|Ox3Uapc6YMR7Kf>Ux-0n3633%Gn?)2pFk9ciR_^a)dAA~9kJ)>yc{K@ zXEq_s&(1q8N00B~RrlQk+Yp!c_Oe(REIb&^fl*()7}SBF!E;c7AEzZQCvWghglXR6 z7891Z3ym!1SM0pHn5s}i8WJD=`J<~_=0Xr$?fH9M>Oqa(^iT({3%hkoQKQ#C$vVf1 z(7JD?UH%eT$j!no9b3-2_}b(Hn{Zv&t(cIIKN0ZT+$`+U!KmrX!tNcw_7)D;EyKLS zop`qaeknM${lX68qP92=n9qarq2fA#a!S|z3t`T^;1&~Iz?r~?E{us6c5WQ-&so#` zt=;mZ5A$+JWQswJj45CYMXpo&&9p0zIK?d1ygNfW5cyzOR9wwVWN^YT=1Xod(fT6J z(Y)*uNorjpC1>Rgv#yU0LS0_n^G#G&J(sEL2<}!_9svzAJn`o}+JP7k%u#W}Ka<17 z{AV$k);5`e+XV5CcjWIO&&x6p$)Pf@0+wR|VN7Lq0+xCbU<6D^3BbjTfHY2DEMPW+ zX%(=P6%gZI0DD_T0+(e_N1p79d;=y=G8Ng8-{gsWGhljKDsaLv`6>p}N`4bd-Zn+W z9?48zd`?l{@g=4ai|NBuY$xWZCozFteTaDqi>YKVtzwRP5_8w zwi9#HlbAt(nG9})iW|2Y$axxzS_yyClHL1 z3=s$ta}zBeNcdthS*@is0zuL+$h5Uys=;v!GV+rxcTkwCG;on+nC&UL))K9c&4t`! z1C4JT&_!h4hzxQPWhAxmJ$!?OgiLRgo@~Tdz;Ny_yp&dq@3_DXJ=ps$!e2mdmQh+W z+?S|=s~|LGq~Wq2TxUk#G>}F;t%0jNB_z5eU@}yZR0*ZlT5^d|&z|SYDyy(ndND0% z^Plm~i%)i3_}&-hYK+;_EvDlth{b#&v;*-OSQ!;JtDyIj#v)AJHpf*^-#uMh+uLip zcV0R3m@U-79QiAD734J5Fj3?WErHx!oeU28bJKd25Rz?Ky_qi`e0aL>vBVpb_kC1w zzVw(WELHkJN|*iHH7B`y$8O~HxP79r=j#&VrE+QIz9_5Jx3tlZ zin^6t){V~iK6N7Rapn0J`uqJnu_-m8Dg8pvSu4+(J~+0aOQkGy>iR5>E@|YWU1A1p zo*T3@>zNZ@Bs{;Xmqyy-)4mH^=Csr{kE~RWYt$*~D~jHc5i|Zd&bf?7s^-6a`*w#u+~2O4eg->QQ!tSqo&@`Pi({Pr$i9P|V$S&U z(33-))@iKI{OAL79X{Hv@8RT!ArlhDU+@%hx(&1E>Aa>Qq?ZpNo_qh}xTb1v=T$#7 T4AyC9-*2$^A^6}=X!`v>#B#go literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/http_over_vlan.pcap b/packages/endace/_dev/deploy/docker/pcaps/http_over_vlan.pcap new file mode 100644 index 0000000000000000000000000000000000000000..4c6444707c451404126669c513b1a3dba7733def GIT binary patch literal 1946 zcmah~&2HO95N3?VZ561e76=NonetF1j>#pd$UoE%;?Q#JM79NshLb}NYjP#hCbh%9!rG{ zG)<$>qax%9IoIM`yChhKFs4H$4Gfpx)TD8A`#g^38pCifU#4%-mUhpNX}SzcWNGeO z>(XR6Li;wbL_6$PD~CDDw2dK4Fs@zxG>jrj?&t>G^mv?Nh{q9Yz;1u118cg`fTJ++ z`8bC?7glr=_xndHcN*Ykp^qly%?5Zu#$z_fXv~OZ=!R~ZHA}CrHlW{i9IFBP9;V3Y z9)N|1bz{}SqYGJ0uj@6Gt-m2N=CWPphZG!i#xm$R7zKLVNd~+}MWENpOBjZ8vFhBq zK;KC`?uW_HhT+o?Gvl*CLwt0^DO&P4Auh?tGno+GdJV}@*t7OAN#!_t~3eQlv zT9IV=1biV&m>V^O!KdL*B7pIK2nr9IlwXu z*ne29^jUVsG8;Bh>IF=5_=F2~nLgS9mXPH(98UzxtCfyR5zi4(O=G2|nKg5L)vVQ4 zt-4{T)k>GQ3D}Tn~?E%tdDCt&xXW3 zAm`GcDJ{&Fnz(db_l2*vWxbk(W9*$IZ@tBmxxT($8YtEALKG&akg=$x_QfP({eUr{ zLXfdROZD>nb${!)Q$b+DT56H7VjoMEw$$9q7)w+#3xZJ}SIw9Sim4E(#-5DAvzGcu zJKVrZ&-+aUk0ZSkfv$>HYMC-FfTjpV#M%#fO!Vb!flU_kCMl(8m;|K5 zVJa@icS6r-DOI7!ZJv4PXrQ0uYP(6wqat8*m`m`5Zy-yhIyn74WTS}XAUKS21_Pdf zRK&&t5isCL;D}D_vT^`=iDF9*g#GdiTT24`e+>wWIr1*Wi0AAc&EBDMnD|9Rg~}3< zKM1sdhM0=&1#ILRA@G=wAf^)-(*%>pA&scVBsheNI1zh@EcF@C1b7m0>O(*iKVoGV z&el$n3mQcToq4A>zn%pba~~Tyi!dqv5AgId(`k5$A020L*$3a;YRsZ9 z>MASjhi4G_Ep?XC8B+qQeZ(TXhf#BQ&6qlp#F|$(Z8wpK1*h|Xrvzs^JJ)mBENZ(` zOjudZf@@7eksax!tNG}-?eKJxg~LG1<`wk$K#VC;bBm7>zkr0PM$P%%Cc%JZ++=SR1$P7fd?)L5R&i$A~z}I1!)noKNZ3xCh={$hzyGMy(|SvbPht_N zw`}1jo6Jljx3jLTtkZ)xf*4I9H%~-j2%czW;4LlQGEEVp{guuuON(~`Kfyrtf$;5Q zw8_@irfvI^P;4?DhOT4s#0mV)nK~Yi)nO2MD%KIc8Cb$vT3lL8L4xiDK001Yge$^P z;OiSVSC-c|R#$FpT;rA%i8$7|f8ugaL~#;ny;XyR^!E3EVc~o4Tae#OJejCSNbmd3 zcmMpgg_Za3ewzeDf?9a=lPe^k54`jH%Wr*fLI3a{WI}>~K1qTqq{3FatL)+KKD)pB z!$FHDltCOZ)#RJrS%ilxOp5uJ)?li4Z66GVQex1n`OXoIVFckk?f z_R&2?t86U}=#RPFw{=DM%GM&oXD|}n$}Z)tClX%Lqez1Cp3}#pBnegVX6l^k%4gIk zx70g<7h(quS18QPc3fAs@9Dy_#ktWwHb_@a9Wf4rD5(q>J61B%Eph6YLX|gd=J-zH za952@?h3tk!DKv5MnP1W>QSkal@S@glEI7yOT=d6ge20rW0?~(?z7!c_-rpoBU7+j zQ*C8C(8nZ*9N$JSi)CxF{fL{?)XeYqd}lZmQH#YB*p;WT?Szek=p<&wgvIobdM6{n zl8EERl#_9vyOUq1C%#CiI}4*A3CzHand_VgX`XGiGuivp13BQau$)-Sxg8`<;)*S) zqd~%kLF!wBPS&`H4{arV23J*;-422T_QFG^sue|W9sh(y!qt^HnYbbz34zTTMPjHc zoerq7e6AVASkv;!`a5MqXGH^ebj&!OwrQS&UU3X6>m=NV&M-a}ao~wLRQ$9>hZwHr z!#k^3w=37JHp^wtu`^2tjfgKIph0TC+3CnmnjHkTD|iT@6W`$K)gkvBccMRrrjGe! zbG6%Tui(3kZx7!!d~e{p-t9IdC5@?I8!Q1B>J5nrn5!{M*&F*i57yY;$no;sj>EvW zwBwj<-`iku8j>xsUlw&Vab7}4PnOX4u|AxNb2|S$G3Fq%!tG97j)L0!!Oyg0LM|LXhx%Ip)`?z}V6(8nEZb!4#=Q>a*f(ItjZ9vRcB9jQJC`G+Do->LuEfjf-EoYbHgB~0Q{`mL z=FLXNQKQWoa4}X_yEl5P%U!ic4RxQB#ugf$4UJ)9Sw9=@gc#RmpCU*(N*;u;CSd4} za~5)6xOKhEu}h+~B2oI7pYp6#*_!IZux&sKhRv&nc67A&YptiJa0Pi=w4Juy&m@IY zFk3-4`sn582Z#74M@KK!f<{=ar^P)RHjVZupG+TVFHMH~*yUEt*1t&QE0_J`0%@%x1xwoH0fRtds+;4TxjsO+^OER zyRBC1`Ez2%1lbDw2?4)FSjtshr%^b0tXJ{qz&Zp!o0hH=Tq=E2!}AdCTX8{}jn*XC zOUQegk_XvIc~wVGC&E$|c;wf0aDLqaZ_l1JIU)Xk{_s-7|4WJZ->f74w_Ys}|0}z7 z#K-)s87HaHf_x*9q><0~^OB7@bhn=7-KI=6d#&qA&Ui7~^S+}iaML&(W%BlbLGt&A zkSIG|squ(FFwP%QFciaG$fL62;s|>u7$N{3v(ztInPb6do#BL$gL{;4n<1iL15h{vfk zRk^8n=8^CWVI9Se?WdvAX3Ab_(DtE`B>@v2cMzu{4WUernki@(NG~y)v~#D5*piSz zXByQGjKG>yd;vM^AwM;MWwn6Ea!#4)a%2${KYN`0sYB;XSZWf4kQ5D59UlRAj951c zfNIp+v1J0I5^NHcgUXb!!Gr@bqnSRl{qiM<{<(c+e0b)O|Mqqr@pI9=S3=&?ut6u=sER7q z1dFUoZ3B%6v0Lf)&e57;^Z?ECF_wzS)DvUAa~gf>_7{B`+}JU9e#eh1|4Yd zR+c6pODhy5)6Satl+;voenzd38p_mOK6iZ}|p!+aO?r_~WV6k~9N zrI+-Sy?Gu|*|DK`__RB*8GyxhRAk8j+24o--^4)-2B!}$kXF-Gr-C$Cl z2qPGpn;F~d@cm?%BajcAWALS>Nn2b~nT%Uq+rQxPvg?$>q1co7p;JQdl2T?R(IIpJpKFR<_$oUH-u`OnD-$!EE z5Ls?ngI0`IFIX!qmO3XlBBlC4W;_-G;Z8E*GfNY3Ni>nE@_@)RM{I=H#}0hKf=JT& z5TOAch}C0^EgEE+S zud7s)?Wan8PY(}dOjFY*E3zPf_fZ#g+&jqO zhip&AKI}fCdx<>N>5$lq5kF5Ek`Eoqsmz2(mSYG#6{HA34s=`rn<3Wc41j7z4amQbxmV!W7!bvX4kmJy|51gZmb((xPs`@ zR8Unw%?&isSOtj(qE3~89cs2}Ik&9lDl*2ryhrZ+o+77#;Diu=uy`rr|CL1if2dKCf>*h=_cl-rKpg{a_9Z)5!`* zbWp&Ppam`>oCUm;Jc-y?h?Bap4?2>9 z8LBE~Fo&3dXQ?f}KeiBIGnG6OSZ$%A;-t&m$r!jZK#shubwQ^}kgap0zj=rdOg@p^)a zdR#X=>m%x{N{e#4g^Y}&3oYWPY6=NAa72hRT~T{eL8DRyLhAb_$;+0@^?ep|vps|P zcn;{uH?7Q%6qJ?bb&2KSRL7?Vz%vvLP|J+GjKcg;fw%-(_pm=Rh%-;zlBWw;y`Z_G zy*c1s9NJZp5kQNh9Pb+VaPw=N5fQ~l2E?+;SdD)T5yA40l3*+%83$)E^KID-9|6sf z*bdSzq?=iDyDq+B0s8;yAJZEiE2@0WV;XqRA21{L>O8aT0rfp9kXQRuuW?%ErLer` zJ`JGCFTDqX%sm~*?Ad%eXrk!^VdR{06Ow$CUA*{6st}+kq-;INE?#^j&OW645%zCq z7gP6v5dX&?T3Yz%l?C~oeOKqo%isNLLj1kot|R^rzAO>{V+;D>XX=Pw6&o>rfij+N zp6OZGM7byOL_hu%3hEQq#5*~7^N8aT#x#AIq7k!CqC&JMUoZiZra1rORz0@KQr7i? zI6vlRvo9A=8v-(v#*e9rKcUyM=p~2juEf)C8CHU#C=8^B?PV_o2FxYNiXTJjgOag@9oOrm`LMgTb zksZY_u!sJG-r7UaTY=ts=xGlH7T6z96pNnr+Di`$^w4Xcp+r%nBrDcBA1LC$4mq69 zcjkTOd7qhoeEpX{UM>8nkp2vx$+JHkeDK#o;TKnjzxc1PS-4vN@5WkT?Z<_}-~Lp1 zB!0hHyZ-%mUwwP+KR;J~`{jq#zyIcDp>XBOPgb-qe)qNZ#pmDdZ13(7)%80Ox1z3m zOKn8V3hgerv$waSQiWbyx#LH?PH0V6XvI`C#jMn8x~5%Q+3-D&+1&BHIyqu2kS*6a zW^p=a9+&Skufw}_VxW?B+hzf(v4X&LY)ceU4fUL?2FTdU;x z$C{#{+;-@69Mo@jL%+vl0Ddc zk60+LchHwQdEmcvT-Q>|ibifcux!WUe$-thcRkKrf&{X?OCA%dH7IRVZjyC$lpV0< zJ%_7hqpBDca^v2ey$AP;#C47s*<$vQf0Jy){Zh*mhS959NuioScCEG*I-_E#J@y6x z%Ua-td~$LkxBaju_d}O?w%=l{RSeb&BgQ}8-}^*16Whs~;ZJ4135uk}+OEZ6 z@1bqw`2nm+EcHjaX4?L@-z@lIo|(#w`qs zR**63W6?!XyPqVqEyraosji(BrLMy#3sg+gte8cZ=0zj2{g9y!MN6_hIh7iY*J3ZE zx-|9`U85C6!+J6$bb(`XM_?lgSS9>bOQ$aOaMkX1r@n3Xe?U;qakwk0aRag}m&mj*{%bZb3{$qf#93d!Y6!?@oe>Zcl0>f`uu^S z40_!}84MRMA;Y4M`;!hG$z9HaiP0%qoHYu3FM@HgG>cMmz!|1r*hN&+W?{%e)SFlb z(-3zvdG9b^jOSFEJu2JpdpsO8g#YTO=9imjax&3~6Za=lJ*y{XdW(g?twH<&HuKPI zTnj#JitO-khxc2^Dj){$zSkKg)Wo|m+)LjRRc-b|KVa%@7P^iniefqh&Pw$sBC9C> z3=6*xP#g{KR2ubSn|Cq%qU6ISQu@-!eQvR1M=aG*79dCQ(j4Oa||ow zj_tBYZ4EFa$Cg`OB%e6EE4R9Kpia4qX_n08{Y7-(E&5A3ewcKgzbvo_N?yQ=gt^|k zQQ{VF)r|x!UYZ+~b8Zxb{viloW_vL-N(|ljLEeHr^sVhK@Rrdq&+(RI;0xUX));Rt zu*!RrNGSC3QwamP0C5xDUDmZGje%B| z;BBd~P=4M%lrtZ4=Jy@JPC;yEus31b1s--O7SEBtoMk3yp5T7_yXf#_qTqh}yXzCF zBU-iZIh?h~E=Lp>#h-Hw@S!LavJOaGLd7=XdK^AT5_T-tC+jZvku?B0x7>t3)=Gv} zL261N5yqCN0meJQB4w&0us5h)lv+J&RMyn0pywe=-YexS)m-nf5K+8(-;WyWUWb8N z#XUvix$Z&|KzQppmgq=INYhqFeVWHi$DV=mugXq$1FTj-XM5J6FIc@Ho*gfK)}%|N ztxZ(Dc)zWdm0DG)DTvr+#&U3#N^Y;6isceS8O3rVh=6{eL=2P`XyP)?Vz7wAyv)*f zcDe`>R>{WBJ{dj>xue?98l|C}kq98u!Uy68I$Qb(o$X!K0M%7!6;7d3h%8M+*ea#B z%jJ@l=pZ$rpOlRy&PJf=o-xj%FlzY@eCo)tAo~zkn{YhMD1xb`fg5Y z79camp9I3!kB&QebX<3v5D>dOI)?biV9G2+Qd6fw9Y`Uvq$#zUAa0Woi4m2nRX}2j zka*7^WVt#UAs@1n#%F$bghl|Td3fAmo)-<=V`~~9lQu^knum`={c+@Y1P+OYVw}Vy zslqi&aYC|NBpDhBG**Y7Q*^{2lPG@(6v&WdHgxea22xm42#Ek#;s5y5>^rW|y>xoH zAlpUVi$ON4HO&RuY7S@pd{PvMgB&9zauCwcrHe5!OvX}JmK_$F zT@KGi!$$decs9=vD3XV_tfH0)dW=PsY-qbIWK4}Q4;$|VwF@iF0&*5RO$yep>@aN$ zDxmKv_>=fZ!cB~dk?Lme=3ez?oHjM(I3t zGy{cF9CMqqJ;=Zzcg};_&=w+9IE;wmB5@S1QA+jn`ik%+T=|Gk_N)^Y;mSxO2yxXz z2~rPB$V$o3(?juutdzv{kV$Fw!S3Bn0v%$N9N-3ke-e?0d!(%Bt7P{PT_wsx9K3Jb z|C9(Bq^wo-s<=|p_IE7aRp^BkTQTY-9XDfB%)%03LTdAK{PqXV!VJHj&s4+|EpY7D zIdNIOkvH(0r5syR(gt_2g9u$Ut7#Y-{vkEhGz>$jmT9>*{sCA{${S`$F>2x>#Du(| zmooB3NyGcZU4ujbK40G0Vt&|}l75rsrn@yy=@QV2#9M@=Px_%o1Z;Zf58?yrJJb6j{5t&ZTSR!3 zhkKN}M@D9M7ZgI`${toih+V`U5tjud4hV@ErUCIdATbj6kvQ>K&26W5>Dll9&CT6B zp4pG7nw^R6tnhGqxY=*N{crpI+u!=b|M7*DFRkd$_rJfg@(OBeu57^~Pp-ZM$5nHmLM%X}P8S`!h-oI(<2iJE9*& z!}I5^`JN{`k>h(iqT~9Z#4QUoN+^f|-`x=d>!f7$WD7&N(&@+{1{2AXsM3!HZqXVJ zU8iGF`^pL3dHrPa?!euB+Nzefi_QSuRK~JBEPl1}Rld1({@gpE3`$pe(nG&@{r4Q# zwJPi7s>t89I*u3lVSiWbdy#YnZissa;$2az9^wCLL0rMp)IqenDL82mU}-0Gw*MUfZmdH`c|0)wKdAZlz~dy5V(v+wpokqW7LN zEDBq8T`Q7B5!#)8QtOW8^+uS>j*wpIor9wE)MSdbRwza)h!{zqYM!jC$+EABkjRsw=@1ldJ9jkS} zTB_BmTkC7Jt$L}}s8%eu++hT}PrW4T9x z?8+dJf!Y0Q^@i;PK+pLNuvka7Kd>BcX~R%jL8pHty`JMqvv$w-doJJEyng=N`E#_V zZ(&c*rxNG?nf7$~AN8J&>CaF9=C}XqZ$KrU&!Q5)^Nm+lz7O(1f98kj&UerM3-|c5 zGkg3Bdiy#j;0TyUag9IZ=OGQAcJEGO3)j5PR9?tN^Og%$916ZjyUX(ilW*O z*JTF{Y7J4_+G*5x)@tI`-NV^L0NWpXvUGSlMEhjJ?}|>}3PKsRMp3tf?Mq~W>fHfY zqyCPlZ*OjI&!r)?I)U12X*g6J(gc@jY6yU;8F{ zybQvQKl4KXzT7zfuhiqeeOvb!FWKMgCEF`x0Q|k?h3ogO9e(}(4G_wKyLYZhU&6)K zZ{?(y+dC)lY4)XMt4sblkdc)@D90d*Yo^6ScT4i=$T@E1-Yvaz1(bF$1O;uoGAB9; zoUPpcjh3`~a;mjw4P+~K?8x!Z4|fNf zg?gqq42bIYL_Yp~;5l8;g@OoA!$=OwVm}gNKX?*~_NfS|kZMPLDWbr_j}CWcd6s+n z9+h}9qUvH8_>tf7-B2+G+C4>a_w?XvceugZH?Hp=l;hbpBPVj@UJ3+e9Qer{-AcU=4rGk;$o>gw^ zwjJ9e&R)wz^;l2l&rPNlni~XPL7Pk28acHXP_`bhC|=8%a22`e`8C8 zqap1#;dddKQAO!Oh@!a=@(!f!SmNnO29BJV9j*U^D{sHG|JJP?@pjs&?aRjZDK8nwDE6DH@DZUsD3_0$3Zed$gYiYy`parUe4+J!b9oVPWKV* zjV#h$8->7UZrb+^!r{J|Kt?1=aj^KQsO2CbSLLcR2MXo zux{)`eQ}EgB5{StC;*xTe{&K$gvfVCkPX2I@=h@<`o&%`C|boq;eF@fs_HB0>R$UX zgx=h{HmJKYEi60XlOL58?{Cqk~Q5JCLEi3 zqqZ8uRnrh#Ox5c_K#=21@9BO|S~1(gZUV)-8!G}?yo@Og)6^W()W_DbrS9hTQhewZ z+rWZu{zAKabae2Gh4+uGKv+dtbc(%Q1u5{XSk-9nqL$No_z2%5y0j9spcZ!Fef?W> z^X+0k?yS`>hfqSJe6E};?ABW?tL(Bcdhueu-D*Fyu%wTQ{g(Bx_NcJie%ODM_FH(r ztuP9A0XYwvZ2n3RSf^zc7-)Ls5DKm=LxOTsyen1 z7PSJOurHzLq5TN+*|A$WJ!Po+S^R@sz^*akX>^`C8%iTs%zO+p}G#m4hB= zK~N=W3lxL@JtDfHSQp(qB9axxMc5*P5UjWd^-%`N#StJah2=U{C`MjV?AX|1PWM!h zfO!;IJpo1I2+PuSdP2dhj624q>L@OPei|@S))io!0N(3gYOtiffXu~BIxcj=BXuv- zH*N6tNFI%_%X1pF1b~_B4$LawYgKo9O(#aR-QMf37rOZls8NrQ3}_tV6=UwB!ZW&u z4bXym4)WBUAWyk?=YVvTXYZ+mC|#(=R0%R7G4;X8&~urFFl*OnR;t4e5OdvKi3iT4 zcgb^!?8ya0P6FEt`GlrT>|7?zDSY%8coXMy%WMrMXp^SAT6qvQmW1S368$ongCMGh zLc*0*u_N@@$}EJN)E+fQflGDbVY|MvSYf_VpV}uY`^;G7>`;yvmGikl=SU9P(mo2E zo;MoiiXwL~YSZ%JrigqYVT*vC2!zk2j3Fhlnl3YiCG5Ow(pMfxvyy6+&9-l!8l0P( zy=5J@L3uLDgzX%|erJVYE9a?V^;PORC(NaiU2(&MLXi_{q#AK);Y+CwJVNmit_cXV6$PXj%#DKtRq23w0A=#<~ zxU$^*L(;5SQD8L?M}vS@05*yYxZ44=m_(+WvBtV}6M`n_HlUtr$2p~MRAS+qL{Zo8 z`Q@S4o6}RXVod|LSpgpHDTSH#gUB#EK5}o6!vb(2qsnVI1;m@JrgL&Oe?N44YH*4 z(~Tz9wrx4UVr2wK=nwJcI%>n>^(43Vi=>)T&6hUJ>0*%9SeG6#SOfa(x`+-%0Q)gtCjPi=JC$7iUU;Ie5S)vC$bJS+JC0*HyaXF2H zlQUCYlt7M%_F`7Ioapwb{VC_vtc+mg)mut`&!b8Sc`=zVHJWOWu+9t#o2sUm7}rS# zp`-zW$dQ|)G=?E@nBlHx;nZfGz#q?`Sj~QIkBzmVGS(WdJuyg)was=QDti~L!EhG> zb3kH|MbbR}g*Zl9IpmjG7LsbV$-Ed&#|LA}8+e4@?F!wh~$?pOSDVOSTw zXBy}A6KBno8Cx=WqegtGip)8N$|EZPBj`lNTA7s+#6o$}`z+9QuqGLNNd}w90r6If zg|SR;R9SJavu@qoRC|`!*cJ;-R`#q|f+NwXmGfaaA{mPKU|i7gN3b`?Jky{F#wFG6 zS?@uT&9s5J7{>EJ4*k$1CTYW0(}vJ2@tEA+0lJz=G%kAWaJakp->JDaUoue70K3>J z@(BTlo&F@$FuRE#GhxOG%6-=YMTq+F0Ff5Y(wDHhWC9>p4P?(q#9DwKh{rJ1iZ+|m z$P5mX3dJD^(tN0SIYT%T+*KO0U`rkO>Cv|XGmFM#7@MUc{S@PI{8&Z~C+yNw z3%YpyRq0eCU_o}%L@=yk{u2x@(R zxg@FO_HJ@RaXH0wULI|%y`W8Jc^ej52evdaEIkg3-N#|eo^2cm$rxH3wkrQwNs8r2 zhEd)wYxTKsi5)hpJNy-{?vkC)?Ca|3zMaRj3h(nnvKHB}u=_YHW62zwE{GHlUtfj8 zVu*+f;wohmWN>Jb?2NTq-NlgSS}N3x3cJsqrN#=8SYXAfhVvL56?Ui9azZbILQniO z3ARa!HNEbFKa9X&Vv226As#nHh|LNyH)~9=wT40cc{JdySG;fx!bc7#L}mD%a%yJT zt}zMoa)RqFVK8UowB{^0W~9^u8y)6&KUy6GBiQ64p5RhE8Dluya$>Snhd$F!AgvG# zdQN?A(+4P(ma7KEcA*6gxRJHcJW+&u(jdV=EoDuxR*puDiVW@QPOn@h@Rf?tOpy#pANp8(!-uv}~h zAD#yUU|^~|Dgck}k@aukfT%xgd5EVYa9O?#DFVRQUS%O53JG}veaJ z4Fk}fd7;G~)KGa~AwIxlwX~~PnE`G%1Nm8@o7Gcj@{=EPznyXGP#0`9%;;LFwij05 zW+8*L(zWI&YHV^;5pJ5fPL56gHn^R>WqvOxo>LUxo>~hN7(XJ+>u~HZp@am=9~AR? z04CTM@UyE;>O(7lGaIG{fxu87`?!lRUgBSdWnwWEeE~d-K(>U3Edc2h4wYUW13Lu0 zWPSvrg_MaU4=-kK!4SmrC#7N%J6c z9SRi{H<$n|*vN!lbNGkGyamN`ihi6p53D7op;H5G^83Z`o($#_(i1^Y2=nq84ns<# ztWs^K)TRZP`oqL>V(Lxuw5f|ggJmXDBqL!Q9J`cojs1~pgY6*Df!LJNa$p_-N#vpl z?QCg(h?`(a$I4n65$sTKzpJQ~Z+(ivjY;G`IQR_c2O z)^doIQO9POKPrWaHiI@NB8DrXm}jLGEd|5<#LXNB^piIQ8YF}O0;=r`%P#f(&eD!_ ztTjbnBk&H9Hzd8BK!?)S4XA5$VlG_Tl>vFBnd8_O@ldt0K+H(EVD9c`1@}v0b_A)@ zBc^D}Rjiw=G4ldLV52>mXqe0gO~SZ<#t_w>!_zcDUr;=!=*Nf~-h>xq33wUAKR_!Y z+_|TMj>kZd$H5zxZJADSST!~sSv_!2ln<%`OV}2DDeH*TYpuUufI7yI`_W*IO*uG& z)e!-5Z3{vMpP(*TB zJU}opTA~Xwu~ICsF$bbvOGkO-{=OK66jUlt;6PSdAk-d{*_~bzUza!;%uhPQ%sIjs zWQug3&&zULwo6N46{r#EN?iV*aWhC0-*c%!AotB?@)%> zXjr`+&2Kd#1XWQ~cOMJ2d=$;fG6elx47xYTSq#3z$VeUxtz;9&x7xsWS`0P~kcD9B zA{!!z^ayjp3*sgjmcrA)5XX&_xft;uv9{}YOS`mSjwgErfgK^&Blt-dgKs%tUXrjd z8X{B!qhG2O6K9AkgHbJn&>VKIv2Q`~oT48mL4d-PmUDq0oK_6#7yA8Uj32AgF?9CfgmC({Uc#h!P~?Y!03jyfJj~g_MHE=ppb9 zu|uqN{lQ*k+ZhQduIcrQMMx$G$OA;Gakd;{cyr0x-cnG3Gv^{-Mv( z5uli{#C=jmfxr9a!W;$P;v5AZ>x=?vj)Lz}jsi0YM3SSR^5H8hzt>pdzsVd0jo&{1 zZ`9*QuI^FgDEO|*QGg^6_5YI1Q9uBj{UP|z-?5Of7?o@*?6-X+ky(s8%h}Z#ObK6) z9kU2vf;F1X)PZe-woq&!ALeH_ATq7sn+pA4>Eh}`{big~wb_P1u2p`3VGD;I|0#^$ zA(T-vAXLiR*d z=)#Jh3-`Jb$K}8fOi@{YOQ6Li4*KDJqfSP{j7^T%g<~RGX&RXg_W*Ct*q#Q1fHt!M z(4TdhFNqBSO^(>(ibJ?(&@2yuRSW~FzJylJ;U}M&6X_1YrwiFjk5GC#*jQ?tfv{$6^NdJlQbr8q%*bS2 znGOXZwa#m1o+HR;B#Fax5(iB{f#9qF*$CvMi{wB=AL1qg`t?CmeV)XO^H$ELOHW&` z)z?yW!iAM5xA$uH#*{T#!7;P%Ojyu771U;6m058~WZQx$M8mcO(rt;%DF6y>PuyR0 z4j{LegxDZ>Q-4xh6szQTVnP90kZOiP??@^v|vb^yOXlq#z12fYgYs@z7d5S;!!iH;5_+6Jdsj_${)%5r-|25I?=Q;0-)WCo|hTHG-}+^@IT9#PJLtl{q;Y*CTJMj*%kuZLTi?wrsMa zhp@wgzhe=SK%&oY*;U{zxuA^x*)T5@8q8Z~3<^pn4)TdN4(`1LKCBY;sIfNZ+Z56R zJ=n^$0tgjjS&H*YGGxj7LJ?P$Oc7vs!>mfMoI5z>5dduAGr-0{Km(S72`z*KiChk! zBLqo``AE*%b$5WC#F!6mmUXMh;$}Fh%+38KhMTLpMn`Y zcP<~&)DzSrHe$9TkoU;LNmu>~VXi}FjJfln4pKy=1aR?zH!vK7|CpC_W_)3P@krEp za@AdY;+oR}VErhk7m>(Yi%($B;LtSQdAALKE#t|bX}W#)HgCrev3Wq5-v~qTNj#8zKEp z1&r$akV^1Cj4Wr$h1xeQ*clU{6{L?jx--jKsAx=3b)^0^yIZpQ{B-tRJ{|cm5Xbnc z&-xMPM`F!1bt`0v{fn=zZSM|LxGwfu-$C#goE=CN4S{C>S2C}DhKbW=GG*0Nn#=87 zPJb|`T-Y#{gDY8i_7a_tprVc>#svF1#UEj*>y)lBTpjIz(%3zun^2(5hn4z3OFM2+2o$7WphGA)e&ajO|LetGv@5>z{J$;4j}!x@ zCQ^XY|u>^;QL=?wdao7Wt$@_`w2sI2@>q2DZ&OD2V6ST_8gSE|@s$G%%WL(pE@f8sXUAfd5$e7$`H6ar#O#^QzqBt@x5UPoO9I;kTZW6F2TD@-30eQ z{2Fz<2V$$S)~MCDx9evheoTcjxg>s|3``@P{{A5&fEgJn#Q}uaJ%PMIs0XV9BAs9Y zM`S(>MOO@)$=xJLkaEa65mp{vCWzZ2mbYi)(wnz!=k~R?#<#jzTuSc~E}8V|E=*6O zP#|Bb^&UGJe-77F1so>IdDYGj%kHqwR!YGrnGz%15kyDHh6693+nE z*8)rvSK@{5y4&Ml3Skg+6k_o(vjvlwW&3vT6j^SNzmmkS^w$#1GHRO0wF#u!s@2!) z>+2g^NKv&=7<+-prRk6Uo<)b^dlOaYXQsBvKeMXq3-L}&q){ZFDfvD5#Ll=6i3%oY zoGXDl6sZ|5Vd$SCIoVuuO@ek6%1%T19w@V;I`AHAp_7LSGw0w@Sb;S%g6kb=l#@3+ zaj*uTKD-XI6oqrsyF9pB5e8V!hfKyVeq!u7pxk6+m6>5$G*@WuRCrzI#PP(*g~&{1 z;|(WxDFFt=U`BG*IA;+E!c6f>8KW}riAMC|56fjL0IQMCmmz0+y4mN-;xHCG^HWc(RTsw$AL78-%<-@%dMqLIQAS^IWvs~HvC-*(-HE+EwaMuQKAhd_D$;p-P*)uH8s3&M6bGCMnauG6<kfT>OB?^I*r{i3b)Fnsg#sQ3-o+Y33U$U3i&!Njau!s zP8H`<)@qwwt5)r_*SG3zx!I|z`Ob-S*&NxlupI;;1`o~bHD4v>-VSv2L$czqMk`mXE-6Kw|3S`#xQV=k#In$Ge zLk@_BBWQ!)(X?k!FgRnSOHZL;$Y(9d8IJQRR8&wAeX;sg97eOaoDk zR2%H#Itn}VGz9X2b!6Xn!I4`zL=ocL5vSOWPd6ZsHN8v;PLk~45_Bc6B_=`{_XSd^ z(J4{l2{_A$BkmM|2xKNe;LHbEvGLj&I!(yReTg^+RYqQUXymFoHa2X8FqsmTwo#}u zfrr}7PY>1~#`ZYzA&`sXrFU>@A@p6G64*sNOc$@cE8)d8)#1r58R89)ky}s$s(myU zp^r>V##tD46SZU3H* z9+pwpw6*J%)!!y>RehHF(jCr^G??sszIiKo1PB3`9(e=V+60d(Jz|;;=mz?`i6mVQ z7~zQ%u|pq96Pjb|ByThVxZw#UvH<4C@5s7@p66uuGJC%6GlTOe^At}R)?C&S3{E>5 zp0TrZm_vRMAck~cSqFkFabV16>?Ix&O9f<2<3ovP9-guNJ%9quy0KRzZZ(sQCXg`j z1ee)#t-8|WcOo_tA&dMS$Lsor2Z1siU|0sJn5w6G|b^0@fKJ%HzwlHt&>jlMg ziss!mfDvzo`FYgMokJ$9(Cb1Ztsq|ID1R7ggAZr2Hw|nz%Ouwgf)Uh58GLWmBvO<)>rk0vmRR~lP~6@dw4woUMu&Q z&P$x)&2Ke&L7@7j-$4TrM0J=-Aw1B1uj7t@espq`u$**DJs^>XSnH1qMG8>DiC(T~ zgvvsMqo|P(+)GlZ$K2spDrbG0;^WDeDP~_hKZJ`Wl)ILq$ zk5!m>r_C?mEmj>1DI-Ja<_gJWKKteyA`wH%#e_Gr1|vCrycZ~k-C^PF&73ee88$V1 zmcEuozwRbon>gSUZAp3b@xtJb+>=U9=prCo*B>VAbVyq_7GNw9`b+$Z-fXQRtO0m$TJTpuLKDR2_%x?JGXwi zs@-;G1tPT6-Bq{l&pGFw^WF1P-~XFG`@?IEpKTPMSFak4H*oX&UwiAB|GkCA-{G3R zUl70WgYSg9-)^WHTSs{;|P7?D#ayxOuK)&k+QJR<$ zw@*c437)(yWBb^R%--!KV|mqBT3I%F?EQm-C!L2PQ-cA8702A$?Or2 zrAW*)8R+ZNe!C(VCZi3uetY?rY7K;v;s!evBGS3%o{8%V`yxIQ@dg{Ffoq3x(CMuk zUE;of-N8JUha zb8Vrkn>KR;H*vYAOPhPb>|HV$Pm@s?SEhPW>Q`k%#;;;9qrnl+~cL33X>t944V1dXjnWsZb`;W_y$UFYc-V zPle-3Bj>iCxQQpWl#Yf88-!`#^gCJO0zR~r^y%Nwb#^BV6N$AWrt1|&@Z8{(#lkZ+ znM^z(M?zq;MzI)}TBif5oPZlvG1hhhvcOK+(19Hry^byAw9W8c^pX-()=9Vzond?| zWax`IRQ#kx2Nx|KXUziw`CLtj&UN{!<}^|(}-+|g#+jXbrhcPfi$GP4)dWJoPC&z*cCI}(f)sF z`{|>Hj~;BWr=pzH355(6Geu?YfK9@bk;N)KjrdUDjDT^fAvv;_?}xw{3}U~OOfHYS}~S7MFVO2CDh(H6oKOoj>y{TW^gx^N$4}| ze@&!iCuOqAE^~{J36RKE%5JN%m#Mk3cKpmNc>jMx-|vS00LsVtC)etSI4o+c_A96Z zL{IEAVK~$P&vlMnf7lst928+-;77~MM{|9sX6Ia2Ln_jp<(n`Xh)Q}qc9Ri%pp2Pq z6X-&qb@BIS^^LLSAPv+>+;rQr9kz$$!Wln9WsA_1HSWp}lxy#+&Y8d}Pwk zix=hi*7M5lHtC`9q3UCN_~OOkQOk%@IcoBFm@0d2y=<#Kp4odRfH{)e(QIvU6DSnJ zn-V*j;WxupyE3tl=R=X?59OW70UtiXF^q19-J?xza5)KVvxh6P&f%tSL_7w7JPI9Q zxB;B7mF}(H%2HSFQA6GDqp^jCXG0}SEbBLfJ0Zrk*{29n zj#399tO*#p=blGA5MEs`bL>(mttpf~;b%N+)wZVkFlbxQf`8C*f$ z7HzjZ+{`3}Q!rb>v^LSpH4l&QPmYdRss)X3TF;AnHfUPyQ9hYDG9;Xkq^TKNYjepo zx#1~C@$I*pmT4VwZ0S*ZWb(t_QESsW934&PZ9TU#jY2E-A%G{-+>T>DF_e2j>=_ac zjxgYFc~iY>cU!I2%a_EA4YD=(69RsVaI_nyNuzM`IPc=op>qU&HXKtcxYRan1J5J4 zZ^Z>^Hd>Q#KOygFN*-jVv`U7%2c!0x~b)i7qh+GbWIIz z8i%7y-X1VW{T>q%WydQu9uo-4{1J@Kmv9$`F1*LMyg0_*35E!OOO^)ZW7mPvx`PQL z2lqJPLx!;87#lrshb-F#11*)yY@+;;8^GoWXo?Ozg751TcNwu1tN=LkAvT<#_&95m zMWX}%BN4|ba6>DUl|h)Ly@9Ld(Clsw`);nho5PzoTZ5(zd>fM5!Z318Rkm={dP!|C zDYIuR0q_PhfT!iQ2rx9}TWJY%H@Z2_!H*@!!#|G#Poa`>KMKXwmy9LlvEm%x6j*RB zf|lzNkcul{Q^0;&%@QSNut0(RR6Yd_3Kp8$n&4vf)~e<7?AvROwZ7E7eVgBQ)~&Vf z?Uh@%R;!{dhpOFb0xFfaCdPsgv3lGv!cjaVU0Gxstf0+MfkO5CKu^Tp)F&s~3$qvq z{3atBU+(P7$}ZPQIaaFN)O`C`_?B>vr8^ALNNY1~KecH4(8!XI37@-&Q=#zM^r)GF zc7gN?vq?Mms)(%!>3614ZQlx=NyQgX!yfT73s_bQcpUeP*&dhD)Pn4B_NNcrbK&So z7(r4rOm_nW+!C>F90Jv-w>wlJVI|lkD*KfwVS@<=V#YIlX8Yw!5dCxes{U4*B=DRv zJRZ!t)lXmIa4eRRu^tBA zMB6%0i;;M8L14Gg?=`0(Z%v0>m2dwV!wB(z_vfxe{I4m*|8X7hfA4n+#Q%%`s3U$Z zx=%{TCmPo8WE)jc#hPG|b*XKjg{+xV`n_|srWoCaGmMh}`&h|(WKmWp4-m**_QGLk zM8WWqnfe`mal85*Xz*5+CLl{I6eZKnn)#H}RCInut&keZ)Q?4}=jpLK93_`glX?|# z6n2OCF6mFJBX%gp;0Q~v=&5@1Jfz5@dPn#WPnkBN;{Z`bZXm}NvSz2+);)BZE2xtD zj^|z!WBK%dL}8t{j)e`?w(j8f{|iMpKMj2oZVVq&yKuFf=bSwg>S2RG1@>51eE0rKT!9E)Vshng08o6uIPTOV&Cc zDN2*C9<_4^lm}!DRx$)4#6SPVD-r*<72^M>j`-g+3dH~0^E%>Rz%;dL$yOGMR?lw{ z$6>51e+itz&#vH0wO`3b<+`MqHFbp{a&qG=|jN=Kzc{R=VQ3fzZ z&R-x5ahT160EuNwWVvMnS}|I=WUZ)J>Vn*elV@2n)r@NG~AID)ZG}wKC7=927j0;s!0u?BhO3G$ZvK{d*qA(v3ODy4O z(j0l7Q$@CJA|MB_i6kfjU5AZ{Boaa<-SCu1fk$hUI#cDO--#}h#{6~~ysxB=Igz!U zpz;A#Iun5_5b1r=RVvE%6Q$lSJr64h7{0o6eT3^3-vbFUW~p#BoGH0s<1c}c%yKVC zXHN4>Q{^_ltX3>4oDEQX5b>BQ7dB$n3-0pkm?g=*+Ao_^9|_-A8nxn> zD;`5C*A0rObRU_wA<{djS;!*l>O??`cT>|^w!5&b<=)zW_qw*Vy1rzIHM?uQ&HZQ- z1l(G)#9$fGr>&u?fSMafFz8Ge4+2` zZ9m+d1H*K(0uo&m@Kh)$83Hs)(V~PVxJ2QFN-+cEXj9Y(45-4n>!&{J=}TF_OUaX% zjfFU^8+*T_D43zDVg_@F>8mPx9v`Z3T4P`@MX*|IMaD+~&3T_}7Yim?a0qOa=V3$tm8{9;<#!G3Ab=Wh;viZds9K9QUyZl`=-dt zmdo{h7IU+h9_Hh_pd;V3GCxvKR+`rpmWNXvpBezqP}D~)GxjqI^G5~Z5@_vUe`XM8 zp12iHm#}(Cb47b|z`Z=Qt0E(S7DqYWH3;D5*El00ijNA2Rh6+C|5_r3ESi~w0 z&SK^}su?~4njx`0q+Liiv*vbPe8mFv|JQ#)Z+I;0>NSsP;5~o9jNGg9%(4g6_o+Z$ z?NhzRX`PqC@}37YfGWTA9tbk`bRe@A^XZ_8rV~W5d&X@@@=12_`Xi}AfTEDLwVPeM z{z#mCNckh|f0$iN-3LN^_Dk0rpS#vj-`RI{uD$t{ZxG^t`{O#|e-tRh|9r!|`zFq zRz0@KQr7i?I6vX%vo9A=8v-(v#!skL76@Hvt5+|9!v3@!Eum48K$?OXu^)h)WCw(V$d#F(^2JC zW4Lr>;R`}tEsx((GL3+e^Pkk&jRr(WU08j||7yaepZ0oMSuOtcBBev5Kd9~lK;8jV zI+p1U-#ecM9lZGi_}f&UGNPsMn@sO8f}K2LPjE8S!TF5hZRu)0DWrZNte^ zKNAPyIu>z4*OQ_oNF1B6N{);(mX*m7!L;%myQf5KUd@mK?3-mfCw2+pkPzTl)ig;F zHao-)j@`%iTXw~;(r+J{V~0#SV%Ev$da#)_>=JRJd-Q(3n`8S72hLOFf*%LFux8je7?8GOsap<4WGR9N zG@WDPlf`kHlw_=z3EbO`)ne0oI}I~ScpBQaaxyNK$8zJQALorp-pG(>urm@21fYs3 zVowmLSEf>`D;*+*jFXjdP>Rsf?n|Zkq-{CGtR^b;;JlS4(XpIm9(HSQ8+pPH7wIub zOQ~9Xcw}&3a5pWolF+rGn39OAeK93Z9K$t=Cr8TT6H%YJXpRHs`0(N?>Z`l7WK!8V z$aniInvcx8esKx|HMRe&9il$V3zbD|e{kp>+7HB`-C^YorQ+0OJap>^Yv+(;` z?C|sOhM&;)>(hTnoE@daS0|bh+kx0qBVJx2Zaq~eHg*IGf8Ol&*xjEyV$*Txv1c>w tjCSQsts_1_M_i^F%^!%%{zBpZZ&8g$w>4;d23b$LS+A{WyaO6Pd1BgNbAdSd? osexhoH3n7&#*) rK$?*OQv<{FYYeOmj3ueXB_LCUKBAcl(ZPh*REW(8bAfJ{1~(M|N+uXC literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/icmp_2_pings.pcap b/packages/endace/_dev/deploy/docker/pcaps/icmp_2_pings.pcap new file mode 100644 index 0000000000000000000000000000000000000000..fe30ecd7c1cb1154ca50330d2684a47c0ae03cd3 GIT binary patch literal 272 zcmca|c+)~A1{MYw`2U}Qff2}IO;rsu+{eqH2V{dV7%+iJMh*s71_lL?G6%-ATUc-SR-YnP7JJc%$hi IWH($l0Fta8s{jB1 literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_counter_ops.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_counter_ops.pcap new file mode 100644 index 0000000000000000000000000000000000000000..0a837497b95afbbafd172afa389ba11efb9beb26 GIT binary patch literal 2149 zcmaKtUr19?9LLYS`{QN#=Q=0uAu1mbGLKO+<~9FyMxd7_xqfCk00WT z4^(0&Y$cO~DDcH~=37viR7opbV`=2z*ArFGR*u~~wMQeT38{S1OBQUn^f2)D2#c^!!WmA5R&8-VTDHbCCkA5LC0 z7#2p}28k0O(X;c99~p_!oDxHGNL)RemFU$y z;ToQ3I5Q;LQk|zitO+wDe#$Meg-XOXDf6wL=$|I}7~CNc;`N9*Dq_wx#W`io_CER-#ugd6dT!jeM(fTgE|* zrvQe{+|T*cwNhcP1Yz?a%#XqrmIPrCmOAXUbQl$;vSVi%5_cE&(u?Db6$<0|LD)J7 zbMFjU<4v(wSD8&8JCd-#_e~`B9?DAe>h6&So@jtTYgx~j`A@|ONxS#1yu+m0E+MId z_FfFVpW~Cze@iUgyY$uv5^dD~s^EVe{0GthcrWLFDwLylOk%xDNxnooP5LM#{h&$3 xWUJsBpMthqW}L_$=WtBY_&F3?sZ3fV^BqQQuYASk4^Ach3Tepp$5 zLc}bhMO}>YqHts&)y1|hV$s+t2(N-}qU|Eau;+R8Rp0mMI`GOlD4*~5`Mj@ZCjTO> zf)4yD76BA|Sbyw$G`~-W9=xaJgzeutz0W6hUpcVa3EcqU2l+6Bn;ss2J2tTu*S1;H zKbal+^O8v8YO%N~2%zeYjG}1{MRB^04DNkH-|1?JzT=P%NAZ~!=TZiv@5cZLHFa$! zG9~yYXU*Z%lPD%+M%P{PjN>neuB%R$vf=9&qGM7s^(Jx`Qfb+G2R@{z_sD&zcLwSG zmSMDo-DsfPm&io)Bk>&4XxWGZC!Z1VN3<@{G}WY zpW(TD5}TtyJVB1$Kb9QzqoX;?fI_dQl*|2a;s7SmvJoTkYm9iWF42U-)Qm_>&{5%6 z?eqF8h`P>1-IYYeQ2nBXqNd*oqH>AqKMc=pHH;_mO}32{a4gYSo$bJ8O2ucA|RYH<+kf zlBi^MXu%*+KQ~IEN?~-Cv`VZP*4Wjn-!$3n4so&t16`%jRck0FPDZY%KHq1X{m4fb z5r_4(@yGO+&xw}n$Bz}{rzayzn zqk11ZqbDTw|LML5N26u4M|3DVAo^1)M}lX&1w76hY9UeoRoJA~TSn zUzt!zL`Xyqv5*ok_(LRr%pYEI8buU|6cnuWzGpjU`@VCwpMCJobN0#eK9|?;bK?EW zM)ZZR1Axdj*eQj0e?{a{M5WU3F24STcn>sk zylseH;gO__krs3y%$JY}(KHKi0nw;5h;_Md332TnT|~2#v0!2mJpzaZM8ai~%?>@Q zpU!P()J5H&%trKRoGSLNC#P-(IHxMmDVIkAzwdUayW$cdKKlr89Q#pe5Uac!WW;%0 zL^JqnFfwvTL2ROdQI`5FSg6woc8Zq!QFRG9)afa9 zik(UMYI5+8#Af2i$4uHVlU2httb>HOfQawVIVw#iuX4r+G25q$XqHw@23bT;x_Yt* zQO7&DaYGE}BSKOnDQ6+GlN_~E#O$O*?QCP(gwHhEze{MBnxsv3VxDP8357Drc>-DUKcr4{A5 zTuQ0LKD?GG525>U^8&zS{EABBUW0eD?A{>jp3A7Xw;a#is582uDdJuxsNo7$1c%sX z+*#xhd&;dNq}FmwK|FY|FZ$|EEgX1dq^U8lT2N6->uASp%KOy!N=pve>wEZ0{qDS=}osZH% ziJywg{n!KQ^!X0g$%ix4>{*H2y=*5!{20Yu$M-_n_bJZzX7qiMW~llhp-=X>s#oj<#; zUkvq&UpJLjiE* zc(xFk6dYqya;(sM2o)y!HU>+lded~XC|QM~@hH(zDVOrz-eCg|QYj31J0o`}@19$_ zyeE)eugG%2`OE0QpL~f-#2rXXSU?Ru(en099ud#A{*CB!utY@wNy6MPJDX~@dYyS` z3$(VKX$f@r`QZ+52e<>=fi-b}I==%u|0qr@3Vr7nhfMpa^Vhbpoj(#%XNg@d$em|9 z|C-ze7v&D94$$wpER@-e3|p5o{FSz@=pOt%XK!8g-L6PTk>O_$cRJdQw2kW@i1RA3 z#z>4VDzYG7@*0UFn4=HZAqqo|4dJ9p+`KH&F34YsSYjuwv)Wm@7D_1h$t*YY)eX-4 z3sl|J!)$d&7qPniv?-q5%T_lL8?V}+8PzBZ#1qegM7(i(St9m}>S~s#tV2lpNPrzk zJKBawiuX|QDek5edbcct;cw(tUtH&wzuPrnSJ18JyLE1%V*1~JWX&iFC8VsW@^a!1 za0j>p+=10|fI9gT?BpKovlNEe;hbrv*%5fj&W-_ltk5^D$m{2PV@tE6LVIp8hs4h~ zHz@S8L7WXQ&}_JWlbsE|X>B&d@F`68v|qiuDP+Yv`?XGG7T83si_OA zDRHXQSWT7JGJC0^J{#`#6ES*mS)yHr$@eT#$;C3)j!C;nKO1$T5_JIzgOc+|f|M5O zbV`-6Ld<=G3@4MU61g#)mAk$ZKtuSux>IjrJ3&(yc7iI}5IzdI}3b}tkr5ene a!jOCUr((*zu~?UT6@D3x;o=$m0q`69%l6>_ literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_stats.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_tcp_stats.pcap new file mode 100644 index 0000000000000000000000000000000000000000..35be732dcb911f25324c768676a9f88185b367e4 GIT binary patch literal 3942 zcmai1U1%It6u!IpX_}<%rZF}|LEG5c8XL0H+06z8V<8Vp=}*8u6w5G~x!WB&`{T@= zq-hW~2u7nt6nro?Mx}z(3ext)(xO;Ip(qIc^ueE&pe>3ImbQ<^bMDODojbc52W~pq z{ra8neCM8XZ@#~L_Psc1CgNFHAtVOBY#IOcnf{+!$XM55>10dOGDi_C&C2W+@%7!Rp4 z$k_Q}UB=!-&+_jwV>w2e+JFh3_1tX#z4G%Yoz^D|jQesZlNygy_7-~d&54Ld9rLAI zt>pw+{^GD7SNJ0s4?!ecHH>@M0%v4(8GFg{XhLS3#jPTq%6n`;L~2}xgImzEznW#w zZnZ)c`gs+)WzUdt9^8PG_^PSGK5_~fM{{)vi54Q*Z_vDmKzgnY}utBF~Jx1M-to&mW_dB z-DiKQBzQ+`+*g26l)J{VJ)6!U(G2+)4_%(ulo!&0_b!RqFDNb|c4I-5+GYQ|d1~RH8gb%zDv+^{V*|kd<0Zd>w zv{*b7eJ-x0o0v#8O^5# z)fA!uEGo1y%xid#qZ!3Qff@|*a+8Sc3TW>MBUzE@wggo(fb9veo5I*Cq2@BjGnnU4 zH;Ja!wE(`P&LlOptm!H!Kv>@{k>*Y92xSTn+YsRbBBcPw+CW$hN7nY-97bt~U`5a1 z2vOaRuny3m2+3QnOWjl&FrrLS-A!s!Mgthi5p|dLTY$oN3fe6| zQaGz%I04ZxU_@S$YL4MFsHiTDNh>sAdn6i;;WSuHk-P*kbT^chuyAeILWCd*hH1z# zp_`Ms-4McyRACYON;1!f_=N~(By9=ZV>!*pn_Ns?UpRs~PSKGBSLYCHfr)8GUCp7o znH)(DXV4r`b*Ybi+>~Q6MhnT2^st%&==xw2-5WN^w(=HiBmEfvKk4D*P$t6%#D)MZ z3D6CL!jvl<;VtT-05~W4Bek(@!B{A0rsd*LGPQ!2M{7hswS^V1946%YLkTDOtE-+u zvo@X?pIwNY86#aY3zy1?4L3h_UuTPWHe7jBJ{uM;iL+txEBS2j z^Obr7N0BydQQI$Y-65FM-JDh`PQetmVQ||?Y!R_9C6_sp*CVB$Y7qw5)E~e0RY)$seg-cti+?dqwDyv&1oO!MyhexY)+h!0`t- z2l*4Su5wUpIj}FhLY6WkM@>{-A313mEQ%DfM`|&ONIYE{HlafeTZbdMaWuoxr)(&Y zgcOI5)HedjGu0pkiYg5?!NLWlLP|Ttu(J^>&fvPjAS2(E(&^ Ptn1HfsO#YPYP$XdT(V{t literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_counter_ops.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_counter_ops.pcap new file mode 100644 index 0000000000000000000000000000000000000000..b73c376f90a5ef0c8defd3fecfe5ec335a2e1769 GIT binary patch literal 352 zcmca|c+)~A1{MYw`2U}Qff2~jH@+WgyPA(749Esy4hHqR)*5T}7?nG6b1=9vFnHWa zXJBv;T(aQ6ian}8toCz)_Gt!_hH$WUMux%$K?Y_Hh_O6iF$fz(GJ%NXyb=SDE!Vg5 zF(d-{AdF#4u<$mJExGO}w%C^>fXx8eBFexl0y2()K^$T(gaakPHi6jxfdFVD$if?V hExfM`vT)%|Gz+5`n1QB%EEGes5F~~QSYceKg#hyVOsfC@ literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_delete.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_bin_udp_delete.pcap new file mode 100644 index 0000000000000000000000000000000000000000..a375a7d67c9dd84da4a0b9f588ea057548806478 GIT binary patch literal 221 zcmca|c+)~A1{MYw`2U}Qff2}=qH;g9Se}C+0>}no4hHqR)*5T}7?nG6b1=9vFnC#g zXJBv;bmKp;Vvi~itKFTTeVV~c*AlE9Xhee`12YH2SU#{AgbgRNQ!5jbl0o)xC~z?N p0>wcX!yfxnp&)y*9)yK{d1(X6|4hHqR)*5T}7?nG6b1=9vu=sHB zFfcd>mi#!dVvi~itNmN8eVWDM`fjjxpb-s%3>+L_V_5{iVlXS9bV+J)Nqlx{W#T9p M4S~@R7_lJ$06qnu>i_@% literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_counter_ops.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_counter_ops.pcap new file mode 100644 index 0000000000000000000000000000000000000000..cf9c7ebaf41ce88f28221dbcb5f17c7c94bbf835 GIT binary patch literal 1778 zcmaKsUuaTs6vuy8-E@X@m(vMRUV^nX36>c_CApQOQe63G6h#m=$`@hgS`P(6Z#}eL zg1rRw5G?3nEQ1&_DhDkt3>Izqk}reuF^4@Y3_Is{@6G-0y(%2=a^Z8nzt8WS`?a|6 z!az(!`867ZaPVM?mJ`8wjzr);mWA|xKRNKa;GG`cWg$UA0<&8I66l;8ct2O@gF0BU zd&Fe<%{r3i4UNXn6d?vvN1ihpJ2=i_J%6p*iSJAXiT+`cBNyNqOW|Se`$>xElQV+$2LTqhVyhw?wxKKw@hN#ZO3l5Yr`sgqd^y ziDn#wn-j8xW6iv6Bt)r%HI;;VvYaO

mm#V3w!0y@cgDM!rADM$QwE(4Z1v&*fdC zkrfFcxF;-)R{!UFNSuDDO9Tnyhgjk*Y1f(tt^gKGvtl7JMhz5H1{z?X3k@Xvtby_2 za3Ux#vb4s*h`b-mZAatGbv(o071bHKY$dl7tn}FTv1dRlNQC>PrLl6t*pEd2A6=r0 z@A2$qiIY>QtfZuUQXzv};jN0hne0ITf-*PLuo|TQ`tdp zIeG9PxS^;A4>E_l3^x^4rNRyqSH+geU;{y&mw_Ow-}kcDk(Zd34;l);@5e9ieSAAP zArgtOPqj*j01s+!rT^lvkMzKA9GUDdA35-B=FqLWwUAO0ta7TurqkyG%D!??JE(vQLdax9SC zgJj&$RxAZ8?^E-zVS2nN6Y3na=#nTaLh#Ed(qU5_dIx}<1S*chJNjV*y^VIxdm8A4 zys9=AVo+eq7s-rx9%wiYV)xexB&IX2#1^&r$A+Dl)s4`IJ{oF=Z%2c2pUBqvy^zrmDoa7zV+FOeW|m(T9@UDWajE9 z5?#N8Mb16oiWH&o0&TpzRwT?CBk}*IE${@1F~gMzjemZ(6Vv*2-Ow@fw(n_pdpM4^ zadVEA7~o1QK-;A}lz7;0D-rI}&S)u?LiS8CwiCr?n>g_$NKv9GWV<-NHY74xN8GqX ziE+i12r2$<+KEHfakDxg`UEtz L94oZuy4~>~p>@8{ literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_multi_store_load.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_multi_store_load.pcap new file mode 100644 index 0000000000000000000000000000000000000000..787fd01398b79ddc4d3a678e56e1746a8d8cbf1e GIT binary patch literal 2101 zcmchYUr19?9LLZ8xYlCxE>PDW=u(t{1lw8!CAckDuEJ4HDM+FsRt!>cQT8+g2SE@) ze_Ri3Jtd`^iD-q$BG@pC6oiZ@u)Qf5y%m(}_dEAq>zup!(1UmUV3&>0?|VMych8-9 zJ@iOR^hCJ|1wu4%^W)f;=9zLr8sR&ZkyL-)zq5bLdBwBNNPL92PsiNEZJ4{0=^NV) zwPV&=GijMfy+_iZwoqu#5u(+X4Qq6|GL6P)@}GK@#ozQ=iC(vnki&3~rEswarPo3O zQfKgPK{9rznVhxuEH(^4hpFWH4zca4MAvJLCQa3}4(ZTo4d!+O*$Y%GRc@E(JLWFz z;c`y_Jrxy%ioy#pAm>H0LTm*ZmWmiiW{{XXQj};DDylpzvGaUH4DS~0@NwA9rgO`e z*`zd6;;Y2C;sYqAuZt6t0x=6wf#faIQZq#g5Jh5?9xF!48UoE&D&omeSiReDBUqFOs_na2B313As-2+v zY?15lLP}3#JWUm~af(JP6KNreiW2{;=qZgz<2R&FS zMNjgTNNjz;Dw2ty=+_CBNEJEcX#_`SR^gJI<2qJwK1iKk;+&6z^B8q5GR|}VjwO;y zkLAZ(Xee}_GZX{oS#-WM&lKe*S0#IhyU!#1opp4R6XeTJ#TFnXX?OF79!xok=ZDWPw7S;o?0n}otws7CiH%L6xQj};D z$}6|B#E#1sBht1Zw{+6XHRMM7IqpN6)Cx&Avs@*qLR1ZcD?UUYj0igj{%#nAMAS<1 iW>_G;z~nbTjwhj0wnio!Z>QX8Z&9E}tp@ literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_single_load_store.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_single_load_store.pcap new file mode 100644 index 0000000000000000000000000000000000000000..b1841cb021f9f673c1c3796a71a32a8f24bdaa64 GIT binary patch literal 5695 zcmeI0-%C?r7{}jpw&_@m9b?k&HZQEei$o3)6*Nbq7Gl4&ZYoI_QeKp8A+lhH13^?* zdJ&aH(oKPgx}&vUX+P9NVHpv-$ks&(+8+?pi}gI)j-B_M%`O!@8xQO-_`Kiud(QJd zU(T2JqXR5468V$M5yHU5@6+E~AI@4yGyKLflRb-v_6{Z*x*KNilkvSm#eiB!WvByV=$N)#%%Fj=6v1dEGT>C&I(v7Uy!t9#&Astq#ly!T6ilx!bznnnb4?0x3 zV?bXMIIj9l8XPFiPXv%VqteJD@wDJD@wTH5`yn{t=j1Sn89XeI7~T$$xj1KKbMA`B~!Ns@o>%lYeXM zOINWi9I#sC2Ure6nwZ6hM=@r-3&I1ej9F`9D&8(|B>S|Uu=-M)mMxq-F~SlcOLKPeHK6(hxoOvq+RMwkkq#kq8GuO$$xzP(;Ck;(p-AAZlW%@0V#X zJceE*va}bHK};nx0(kKO<2!`c;{ED7*VxqRRfbJHYHo|(*Egve;}i!{ay`Cg$nc5Dm$*VR@0B z4V&kVzOwGXe;lw{yv@Z7hfjU^KI(L0AAPOV_EEwKeY7$JFC>ev^VTyQ5|2ZE!_su- z!O(RiP7RkNIyf>tKoh%eUI`Ym+r~=&97C=zqvHOui=ecMBSZZ(7d!r`V(;pXCw%x- rJ{e!5J3irrj$ab07%q8_?szp(vv+>>JZkJtsWdKuMi;o5Q)~PSMVTY% literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_stats.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_text_tcp_stats.pcap new file mode 100644 index 0000000000000000000000000000000000000000..cec7be1e83c7eec183eff3368832b24ea1d4d078 GIT binary patch literal 2668 zcmaKtK};NF6vsbcwo!!p& z4O={MDTyZH#p52@8m$MTOA~&m%_K&|XJ?0yCirvs+^-itj>pLv_>HTT9Q)v3>c@`=75Lh4td2p5BfA*MCnU=~na3&PNvsX^zG3Hnp_Go0?kNPR*a4#l2Xw zM?aB>lhg1Ym*8Rymp%#s$Q%1k9zilj=-qhKb3>cB3K9CRbzYVVPds|8xwWn7x!)9| zL!|wfcQ24n0u@(7-pY4X%)9bIB=3HpudXB#hn{{93i$aVSrDNdf~$czb>K@RDs)$3 zcjC~I_rpX+xwJ@^r2+U3wzp|ny}b>iyj+)egCa`xHY)Ndk0`PVicG8|$mae(y(mHr zLEKy8>K&K3xGS-nY<6yiiRWj|o|}BLG1mq~l*d<55qdqM$OLG-=4$*^pvauixDTp- z3-ra+Kz!}gw@CaqyDJeiPJR|9E_fPy$s&3Vu(%q8eY<+smEoO;3~M0l^a{wZ@j^(3 zxr^h|7bg7+6xTO-#@7Wy?cIB$x3G#>B~ryS=yDTu>3X^rt^)5c2}E&+4Z4he^CJ>h zr*|cGC%Qga3=Dybx8#W$KpmM&3?OLB4` zDX01%^Q=kz&2q`GIJH$~yho)W;bJ>XTcE1Ls4XeU0r%rO_*-n5aaxqpNhOWD{-*BO zwyKvbi|QQmU{Xr#@DkU|@Rl+xyaET6aof?kV^eSy<-;FpFVUQu&oN0BK)sk#u{Y%! z1}r!c=(@qbB84m<7(ay8d#; zKWbRIEe?tjU7L5TMywsH@xbOC6Upcr6EJZKP41z3LsrWzX=YHUTV(i@XYvaZuA0LO zD(J)lPuD_iyJXjF*=0_dYEuoGawIjB5jA-BifwRCq3cG{=|Rz;rcpFNM(v7wMj9GU z4P-JwgK4@>p{uP0w@#)Qpk`h21&tNd za;X9xZ9>zVQc9%i?s&PRWkt@2+j8v&Q|XnmX5}EGAYM^3&62L>HN%W3A%VMihyPl`P=`$^LJ|GZC|?gTmTY?yf2F}OE<{{imaZ;I!)kb87I!ku+9?MRUAM3{?j zio;zsVsxGprFzeO&6UIReCjyN^SPA{vf0uXn&+30Xx9-NYFGYf#~kN-B00`Mjwe9P Mo$Z4`j`OJIe^Rg((f|Me literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/memcache_text_udp_counter_ops.pcap b/packages/endace/_dev/deploy/docker/pcaps/memcache_text_udp_counter_ops.pcap new file mode 100644 index 0000000000000000000000000000000000000000..bd7edd98bb5fcf5d6cb6ab6d58d167caf1778744 GIT binary patch literal 288 zcmca|c+)~A1{MYw`2U}Qff2~jHohO)a)p<{2gn9t4hHqR)*5T}7?nG6b1=9vFxXAH z!oc7l_|Epgian}8toHY}_Gt#K6{cYAKqHD%OB9mxN)(I~3=|9%^74yP3vw!XxeR!@ zKxTgcn(YQO7lbj)wusLGnXR}6#cY+2^$bivjX;`D+e_P#_zGIT+OMT5GJ?V^r?Q&B5Txz~C-7 znSsGUFsbaoian}8toG!g_Gt!VzhHy*{hzBy_P%t+Q5Lj8nfUm_g}_GuQw$E(2F8JQW1Q%e*|Qj1ICvr{V-41mzkz{o@)FTW_Y WAg7X-D{&NzhQMeDjMxz14{XvGhHNZ;qZ=WOm-?!ChhQ^%f} zcXo5{-DjWkKF|A}b8mL*bB`|fi(H|`v13B`=nr$&!s_DFg}9C0BkUtzj1i(KxN(#i z)%&!+&!P_?)=f6&rQ6@h2?%q;>@y3+S7AEn%kL|i%g-0heTH005cv{jYo7HcVZ;-q zKdx=4<3Eql7)bAYVKbf>9Sw(#+JqU6#N~$$U&5@)N`x3l6cP3TR=&biD_AYBP^`>( z>n4K{F}n<`j?q*lt1>X_BnYrV08lZcw>)rcEk#akG8T`<#J%+XRMX;%3;aZH0KH~r zQkqRZx897!6Xl^q?PPHSU71rR&gKt>8Vqp?y^B#2LdjStl8B3(XrnddUUY)49VUj- zi$8*Ezf14pGvW!Oq124j8BNAbeBBjbHF_Le0al3rH&-BA6_hOxS8QSpKUdk3u9zPXHzjpfSlNmZ;(eP7 z#B9nI!amq%vEXJ#T<2^fvHWmTlKk)z_pSqWK4YJJmLR|f;pT^>bS~eFH&|qR zg$<#m@_00I)ubuZ#;VMj2A!t{MTaYlcsz8Yfn((}sBs7p?)2ltwJ|ecaHrtw_verU z!_nGM_!^Vyzk1tsqblj!`ARcpj5A_!YL9}hqGM*{TH7)HE_*LPPF|&)c&PpgYji~A zM5_K$K!h*URfk4np9JFaw+h5F^j!%1;4H5RzRHM6M?|RpU?$7!fJoPg0tus3&-7J3 zjuqlMdgnJIaU+&Eu6^d#MQf7{20G~wx{O+F3BBZ9PYt_z;jGxOo#%a;d)L_B{*ds~ z@ktc<(O8`kGwMiIOz6w^3dBr0jIa-$P&l=iZS$d;kY$_jh3WQ=%h@(JWG3_!O=#Un zg203jZnmK{Ruqy_IA0jy7iO~mK!I3D#}M|xOl}Qs;nb!T6HBa)%So&#GnuY2dFm>H zz*>Xhp4zkN?D6&FtB=O2CL7@}f0|boq-x9uo)y-{sj5{3WvZf-s+Oz@L#m!ag@GW# zEmb{UVH3JrVf|*G;#FaIae4awCRsNuL@hjwmGOKWZ9-+Sh{_CkzQe#P{lD+7$$^p zvyD@Qfyw=U@_C8%I;ZxqVq%H4y@))`zEluns>-xg>cjU+j`%GY&BE1 z%4u#0`{3nwMDQ)vFw>@_hARUiny0(M%GOLmtURxmNDvglJ{Yk+_%?96tBp1Ryz`?g5wG14Vy{I@?9*E|V2ez{Z z=GZw@6^|zra6mYD0K4T93c3F>AAaMvgYKI4vkP1NlZ2m+*J`K3H_Owl&Zk@C=|ysF z$@+9ko=(Zrbvk&PJiXXIjlY|2IBe9SRiD+Y9rE$Ymcx$U9lb`L{b?wdKh| z#PZaS0z-44_B`i=mnRT>h6sAxv@Hk0IM(CK z)7~T9Se}rRxf?xg(7~eZS2?j7QRg`UF?Dd34Tiu5zbC|!QN6ty(RN0B+!0Z0L=z4I z5sm0n3JlE#_C|zi$89P%B5*iD9G;^C2>ak>_;_jsE4@^4u#}!Un3S$zrB|v(1P&7p z-a-)IfKW=m^3I(X<7+YS)g=_N5rx0@R)Q&QDevu7ubrIMeQHWls2UO~tqWyM35Xjn z?d?^sI~egEM?|e&EkxAoX%rZmP$yTfAXq%6w^zO1$12t+f>OmaskmCNSBoI(6$BAV zMS7bVIM(C!`lCVPPyQhba^ipA(*`?Pw7n`P(gv#oB37SegU{jYI|=d1i*m*9XzmF6 z;97|WcQN8aj)<^9t*RAcF%W-F5T{ER%?3{Oik*Geng%j&j?NWnI*PClCUZ|J&649j zlXo$e>1GdxlJ#Xf_s4A_$N{I7yBIE}`&vf@44Ju#$rF7sR=oP!RUPoJRzA za{}L0oTViDNRo}ZBnCLQ0Wmrz*Q+x3Fyfyb5w*&+5K)?CcN;X)75-#nT_|z< ze~)sl<8d*HE~1B@Bk?ko@6Tlw-$)0NSqJhPlHr6&k3y4;{7{wDv^^EYJdfVu6YB{J zVIMrtM^X>4o0hA2T5gKpPHx)7ZdzfVXX8*jTg5yPZf+V!=enMXRz&N}dXpZ~V#tT2 zG*_^tgVeSWm-n->P_d@Y&q@u`{@|wGI);XQ=h%8*-kYV>4HrGk;v6u z0L>bQ0&&e>JfHf!&xi{g5w&K}SPDcm1N>hD!`%fZysZYoyt_T0`aH<;{YDYAfCeCo50Me9^Kv23t&0NLP$EE|j@(Mp#Q z;+&Mv>#5Jb7_r3>5jMy?^_l(^5HF?do=Jh>Zi9hz*8QmuSnXNj^Lpy@5Nm(2VkNbI zfwZ3p?Yo}(fYtP`I_dks3gM>xS~~Y_{BJq3b`>W~u9z4Q$rZXQtZY3< zh|>lO@jPV&VISN&p9ub&5yv?q!WFA2&-@#T=Jm+`tpxEs3FGdH33P?O&IlV$ON4bi zF3zKisB8WNFWE~3S*pQI$nU|6Z9TxG0`#*0ba8}z@T9`2m29faN@|%Zxq?i!ha1Wb z_DMCbA4w3H6vE9^*dTVT2Yi_Tli|dqoX#QagPDv79^mwD%S!Ja60AcP4C!rN&xn+m zg#?AL4@SH-_yHsS!4XmG=FJ;`h;BYW!ng}|!rdGM=Mq7Wt=%e4ezhVfli!hU-&Lk} zb0)X}-5dlFZprWQZeE-2MmI-Ju7A84S8fOSZY}d@H9ulZCrL4xUlsHfn+Y6YA3T|-Q>)oBcc}DOmYLQ@ zma*>BAGJ?rei7Zn@nkR|H_OoDRgp6-6iyoU`#0Nj)C|p>F#TX+Oe_|SS-+GJSkq`L ziVbevm?ruqm>Ic|em5ciHLm@@33H3m+&ntKhb+`qH8&{~-EU7nOP3x(%`XDt9sT-x zb%2i;ajqkx)&b`C2O>Ja4=6C)r9a^g0D^~zphpMzE6Z7>2wHMZKa1o%s&@b;*dHAL z1QBj>_IL-_^kz3Y0CIBgDo-06X3<_(IgvIvN;cS^WrIN^TK~rgamh6~UN-oc5$8A} z>NZ#bMA)F10^@720SJCU1U+oEjAc*+JZ1BjoZrY%@$nzoWr!3m5DkstgtpPD3 zoMi*f$rEIQzn$y(Tj(Q8rjaxITV`oNx-=v_E z$vWHPv(ENtcalnENqZ!_>A&?NX`=~4#_t$EjBFg`_D9%b4m-r5CJ<|!Jv7WgOrLth z9FAS=b5I+5miuoWte;yQ%K>MT9L8q_Rhp*?%!Aux4y*M)9Q#Tp-B1DQkN4j+(l_MJ z%k|T)9|XkHLJ>kNcGOCs!d6VP;CUC2YHDo)oS>}Z;am6o&#msYcTNGHU(J7ix>74c z*vLp3fk@$sHb&X}f^U}dm9B(%pxR9xNDNW3;FYFnS7K2c-Dxewv8vJGJ&0yUSrtm~ z_NxA}H20Be89$H~`xJ6Lo)^P`A4#BnX{|=1h!_AG92MkjQyc0>2e^eKx^^{N8GvR| za3_=KXJ6FJ05q=_ZZV1e`1VtA0D3q^my+nCx#tuAqpN-1BaDU!{ksy!$xH5$_mRK8 Vq}vex9u!|AwF|9LL}6Ztdz}TM0>sBG5}6Jj8aeOR{aW7mM7|E*+-nsZ%pMGBZ*BIV}E3 zv`f$-B+^#8ghr(~)g_`(P_K5d@9&tG{q9%Q}PQv?!IRV>^x(EaDpXoQ_(EEAn>WR3fuznH2zA<^Ax zwK}}8Xtv7@{Yth*+TVAdF-eM4veZToOU>m@LnVx$wY;^lxn(C4^;VZ)h&; z6>b%t!tXxXk(ZB8gRBjEih_%RBjM$$^pdlFQlIRA@v47-40 za@pqW0QNM?XAMo`ime&|LCz|ccIL-7wQ=dSAiVA&Jh`xF)n;Ru+T#4=FR)ZTNs3Pn zh1eZrqwp!Jl6WVb>5_`{9^5O|+DwY4pkg4X-cmiIvnskXZsC{K#u-tV0~=+U_*NkQ z>PBwWqKRwnCg#aTGZm&C4zY(wK;diRVDz0(d{9!6nmAD`EKQ0a$0`xD$~Eyg?j_Y~ zlJNmD#nV)x)Ml9J4z6j%6H)XaEN&O=V;`4hL^ts@aD9W;&`sOZO|qD#qUWI)0%QuG z;%`ZO4V>DNis)wlL08e~Pq5pGpu+d+<{0iGs-+hSmSVbmH(?o>i`Q>rZqsTv$2}9r zP295Nc1~xBE(|wg+G>EFZ#7k$CuCdc5YMj%F+ZB2$l7I9=j=%G*U=_q7f-4tZ{emz v??V8(FyrZSe?ojp(LOl9j48odc5Nx?&U;?8R-Sy5~Bg+2(kGsTq literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/mongodb_find.pcap b/packages/endace/_dev/deploy/docker/pcaps/mongodb_find.pcap new file mode 100644 index 0000000000000000000000000000000000000000..c2aa5823ff7d6575f217e0e3ce0c183dc63256ba GIT binary patch literal 944 zcmaJ=O-LJ25T3V&CVB{w;!i!;iv>-gQ0T>zx>`gf6|pLMku^Te)7`A>u89W4kk*3+ zLE=FKX=!hTfat-q+Ji(2{lR07J@hCDIkug73vJe@1K+;gnYZ8jcD~um&qp5=@WKD^ z0mFyZx!#ckXRw9$1Vzo)f`9aF>i6zm0A2#D1;2Je=Yvmc`Pwj}TCq-S6fP1at$p)L zx{(cK_5m0R)IeX(g1+(a0J790C@%f(>TuiXQJ>M$ZR$FYI>L;*CA>aDC{!EZ%Rp}= zG<}gjcg4-mFxbW%!IkAol;Se%gv1?ZNf-$f8^t;jR=7xZr5oWo^S)eM&U%F`D+m%u zpC3S!2j#*D|D>3PkzR4QvvBa_Y2xwEJN2bdpNek~Dw_8q_)Rvi;B8*AOKZ%*< zs}43}TEj7}>;E!xV)|nYeAp{Og()R=Dov^Pnv!ioQ*va=n}=SBXGp$^AencW@(ybO zVH>VI7BaLY)i&dUQ*$^>!y?784l*6#wyn)_%BjmZRRDTXq5Wf)aJZ^D(U{!-s|ui6 zH=~;VS{NMm^QGnpo-TI^i;r^4rXf|3H)M$TSXoY80 QI0!`?go(02SfM}ZFQ3iqeEGD6o2DR>Mo)dA>JCoLxe56k{MnyY>7Q2{;dw>Htl@6gF7?ZH?yVmZzGU2 zJ9v{2!fv(%;-M~4K}10z2p%o6KPM?R@L(6W_rBf9RaZN8=)v20-@o^L@ArQ1?ZT_s zsS=REm24K^5)KwuW_s?Q0(g%$DS$_YQeogvIfMY7r5jtIrF2}r2_TV9x9X!~XR4~Z zL!T>BwKA;D;G|UUgW9kcYAYY!!IOvbE*8pihQn;fUl%nrG0dV|M5{zMZN?p_K%3(Z zHOW=eu|d|XXwqP025`v}fCKm`i|88k%&aUvX}#P#+y4BgL|!9ND~^jKnPd25i))NC z4I~lUy*7XbDW_XwllIqtrPwMnZfwh8ePpSz|38EcGR>3crhr_tq8)ej{}6@`EeIPePlUI=q)vN&IxvWFGMixeT`m*N^&TY%W`sC zAT&3HT5Szr4)JS>MfnQX9Twu;;x?pk3P~|Y%etvCGSG}#8iUn?2ngfcu=}ACXG6gt zLZN8ML|l)m4pRo$kb>(LSH#g~MR2o#e*QX_SCJr{qZ7@_Ri#-8`UA>!x{82#gut9Y zo3scphwHx)FjXI1U~<&zoEsi|c|28(WrLhvFPpHJeBSEV8SF_;J|B#_KK0S*Rw_d* z$BFI0mXWShjs)gr`ES5}jKJ&!cKQebGk(_vCf}nb5S;n#z+UYIm_$TKizIL?-6VWA z6!l4cFZCyZqW7IeFMe``;`RnrGjwxfaZ_N{99*L0=#7J*=tM4{?*@eWQ_ijgw2(Dol>$8BG zxM7+7mJJe?r7LckQAC>qQgmA}El07FiG;-+rYTO0Tgm>Il6NF(h_C%6tw%))M%=LS SY0Y$pzI1O&>t6i(@%;u%ABh|Q literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/mongodb_inserts.pcap b/packages/endace/_dev/deploy/docker/pcaps/mongodb_inserts.pcap new file mode 100644 index 0000000000000000000000000000000000000000..5212ff70ae8a677805469de595e7b8e45232b9ae GIT binary patch literal 2376 zcmcIlTSyd97(TNu&DO)Vmey9J(go5$O?udUsclnCLL$69=CpfSr)GC!W_DAbwyjO~ zA$;&5A_xqW0;%kwdr+E|BA8?s!a}Gd=)s`NWA*=M)ZN+35QztVX6BqT-+t%&zi(%1 z=vI%3m`P%o2?q}YVs*ppFi#?Ik7aWA=Muj0Z2RvE7cHcU5ZU_JMO-VcUFy#*;c#s_ zUyP5Asapi+Ie)~??TB^}!f}>Wq^6*k)bKrf0L2Q0V~W?Vg4ZtwO1F9ZUiSP4#(KEp zM5R_xR4Qw`$hWuHW1_KQe136vkkJNbBKZ8D#N z-a!CYp^y`v*aDS2aPBgcMO6G68P4VxTHQ)8aOmi9>QU>&c8V{s=~}8Nf{)^yyG^AE zA=0!7_czI+O5K9$X<_@ntNen1dR@r{svp*S9<=PZ)PBDA%=6Nn-CW`m5rN zVdm~Lu{NiO!a!At$S^lb~d1ZQV4 zWX_S4xtplTI9T$|IxTNmGB?Z+t1=?m0dZ!*2#y#cV&-z8a2Oe3Ntqj;&)nzq%wa;4 zGRF=Gf9nRBd%$eer?*jOG1zDVZ1g>mIXs{vhM7ABg@?>$qfD7YCd0tQ;16?zN&PZK z>IrC`pl_bW1Q8!?&=Q;_#m^Yx>5Pcjyu}o2h?wFvP&ka5_s=OtibWf>uV$7n=R+p{ zrWE;w(Xnt5%AZKFMiEoo3WYSY$-nF=o~``(|6fkjr1ZL>5uUTQP3qegE)tyatzd+G Li4;4!(2{=vbZ}WI literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/mongodb_more_rows.pcap b/packages/endace/_dev/deploy/docker/pcaps/mongodb_more_rows.pcap new file mode 100644 index 0000000000000000000000000000000000000000..f47a5eee1b795aba7578babe390d9fa2b1090f16 GIT binary patch literal 46491 zcmd5_33yc1*&czi2q-8bDC($Kkaf095`~%#2umQ4u!_J<<|Z>_G81PB2}Bl+3rm4k zt!Nc&MHYpMib|CoIC2&`j354A;V*a(3w_sIfcJ3U6AkweT6`#u z-w*e3*TODc9P_U=-^0mvH*R$}^5D1eKJY2q!_W3RI`^;ty4x)Ht3!vM58*$wn;8l? zCN4d`b!NLs`rE&|qfcus5Pczt3?w zKB*r3^=s7=cAVpO?0a(5KkpCcWjR{K6ER&+IJ&?k1<_b66n7SCu?lB)weDy&H&j&` z4d{-x#&|wI%vGzBXe^p64;r84#G;WJN2}6gC?1OF4xGIltwN90I@*-Sw16IW9EXou zyBz)D|2hP;1UyL9(A)FiQCb-nI9kDf$aZvzmqugoeee%QYq$C8yz%E|6IbI+Ia+(n zS3h_#G=#YNT;po5`Rd)<-t-bzcQCH@nXm5F<)K01)j19KeI8!zXcf^abw_vjn|U5_ zKAc6tXqBT?{ix@K{7P{P-CZKRx7if{7mPlwOq>vjUfy+S~kk;np=Mz(-AmXV_ zt+R-$aal-2bWA*$L0qi>>G{j<^x0jV0_h6)n!MT033_cL8V-O?B}<&ykpO(qAk+kQ zneGgq+u?W;zC*^YAIEMsjNZsGR8UWPhD!qP#2>CYb7;N+UccywjDe#h@QM~)MKGiE#kDnug!(GNwncaz`K`7*6FuhZy@H_FnXep?)_ndpSW6q z-`2`6J$6^8@Iwv7$s_uXVd3|a5@IwwT6fMo03-gGliI78!;x*mx)iXn>rD18oa zZ1Cu4JP6OyVDqec*uLkXk>UhRYp@;NU>FIi9)B4|S+UN>)q);w`^`~`YV2x354X0t zL82Ph+MYOe3aSg?Z^hASCwnsI=uo0GsDr*(O&CMV4`^*upf!M_Re@u36NU>kBLhs1 z=%74v+3#FaY7DTR{HoV?do>eS7r?J%#}m<5NOR^ylVQDD1J6bjN4FQuVxtvP!PZ=M z?S63!1=&yGP9(@2*KZ#t0?fIHUnr^LF}?3l;%df40W#N$KpJti0dNYk9`H3ev1B9~ zcaDoVi-Wp(mI&P3V4WPlSKv0#1~-q#<(F_P9<+Mtp1Ta()(r3RQ1Ms^w@IN=0It@2 zN1|)#b(`si)GA7VLPVS+<6$iVFgLiEEn!`F=f{+RL*t-23QbD^AKmSyd>X+aRj&mc!0OW+hfl?YuxZ!u5d^f1R>DHqb7%kst%9<<-`zu* zRp!A83t`9h0hz>|Fz;Ac2={c@=O(T;#x{FEdU+_q9UyQh2weR>FlBEmaCLE9Ll#`! z8D1IJeSx~MTj~s4zq@(Tnzj>6xS~fkHVPR4&{zsxkH1N#J7JiSrMfdWrfZc0oFjAy zHKPNZQ={d{SYm(^{*zs>IHbR)1(-j4_!Y{JWpox~de6i-MQ7$C3z)yZXgx(|W9$@) zz2I?+wRl1|tZZ>CS`{jd<5RK;AQ4UXg0-zvAnN9bhGA%tsUFA?NTNOU-6Q?3XI|3h z6NlXJH**>X#iJ;iOn^Tcq0Oz&51}j%_S?emNSPcpUsu3|B44LCvnb(aoD%rj?GIBa z>@ZfAyri0{lT_&58m~^Ffwu~B3F|i=(x|yl_qfy50icJ^y;UXC)7`R%dfgLGj^4|n z_j@DHy;flMbPScupm-#BI4x00YdDd$ublEW6_MX6myb%AFeMWh^Xj7?QIVg5FWkW7VNjNJFXRFWu(_zz!AvXwSI<9jM$7Npco#zLvYFJxjzapQe2?L(ZZN1AT@p zn&0mvvS@yDx)YhJ$fBuL(8|Z%-@HTd(NHQerR~~MPVrHpf~S@`C>2EAmcVWE*E))i zcyWVfBG7K9F-LxXaWFMUO(B=*gM66dJq2=U9Jw<54$et@o^+S2p^q*Zdj4xHQ~js? zxeu=?kSIAC^daud50wY!XtkEe!vpSa6O^QbL@O~Jj{BrIpDUQcf^FHjhAKxehhHG( z^b4-N4rWVL>QKb_bx(#Vq)~Y!V)n>eCLzsB)d*1QC?C>36xX2=TcB zTE7jn9+y{gO-}ye`D=g8X!*b|$DcdX>}(<`xxr+tlq^AD&aVk*oiGUZw3=`=tzaL$ zxMvG$Pg|Ftxt@Se0rr-cUz7mh3yFzLwq=8ZpS+PN8kUF3h$V?6Q;lKk`)v~8H)sgy=Ui@R7h`tmEr}aj>keBJXGpr zH(eTnh*a%)`rY14uyP+L=0B6qe+UL_oPT_bG)v)O^Z4`sdW^;0W4@Vp?GVC4N%v76 ziU*=au7)l0P^`k|+vt_tPrgo>+z22X_-T77!NzS1@>$}*fao#GpJDtGgm3!Bn7yb9 z!dJE9M#=r;_ib3`6u@X&Mued>5KYGIvSogE8qVrg1-RF7a7EQaa6K7v-gL;&M>CHx zJ9qIve*f0>=3+aV-@;flUZs~NSTDt7C{SAb7?9CMcyXev_4elapF^g;LMfavOQQdo zcdRG}CP3wtDB{7j(}VVS3Fvm}F@^GB%y=Oou|iQ0t=3Aykl@t8T_*|YhkApuLE?Ij znGORs5)y5Q+mksEqBk+!t!;Su+~<;pB%W73KdoKBB#AiL9v7jBP?0pDrLs|^B3i?R z9+$mODWZamhr7N&#e$4pf+E@&B)n@WTxdVS+Z0c9bv5Oc81f_9t=*+dD4cQSOJ2#s3qPfD&FpFcxr|@; zvS+X0mF!q{KeZ~@eG6s36SuFGLOs6X%&P)zV!j3qn0f-%gnbgt4?a39hNl%2zJV`> zAPgujhIFr7O6dC7;B}{2DyF_TYh_F~8ANpTa--oS^!vrhwP1E)h_!$pTWfz-v$(r& zxwIO%*LevH(fkyt!YmFruv%h0AG@0|wy+u=?psUMfehtO@z`+mfVfO;o8qs>;|JoX znq;y#WEF5PjgVo$1142;VK!{|=H9v-)A8^8MJbQ5CuDClcC^T7{JL?deTb-COS zU~={SFHyVa2?x#v77PmNyYlBAif0NA7iZr?sjpGFNTGHSOj35F z92}VnNQ#BRmCjr}0*XiJuE&F|V2>-Pmd$Z16L2%)L8$eKz%6L|_djoBR6Ce_{rkOB zOu%9MQcxR9fGbRN=Ry*-5wesQ^kcho_tw2l2`Mvb0%RNBm`g#%t`;DxKQp2QDbM=I za?1ZSLXi|?2=?S)2nw#b5GRDGqLClEQUIzFg^A4JP$?n>mv^8gNB!lIzpoj`%0@T8 zcJungEE8JD7;id(lowm!IJs1=4bGZeFiKi%W2bu;QM|(Mm(+0CuSZfbow4@C?#?aq zI#ITfdA5QY_DDZVLCWq#u#JZ=FOaV0iA}t1M{B`0uIyb$`N53gescqj>&zvTAI$DM z-F$WZ{yZvaD#xPvQD=c3YNC-CIvxEUpBJ?AF@+f9@)ah!&M4wgZ5Oqmp!2*u6_{pPUHBxEHRvEF3Ri*>5aNwXtT-8~ux|k0oBf1jaJd*Oq}wJj%AgW-V9OPs zP>E4Cwy?wo{CyC$49rlWdx~j;+-NeAfOf)Mt&G+JtlcZijCmZX5RBJoZc(<~nR2me z<>whs4wz@849?zN^sBle6I6IVsX}8KQD}5yjigZz)XI%0Lf$@9Qldi>e?yy`)k8Xc z_;X4VSms6$?z7QFR9?>TJ4H?CH2gRP7>i#8z_#8{;sO$=a!6(m3H`RBpa$L1l{)mX zjf^DvjNvRJ4Q>WD@wQi}_%M!K84N5TXW8vk;NSbW@EXpB@r$tLuC>73VMo6|~$Y@4zT8X!-j^ z-KaRnOk$k+yy%=r0)A}M6kZqRYE?DK;d~v43`SE2+ur0fg=hQ4UyNnj-hMvv;IXf7 zHZ24UatsQ4yk0_aeSUMYqAmP_)GXzMkD6PaIu6&0L9ny^FDO#u`jQNNuZrUo-0W&$ zact`J4Fxw_O2Xneb=4@US&m77usHJPcc;v&+1*Bs1Z`_pP15Vi1hHJNu&yIG;sF@1 zk@;v{AvG&nSHodrA<~xkJ7o`=J#AdKU_N3AHP|56u;w`L)pCvMnHP;DVP7b%)h*is zx6E@lm1|UR{{6(o6s!uZ&d>dV@|uh#lX9}p$EQk0DngMy&eYQpnJ9n>eB37#Fy(WY zN?^1`m~cU)L-9odYRam_sA^WB{5bQ*tf0B&7#};0@Ufdyp;T+L)uukY>H=!3qJnhKn3yNJW^IC28mNJ(~0BlO9Hz~l_)q-C3UR^}d5LFE5V(cGA*L_?#RIRIbqGAx@ zHMZ@{Qvf=O13DWAZ$e11YlLi9Zy)hFM3mkgru$ z)jCJOt}=3`o8RlnAiDBL^QqTxR6g|>RroC%-R{fyJS)Js^hCS6KR#kkFQD=fUBr;O zGiMj@d7Is~X!SfcoVbN*-e%6A5Kiof)lw)aOq5NTA7{iN_N1PD&PQ>BjV&{ zN+GHRd>w>fsK#}G>)2;W9PaH9yeiDfYY$yhIWEo2Y}C{-dJVL2AK0hkklZMpHmP@C5R@xcY58a?35NtTttc^(a(sg?EzUKmfsmxdt{t8Ql>>PC4y z>}p|kbh&djl|_JCmT8}V(JYF{ifFX1&(qDx@8fU6B!|H{vg=mx`fy{DsvI+x<6Qwm zHR6rD_xLj9y#Cs$zB7{+8@&H=YjB;@ydwl_djETSUr7b9dbKORdxP?76&Ua7yn|8z zg-Ny9#lx-^oFp4_ZD>)7rRYHBXi$}jJIBHj#*OyMjUj%(4ZPX&71^P29JfjfZt0m8 zqCPV7*)yNA4F6jf1lkmv(?eKDGpt5cG#rA1HPl>%Ljug5k}A>0^a6XV!G$qBF&CbX zGt;WutBx(C60&S&1>HV2WtC)*xwc*mUn|waw_GsEK5-zRW=$OMu@##{@?7nt#DR3R zkSAJozFVrU@~e?AKsmz^#?_G@O*q-~k;@?sH*%D+BB`J7jXAV_R1{|IomZY!{&OCX5GT?@fm|6&EHH#uz zX@#>mRH;Lm9oot1<$%q*hZRGN~fv>(c87RLV_f&atoi&3Ef|rkN_( zlpiP^hHK$!LA8Sq+(wa55oOu*LEx%un0oZ7i=q)D^v%~{M*?Xz(~(uH6#z`+0En@# z0f5^r$3k@zYd-36yAcbmc4vILc8p0@(G||Gg|s#4K)Jj^Z-a6B>QjK6FjjLbZdPb) zDsGGw0yH(dFQodP6pSmJem%t@Lmy2(O|z?F8F<)^ssU{hM@NSVX`~10b|!4^6E$z% z)ZXdEtdpT`$s&MGryg52eA+DJL8W&uOt7y;)E!eLZ}S~d8dA)8W5CR9xvn-oNv z%%KvAg!kq4$xWV1`aQMmW#*pT;SGGW((HZW{TNN2PG>qHWZ;3Cn@(`1n&qZg(dy#q zL*)?^Xm$JDYZA8H<1->V5iOfuP&T%J*6vScQP|>gY|y+GxDuJT<@s3!R#R-S@>*QU z6&t&U=d(zmIQ!cX_m-J7uMsQQ@}M?4fR#D(OJIc`TLVWcUMIdBDrFEj0+`c~td6zQ zgkP=5AXs~-xxrUB6TQ@26Hmv|Q?= zA+5%!&4HN|!gg9rw9Zbw^d5ncaE5uGsw-15HSZ7r#*;)gVO}#9CO^-I`>U z_-QUqctChwBRzH*{H<7zLC~ayfi-3N;Hg@qLWkzaaHy(^ZfA$IHv})gSKxOe$FB^( zg*)5mfTqjznfZ06`$j5>}cCK zdT0ogMK7!L9ro;?`T`VQ-H!JLQz>tDwSeI1NtqPhikz9Rd?012439B|APTZEJE;^W zWIyZ*7Cuh~Oxk-2;HGonMB<@u;YpW6-)-OS)URW8%3rQLdF34u6LQ_*H;f?3ID(}l z77CQ>Dt{183o)m-+QP3%J#i{$&>H*NoCU8CzYQxVQ>7>c>)L$2z}|Hf+>7w$XeLap zDz&AEeQl2WGrNxX_vUmJz==oz?MVf+H*si1P8!f!PG8wL?#-+ntQ1vw&0B@(BTUdD z$wq{XR*txHj0UImTR3Tk^v7`0imx;99A(^?LoOJ%s#YbE^TL&{58Su7*nJFu>u#>T|8du!&07c%yy3~P%?>cH8EbqbMSPH=u&{^I3US?%=P8I4vb$=0 zx|H_h5QA4CL%er!2_?G>G=ajqe)%OuVZ-AT4>mjd_dio2ZAf|wV)WpP^%^Y>GMEU# zF}AQjlk`o!c#_T23S?(;WJ_VZM$?MI2@T8eYoc@7>6mn+DWm7+ zBMOquX^h0V7zq`JknL6jn+lWy*3&0%rLvODJ_^?K#Q8HQx0LC)2Q&Ek-0FmfYgM!=pf2kdPMPJMnq zizYfR9l!senT@F!L3L(<+XE@IrlJX4B(PmvtKj7XD+`Bwx7uC|1)-hwfz|>;YLkOu zxk&-8=W91pEMyBu5Zd>jf1PR~HycunMhkU_44q?=@ahqWq+vROu*ubii(Uw;RlDUi z4s5vqEQTp^K68fek|zeUJj}1=>}&mr`G5mdhEzh?PsjE@x=_#))})wGZj;?za&URH zjv9I+JL zF=iDyG;+hq5?Yvj&@-}M!SWKm7_2PMuvCp&*L3XNmo10R>vzAIZmt?3%ROpYhN>Za zJbwGPJ%*iR&6>OWLW zq|PT&k

p6LBU_Zu@A?JIn#u(;tpJHZNk7CbFSHm_=gos$52^FjEqyd_+s2| znxo;Cspgm#+~=X%;#SU)D}#X>O$!Q~$1mHKwZA+Se=7Czg^zM-=gNDg@?xQKIO|y1 z3J$O2GkcHtOxAV;T+fBjq-y)7xA5KLD1}3>S8^F_lH1JR7hHy|zrKrN4{EZ6ne`PY z9AU_S!5^lcSQTPVmv@Spz|XYr6fJat;kuNv#WXaEo*-!b4iRY5&j%FGEqju`xuf3M4V)W29xV_T<=s zUD>kOeC5q69yNE0W2(&nh~D@JCg8{U{#Nm|$(N&zmWbSC%m^w2uJ8_(YVr84$i=Y#|0M!^aTz0?akpv}(*^L9Yt7|rI`iKdfzm~yq_o?9=h z{)$yQratq`TM2Vw21AYES_s}l0mUk{1UJ1c3zz-~sKc4EX;#;0M~9awXGcNHg@3=1 z!i~wbK+E91byANXj|W++zJOc(PYy`oHNToA5d>N$9^ESS`0=Zac7hZwaUw@V6NxzN zMuO~2KAc`dD>c5>=r0Of!yH!)h7%2|+j5d?&bdDCoI(Nd<$_c?Nv z!zCPUO^7sp+@Q9NZ{W1TYJGDNpB|Rk5Y)Es7sIHIKm{H5?z-JR$0ER*Sk;>)Jv4Bq`u`g6b$`+NLCLqdYg`PEzE?n()|Kt<+hdf!C4;z6!j(XF@buNiGVX zAJScyDi%d0u_(|{%=8b0_bZG3nE&S|pK-D+T8m$3>z!^s2^a~+nmx#V(*NouuGUr2 z{)KHV5b+-U!c>l35&3L-B$x8Um|+)IMURJ{lHyygI|>o6`gXppZzXQZS=DQ&^qO;} zHlS(A(IW$M@VH5ATWDTbm4@&BIi*nl2wxiIFtVur9?QWYwF^I3vyKkhQ`@v%&B>dg zt~FJ;+xo<}suj_QpRj(O|Jf4CHDo#=xQ2oLH&Z?Y(;z`rYa505CT> zq4j{%grdPD9B2Y4L){J{dAq`0S~_Gs+9|9@l?}jf#*Jh<%1?~;U(S+dXJ6es@;Mpc zhOEAujOIb9nu^=dLmG}5>L8EFt#-ruhAGY>)G8@xvpG+fd2#~6y-)sAD!g-x-`f~l zKsf)+O%$IICx^)A2QT_LrVkE$Z%#n&2e%Gz|Wsd2IvC*VYQc#D>Es#Y3I*q4<2ZfK>dSKtumI9M&D2i^oPGAHxaCvsOZ=6ula z$aPnmx5%P}O!Yo^X#oWSb2Mel%^G`)&BK-DxzV&hhWEwSN4>8=Zh+mC$2ACgy-UQZ&@Q`u(SYe+ZRZf+cOmbucI3~ACi0mNu zz-)?ts|xpPO#^XqsyW*EyU{gI?+BfU70dfybh9ObKG)+HKzP0_}Sq zqKuJ(Ts8$gg?kcozbUz^eCjWN8_?eOq)y8HW%JT zmHQa=1i3t*^_N^oK97a~ita_-p&ulNfg{RN4}yDPQ!-*>3y7|qxkk!O^E)voq|mTq zK^F^xaR?{^WUOc$0sbcirgJ!^5dl;5dE9CKfv~MeG=`%m4cqn_I~>NRufJlidGD-| zpoHDk@e+9XaZWTD)~jLjlEhj#Vg%xP&RYB;d8-mWmvQ*PVA&#CJ;*KIsT64yT6}mz zTWYh5LW@`aF3o;H2oT%6A;}m!rLK5l8SV)(GPwAZSo~>T&dAuD{x=1RH5^6JuS9PP z-ft>Fxaq5J*7mM4dW~+qVe+%H&3kHb&WwN%>hYFiF5PhAW)sjgmzjxwY^Q)wXzhu; z*HJ(yw6>|ueq!@P&AX3K>S=II3M>T{4b32NtdMpQN4tRUl^*fk@lsMV(*zIzd|9{w_Yh~q_n_iMC0bIavg-G#2 z;K&P9T!*$r@>8E*pC!fa(%1qk2h`O_u{*!o%t|9h(jkEn2vvm=wN5W7r5VV9bqW&B z<#3h2J&SPpEd4MY|J`ngi`mB?vU}$)H@{5*rwCrFqU>P;N4Du+7&Qy6Fx5Qu1tp%$ zDhc+nNzMw6tPKm<*aA#7k9VP(B#f(5yh64Y=;3If*4Vj4?`FuruBG=CD9z(2%@$C? z45imK&@FH8oZjWVKEGfmsc0_+Cp~MX6|x)>d7%irgONbXEp(izj2(Wlct+B3_(W{X z4DbAyO06@E5^%EdOxer}I4$eClJYefRRx@OTz$kgNEFr5=CujN*eO)eZ1a+wB=C6~q0`u5b^MSY~+2q_~62pMr%p z?@TqsQbe~VXPT7g+bzk4|Z*!Um1MP9)+RCaBWZa49r1>W=VQAfScw%$HlETm3HTi9dtqe5* zW1AC}3>-v1ch#t3$#dmOU<67g3!59Ojl;f3+unvW7nn+ANB07bR}iL1q$9pjUZkUc zT4?jj46yol`ph`jyus5D;s2$Bvecxsx!&(rSy!uW;N*Qnn@b;u6 z(6P<$N!U@q!sS0pJnNWWrhf@u}EX=esG}$rvNR z6`ZigJ|86TYx;v9OJxk6KJNuLEx~0iNb{>NGp-ggJT+A(DaAFGLJC}*$)cbR@4&-@ z3P^W1&4oRpUEzu4uJ1)0Qjv@(o|a~kWp9uA(}c9 z%E*|xP2XB5KD8!J;bdeqMUN;jCPB3mGFl0!+9Y+@*n(xOdooPn#PnN0HQ42K$}%$X z5DLZNtDlt=nG+n9ufc!n34bdnjYpy39*^$FgkLsvecSd9q`A_e-0^{em1u65}T1m<|W+OUGy!27>#?h=jsd!YP-n zsMSNZX+u%mw(DVC$04+ngq zqp&$OwKU_cQ@>Dvdm9Hg1Vc80i|&9w-SXC(PqO#ru2^n3OOFp*^RMGsd0D*j(k$C+ zZVWLpDC$Ehan`L4v9-F{=CR$BL(K9(f|yVL$^DW;%;{rcCK!f9G?#lX?9~FOY)+nGVk($Rn*&Xl zPz&bL3aoVBg1MaXVPnK$!cKoZNoCO$uJGyl-I99pSVWOd*g8w6A{TbG zunN{*uS<~&AKO?3DZ=8GC^#7p%3l%iYbL-Od-9D_cX|4U#tgT!)hRH$lVes6gEtyL zoB-LmIr?7r9Z?p+^x8IK&`@(`7u7c9?b4?m2%Ay~{|0AA>Wj46z2{%el~Q_qz8J>@ zyLa|LI+Y|~922D0CP`p+K~Ox$;8{U>B$~ush4kFRxv!4jDCYhyKKE9>Kmt$R%l*cS zpLMyC@#V-eZS0;3lkQ=rSy|^dE7safvT=-imp~kKj zX8maEb(B^a-iDZ(ag@xK_`*ZSA@Cruka=HDZnQFLpB_*1z@{Q)U(R9Y#s$>42T}1+zO_E0!B7TPemYT^STGdI>EAa z`ECmp+8NCuDMV3bMng+uv%G#!1|&$2D2TU&;~KQ!>h{TY>halk?|p~Gbc>dpKGE8| zUl6?oc#CR@9)owv|DQ*7E!(1PQ^{bFxB#xTJBKeE2A5#4&W@cgRWkV1iYVVoSAMlQ zlZyQS*%5e=R}||TrfD5SYb(C>`7s5=OF6_LE5w%5FF)J1p?hkZwtjTLiIAMfDbPv- z(3}7nUJ7G#Ws8tl+(s fOpyXW?rfUVsfb{q2KyL72`ERBNO|F;ddL3&`61Yy literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/mongodb_reply_request_reply.pcap b/packages/endace/_dev/deploy/docker/pcaps/mongodb_reply_request_reply.pcap new file mode 100644 index 0000000000000000000000000000000000000000..9f5ffb5555fd6416bb606bff8c612b8a39e6c662 GIT binary patch literal 1281 zcmZ`(&x;&I6n@jY#K}fvST-0>mZ*n-)pYkvdS+L|b;GU>COa{+?p}nUrn{!MlJ2Tb zRnKHc5a;3{i1_0o0VA%5z@8KdRrPzX-uGVj z_f_Bi@rPXpX5nxg8~~KiP}RTR{rdb2e1wLb^LvA@zWZtZ=Cgmke60l$C#CL)!}bNjpPeRyx-lhcT@zp%HqJDOA| zAC{c%w(9e^IEEMNEaUJDI{K`j+~hP})6NMU6KX6epq5^-q~sr3LM$=Yj)^OlkUKZ--5Q;kdHW=pkb;Cjs<+Gbo(NWh3u)ZK*r5n$7XIiFrNQch_l!E%{KGa zH;*dh-YsnC7pssjkh`fu{^ZWg1zA@E5_rU~FVz}LL4&NeH_-ML z$xb8egf+6#YPB~yXPPUW&DHbmW^4U5zf)TTCsi!wdM#y%f#Qx>`6sUp+!_smI`Ks zObAVqxcgAKEtaMTVniaTEyy%S6BGOLqEwe9%{5E#3ZhfU0m8&IkG9d`THEru$T7iI zvSKNOq#4hmEGM*81qZ=V-`FP{#rBIR8#`cjO6MC|vmv~Ip^67cGgSQXkEs%XRc57% r3l8T38!!`Tkr%5n5t73UdN&&=P=SAeWi-k$@AeZ+dHnr*6p*Ls!+XGE4@tL72&DjUWSiSWDHv=`%SPTp1Wz`8GH( zIIyjpu|`mf5hQmjd2~wiQ68T(wr%Iqt zfo9)f0;vx#$}CBBN-Rmv0IPq&%)r2zlb@WJ6Ox&m$`D@pSZ0|PS)0~?qDBsdscIT(D?;v5(p z*seL%GcYiM@TK=Wucj9N^1R3OT(LnyfZ?AbP>_*>i-E&Hk%2=rT@++WX+cV2Nvc9g zYH^7|acYS|vaOO5$g;1ZybN_f1t5&Yvb>s=Aj|e&gIUJ&>e73VML-Laz?LP!EmH$o zXa?jm{IOwVPy!mK6O>I^tuL$Yt#Tp;Z9uu literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/mysql_connection.pcap b/packages/endace/_dev/deploy/docker/pcaps/mysql_connection.pcap new file mode 100644 index 0000000000000000000000000000000000000000..ee83703282861c1043cbbbaa404dc3fd78daac7c GIT binary patch literal 2021 zcmZvdPfQeN7{8*LKynI-+T*x*dZ^>zwdc} z&-=^_3$r)>2(TKqx%vCv*Yns|aGLX4ebOreUrdV66y{qO41 z^76{$&iJA?j+08b{_8)}pHdydy84dh&zj>c>|^X(?uqh=p<;@yuQvwR`YfFjTlu50 z?}uYUdw=Y%m@J>mkD0|&x-*t*(MvhUIc--)8BuAq8v7eds5lj4OX;vo_4Y#K6%kFR zR}O+|!FwW8UBhAU${hs~N~37M^-smNUGPpg<$_+!x#qaB$ziIx?SyUTOq`5G^nAfI ziY{)mjBvpm;freYk~tdeY-?}p{GfWnxKVLTyBKO~{-U|1wN5V;a_&jHVuj9hwCnAk zM@kj@R3&F|p&(Zw$E|QY20SW}!|2mC*|DF)%E6`O=U3tQi8mxW-jAi;{|~hqi8O!e zn?>I)^rRA#?!57X+}EG<^Q)Nj1p3Z)S@iEkc~!`P=1eBaI#WJ$qy9eh)q@31UM>8p-WF!F9Rkr4UldE2rOXtZEj zrW=h@Gb60AN!&~&_|LxnU2Z1$r@%jlW{sFh zyBMnjTe#1*jFF0Qn#_BCZ{i8pX>1U8QVH{iZyu3(g!ws`zt4G+G7r6cYR}PBGMkF_ zCbP){$xJHh8jed1W*)vD*p+8;17Y|+48KH!hwlV7NN+!w75r2K`{a?vj-V%%U_O*+ zlqCi8OE52T=C3xGNpf&IF=tZ!sh;cxbJIQoz6kX)u2PAFtXpMST>vivc#Q++WObfU z6zfGo_0_R7?W1TYG(Q^LsIG2_WCj43FfU=RYq~=Q5cbxl)2j^tnDgQ?K#<_85&ZU8 zWBoWmB^>pw?Un_7N2?7>%P&IQ(U-Dd0}g3<0>5gNU`bwQ8ns;CK|zPJb#xDa4*>YzpV81oPzaaamU|?*a1;u8R+?_@|Mfi~+1D z=;fyn^2M2!&5aZcM>mT)nb>lObY{>J>0m=J>O1esWiSokG?noBP3V%$B)sl`*AkfS zdEF9I=0mJidyfvJH=eqUH)Y_TEu##u-rGOP^1^ZnmSd2A;BAib7%XQnN*+^^+9(SD hzFmfH7mld}cIVw+WnFPsdsLn=@jgt1r^%H{>K%FG{T70;`6Q$f}Mt?L9^<%w+7BTrc% z_rDm6vaySSfq`GXLP}yuVp3vpsshCN)D)1VxmmmnElJQd56IM`wp`d>c38) O#eW(Efd11!wG;pnicsDF literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/mysql_long.pcap b/packages/endace/_dev/deploy/docker/pcaps/mysql_long.pcap new file mode 100644 index 0000000000000000000000000000000000000000..8bb52ff8e283a82a993e899c52f0c463dc94bc2e GIT binary patch literal 183149 zcmeI*d303O9S86?EW;Qh#IP7yM0)j6yFY)S|_a<+Naf7&` zq6lblOKDwLtcp}i)fNkgV%54)YHTUgR%|6&ic19*q4!PX&owVTO70 zz4yJ(y~986_wJgNPu$y|I<6H%>W^EmybeI{vXQXVews8CxGxNs(BNA6+{yr~d7t0`<+d zzGYkSK=c=to|_bbvwh61Uo$hF#oxT0HMB7lb84Kj|janI==}%hHL0Of~SN8k5^}0;;Q^M2ystW*AsPdZ8Lq)457Vcvi}@F1DP6<*5@_|4`%F zVM=vpso|(I6_)Q?A}(#a`3k8M3PojDCCxxMdO#v&dg@K+m58$1xRnYlb-{e8u7Mkm zn^s&M7Y|c1VX9PhT8>D0u1r{tzKZ%vsZQgeoig=#3%9aT#-%9|mT!6b)1+(bVVL>? zNp(5=udi#ERD|tGh)x(KAv$3P5~35vNQh3j4++r;b4Z9zxGxFO33Ew^PPiWl(Fr?} z5S_3S3DF7jNQh3jKMBzZ^GS$K*qMargk4C8PS}-%=!D%!h)#F_3DF4)NQh2&APLb4 zyOR)|um=gz344+dov;@P(FqSCAv$4i5~33d5~36KAt5?pUlO7d7LpL1@L&?66ZRt^ zI^iKCL?q&@CcmoO132!7JI^i@Dq7&XkLUh8LNr+B(3klH)r;`w!@KzF{6W&Hb zbix@VL?^tRgy@7bNr+B3i-hQevq^|fcn1m53Gdt+2|tQ@z3?Hod4}+&$C-};xmct#23}<$$e<-SFKH4 zbDU0mP-G{5>Zmck(Qj6E;sZ0I#_FL)x;3vBy>j%L8Tx$TlRB}-fhw`1PR(s>+&F&G z7v1!_smtq-zpYzSqB`TwYTe8?lf|Msl)i9WKk&kYuxc$YE(0@=t|LO*Hj{Bz*k*<6 z>4T&%MHmRvmg-9>b+E8Z5qFbGH{q(k9p9=B&7ee#)RATwSVDTCXNiPsyPlBfKcqk2 z8-GYiSSjPu6bZ|>ywC|m(zR`=CaEKnLaG_<2Tc<=OfHKUb4ZB33hyEzI^o?UL?^t5 zgy@9#k`SHnJ`$o6){_vO@FyfhC!9+{bi$vK5S{R6Bt$2?pM>ay50DU@@Iexy6Fx*j zbi#QgL?@h2LUh6fBt$1%NJ4bNhe?P|_;V7X6Fx#hbizkTh)(zz3DF4`kr18maT1~v zE+!#5;V(#tPWS`~(Fva_C_%aF6311;0I^pk0h)(z_3DF5(BOyBB>m)=ce1nAOgm3PZgt~I3PF2o) z^L~04_SbuZbsvYstz|F>5 zu~XIRy>gn7uoZ-VAR+pX{TdRY6aJBe=!9>P5S_4rgy@8ClMtQoPb5Sq{4)vB3D=Sk zo$xOtL?>KFLUh9QBt$3tD+$pF-ytD7;onGzPWX2cq7%MLLUh6nBt$2CkA&!i{~#ec z;Xg@;PWV0v(Fr$_5S_4*gy@7HkPw~lLlUAB{)>d@gq!vZp{~W5JiDb@oRj0aa^}d- zvukn2Y^uxa)a#`c8MQc_b>by0CKhzkiIYcXCtg*e5=YgK%}#vvo)&l7c|Bd-GcU8c z=kA(ss_qe1AQGt5AqW|~t5ed-=KPDkM z;U^?SC;XIz=!E|vAv)n_Bt$3NLPB)Htt3Pz{G5d7gkO*lo$yN%q7!Z-Av)n#Bt$3N zPC|6T9VA32G)Ra}7$G4#VH*;n6SgHGI$=8!q7$|!Av$4{gy@7FNQh1tBOyBBJ|sjZ z%poB<;lAIIP}ky&yEkfFJHSY{9HYoEjF?eW(@+{S%3=e8!nbwh%poH)D`#Grl&+j9 z=#am8RZ}gF+GVG+A6>h^mb$*cN~rP~Vad=>x(N|j$&~AP6`r+qB5+Kx@;!2ZBwL7PrV7f5>Zwgw^D%>dcv1#8oTkhX~orXyQ|P< zKN6zRHo$vq>q7xR7 z5S{Qq5~34!Cm}jv4-%pi_9P)XVJ{M*6COlDbi&>wL?;v^L?`S+LUh8uBt$1HBq2KC z!6e*sg!+!`JJcQ7Bh-D^x;5R4-F#nmSs8|FkGp3lK0QBb^dD@b+pcw;gL@V>>O^r%MqTIPfhEm#ou4^7>pHury?YiWEZ_3< z_B=_~R-3>G(~(Ib6T!g3O# z6OJPxI^lUFL?=9-gy@79kPw}4JPFYWCy)@Ga3TrO2`?leI^iS|q7zOgAv)njBt$1P zNw^0Ib-j?kAZm0kH_~m_%9--q!cTPN%=Vd?l{1NM&6P6+lQS!4WWo&0Ksc@=Ql2Xl zmJ<{UUzgHIN5n%rWs2%h3b(RS#-%B~U6n=!C&eC|6uX5mPC|6T1PRdzEfS&=R+12% zu!@A}gcp+#oluexo$wM8q7z<9LUcl#gy@7x5~342Bt$24Nr+CEA|X0qH3`uPJrbf5 z`Xodr3`mGh7?Kd3u!e-_gqM*Jov@aK=!BP(5S{P}5~34cNkVkOt4N4Wcr^*p38#<{ zop34%(FyBFh)#G73DF6!B_TTDbtFV5yq<*Ugg1~7o$y8yq7zOdAv)nrBt$2?nS|(s zw~!E>a5@Rm32!AKI^k_3L?@g(@@&H;LBphkgn_WQa7inr5@4Cy>Vl1qh99Y7mq!t zF0bR}7oKTa>V9{tecVNBxJV_%g!9(szyot>;iBNJOmC@G2G9(qq>ZDP{z5G!b)xM03oP+IYWwN=y zXDcJ;$zP+sGNbjGbqyeA`MjA|9{(Q9Wv;UXWwlG@L^|shh=QJmxu9;3x-h zl+CjN>|=ndPy#5hI;-3Fco-&hJHzJK-0)UlP-OFL{%`;fl9Wfd(h=PV1A!ulI$;m} zZWQ$h&vS`M6J?8ICkULx7#_c#+kB1A8P$o$mU0id+koU6fXqjv);iYcW z2)U1eBpF6-n|@@=qUdlhh-hMi+GlV@qS{b&iNsk$LX#*N5}HKWkkBL?Lqd}{XGmxg z6+=RkIB!U35>-P&lc*UIn#6=5p-D^{5}L#XLqd_Dn07IXX)1o&kIHa|(wnOBljYon e)ekCu{MQ!tDWC#MXK{z67-#_(Cfai_Q~||77-BZW9-s{z3^}|<9T@D{CcXrj4zh*k)v11v=|Efd zHApZNr5%RY@TK2117r)(-HeRl3=B-nDXD2d6B!K|c+v$Yiz9AWG>y*GBCr^+-$Btu(Tg8F&FgyJon|f`+lE?r$4*x%kJRr z^?iR{-}gPc9_E=WX9c(?w@;h-(?~wTvwXy&Y|Cvp#rN|ZmhB{E z8;^4VoZZMmi{*KFNXWx+6y({&=UIl=dLAt*DSCK;l!p5`Ie8^*GZ!wEMsH=w(zfk0 z@H=+P+FV!EUKU$2r*=g^3b(~JHaE8T^w1`)af2@w+Z>4o4fF0gtEGzv_~{asf-^AP zk9L-_pO&Q;u{A9=UE8u}9XJX&VSc(YJe=AwnFjD?(NCLOG!oGzN!Mb!!%z(fBOd*V zJA9b9>fj6<***+)*>0#laLN&a78`2uk!%N!0?vGMs4l8dYW$`2a%$5Zn`pDI@JQx+ zpOza`1>c11B96XBmezqui$x0rbO#RkuH&M072>rit14>L6=lmSR;hWddQ)khTE4QX zs;s6W{;+YK)}lpy&5eOj9&Ou!ZAG(9L4I3iR)yJK#J`wi){H*{j%fD%w;VVMIK0^| zn02w~DcZEP)@Z|nJd&C1h1o(xyJQzF1kPG;X)&{PzrEwYQNVeUH=8+T*6WRFu~;b5 zQsisZBY{Xb9MaWA>dMMWioD+@^34{0D`vA0HZLLa_jZv_gCp9^e9D2NfMahH!Hu3? zvx)Y~MIOm)UV_b%@eaDWL6#PQNsHNBaOgn?4juGd-X@)L8u?lenApCdULMALmB81P z@qFz8NA%TO@4)$QUk7cX6@SSinXfDGRW_cl`<{^{4fE1szIk*&(!)@bs%;6y^cenv%P4uBk4;6db=CZ)%xhUj=Cw40|IV(5ySG`r z)^|B@6mSwf?4gSrdskxwqlcY9iqX2?cCOJ zN%YX*m_7UqFfr7L<2;P{s)Da{ggS2*Y7iW;hn2!boZ~3q@VtWRQrUQrGB28uw4bEfKL!*L$sOHnPcoXBDMDx^qpSsBx z4Lt9Q=07s8V22JN$eKCa4agt1-=ho#>ultfDUqpIJGM0!~77 zKeb2@eHBPC+9yMNG$y(lqWywsLiW>$M}D;yQ_gYVkmy7)4USpN^MHw=N=kVco6`?p zwFuRps z%J0g=h9Pzr(tmB2Uj5xFHvLlvjsi|X>;SdK5bH8N`%r=EffU7_7cL@9>@JAif@p(D z(Fi#}oJoIJimOIEf+}9J7dX0TV;L)Xu}0uPyMkSMX(qS_+PMg>3l7fn)VG zz=}xOXwDaGqCKJTNH*tQ_}V$1uSI{#QZ<;gSP_@c9dY20uQIcU#)$NNEyWYlnzewg z&h|7#BVnV89wR6=5FMUg&u_pS?u5e*1U+MSuo*XH=?FHW#e#l#v(JH}fb%vV6!Khh z4ql%U)SBG%xgqhx<#YL_WJwEw{|5`-N->n(^ZYJ9p0~z)-UR#uU__F#Bz)zYAcwV7 z_Ljr%CmO#e3pGe@v2ch_&yK4D$8{SP&e~b%{L5PJ)W;n-3OI>+pQE>lS?@D|iJ?At zh=;MGxs9Xg6pn^q=V-WLaKw85UGBi4qe)y2431E5<(4(ttUWxE`RdeiH8-LqU#ZM! zyTK9bU31leL+`vqy$w!sy**;Rdu)Oh3I`H*sJY?r7=oToI#@HPGHk84tC$bUaTIV8 z^)@*FU%kCZFE%Ol9zH!gu46c^c33!RXQ4hd#lktf(Sb9a;|z{9a)%A);Kw|N*=)zD y^a-azoIz^#ejARzTl{L&NyV?7WXNC1Ty44@dK9>hil zATf|xrs3hMF92y~s3ao;_o5ak8$^NBi2<=RZ=Vf{lg* z3e&#}aPxp{paM=HW&&afkPATJG~o#|!w;YU2m@UJ45t(FY40x=K*EXPMNYBKl?>iX78zi_+pM3)fCtw&&1%*`u1H%SrIDy=X3xNF!l7zbtq7vD^ z{6HZP1_6+tK>+Np|3CoY!by<7KmhJHAX@`0!oa`^riEKU@x>5&+QE{^`Dz1*9r&pM GEC&Eo1Y#)w literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/nfs_v3.pcap b/packages/endace/_dev/deploy/docker/pcaps/nfs_v3.pcap new file mode 100644 index 0000000000000000000000000000000000000000..fa489c8b5d3fcd78fc0a8d1a2667bf1cd4d6fe14 GIT binary patch literal 426 zcmca|c+)~A1{MYcU}0bca#(EkAKWF*$gm5@24Q5t!Qjfkutu=Tfx&@I>q0#P10x7C zyK^uyrq_rzIa@b3NErY8w*V-}$iXGj8Q=xN4Gat=3ul#HfSSa_z}U7J$YzFOkfkyV zZl}dS{KULWAO!~?IbD$#D$43=AAlS!PB95R0=UwYVfcEi)$-$N~8z zB#fOQ4af#zWB~R_M9_ASPhLKQ`Gf=L7mzQ2zUgg{V7B?^1NVtH)F%p1pP;)8WH=Lu v&;i;ib)KEU3CIRvWB|6+M6eoUtF}ALR%rP30&QO2AOH+M4Y;kvKwG^5CSpd= literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/nfs_v4.pcap b/packages/endace/_dev/deploy/docker/pcaps/nfs_v4.pcap new file mode 100644 index 0000000000000000000000000000000000000000..5fabb74fd2255c5903537660cfa466d50335ed4f GIT binary patch literal 642 zcmaJPk{`$7%Wy5~Tx4(VMl4q-HKvQif!Olx(-&lcY|E z&!QP7Wg;z)=tNYIRIo}{jC$R5;28WruHjs{hjT!8hdpW+^s=q(^)+W}6Zdp5++KgD isVpo?N8oneUxM56j&d9R7xiA%eW-aR9}SCt+?v0Lj#}#g literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/nfsv42_clone.pcap b/packages/endace/_dev/deploy/docker/pcaps/nfsv42_clone.pcap new file mode 100644 index 0000000000000000000000000000000000000000..2ebea37a37a4659a141f95115da8f6ae112323fd GIT binary patch literal 580 zcmca|c+)~A1{MYw`2U}Qff3006Kojm-OS7o2IPP+1CM6@dTAhe<;x=u23H0~4>=|W z1_!oT3I|p&hybxB(=!f6`CnW2HOt=K)gZyx({uu85+euK5}w>#rAZWuRg7 zL+%E3WrVa8f(d4c0ZAD~1~$emi)wGrYi#@ilV@V!V5oaI_c)NR0K_=e&GF)3sE4R? z2kC{`3350H!1&A%E+)AEEW`;ULGG4d0QwFT%4IFg4BLPLAPfm#5rO%4t(JpAnPEli z9#AM7vw=bw6w(}wOwT|eEdOiUC15CD%b5fTWl#u%Lb`#0p#U1nFo%K6g#vXED1#M9 fn}XOdS7Qk|IiNHMg8(R0KtKUZBKW|NP!|CJtBqxO literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/nfsv42_layoutstats.pcap b/packages/endace/_dev/deploy/docker/pcaps/nfsv42_layoutstats.pcap new file mode 100644 index 0000000000000000000000000000000000000000..04eaa4e97a08fbd7a4d0ff48d82a5094e1f24e9d GIT binary patch literal 744 zcmca|c+)~A1{MYcU}0bcat?~=Mz<_tXW(LD0AmIQp7|ek#;9>sc%*SKxH2&Qk)H3s z;J`L#N%P8`SDRPvpTJzr!I*0i&ggpRb610enqJd#1_nk(4z4n>=|3-eA6eeOz<8v9 zoA(jaCME{Pw#7g;$ZC*xPfMq*+^B4_4EJrXGNc@KaAd?AUHXB$kP;44l9fSlk zkqD5RkO9bFSAdwgB)I@2E@o(KsAp(qsb^>jq)m+V42?|nOe{fC1l6`lMNC~AN<6D(G5%)z*MmTlsXz17!sf<13eUh l=BwKP2@n9sIEaCW84wSYa^SJf59EU|2!LW92tfMPZ2$l&Z>0bL literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/pgsql_extended_query.pcap b/packages/endace/_dev/deploy/docker/pcaps/pgsql_extended_query.pcap new file mode 100644 index 0000000000000000000000000000000000000000..559dadbf49a38b884b6feb1648fe5dcf03c54b82 GIT binary patch literal 1561 zcmaJ>-Afcv6hFJJ>*hz8th(yUm=P*|P1kWge*(^1BAd3dJ%<;EPAiN=U(cZ8FO`4y1QpS&Yk+HGBWHoo5N0sANP`o7M6u;Ap-cp=e+ro&SdkL=>S6DV!xe;ke2)Au}zkM^r5e{h{m4 z(5VR4Cnn+yy88kUQWI=Y*BG>ORjCi@BNIBXhr&?g;kd2{Iif~Y!NF@$pAO`}RotB{ zEu@vDm?WR`Qcp@q_c5dg!F=E|{luIG1+#V}2c|IlWT{xTL@5T-=d5?0isb>`*aC0| zkz54VhgPJFj>grnB2-oj-C^KY?CleSR4!UN} zly&2bF|Nd|@Erx7(A+AQ`Pe8k%$yu9D8c-UBhtwP(C7bVaF!!sXsK(eyKHV!!5Jr) ztc;16Zm5%{qGV2Kbp;oS7Ez3d9M-jA-AG_^WiAZ79g+2%mf2glI2ZrDWn$pQAiiXF zQ!1vP>2VN=&1bm~z!$RAdVuy)JQi464JYfNx_oOXP#?s4&^bT@L1CqWqXRE4 zWCKZ!LqGCh4&7vF8Xw2rnWqlB!SVhQs7H;hsB!!GilwmzHTHCMgrsU|*w7P_U|dKK zV$5KY8bP5KkOOtJVp3a#W;1_C$$W-Ryg7r^(k%IA%1!wne&-!^g*5r|rK{#~z^-t- zTUEEB{8^G;`}DZ{5W;)Gu14_gCk99e9Di^CSVx20c4SpRF7SX!tb$x%qcFO?Uayoo kD5`mf`Wudg);o9he{FHiET68F(9U9LSA*CRrw0K30)`aBpa1{> literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/pgsql_insert.pcap b/packages/endace/_dev/deploy/docker/pcaps/pgsql_insert.pcap new file mode 100644 index 0000000000000000000000000000000000000000..90276307f8fd1c03f3f56e3a287f5ac945a59d5a GIT binary patch literal 355 zcmca|c+)~A1{MYw`2U}Qff2}=-L^4AO`C_I5y%E%WWd4T%D_-8`rLuRflX~rJx~J( zPyQ)t@vm(a<7NN(Mhy}I4FA%Bf{YwojD4;QjGg*31A#`^W#$#97L_Pu=9T0tl%y7y zXe8<=Bkls h4}_5c*d7zn7hsRyg4qN0xC78Gj|Kst$2Cyx0RUomPQL&E literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/pgsql_insert_error.pcap b/packages/endace/_dev/deploy/docker/pcaps/pgsql_insert_error.pcap new file mode 100644 index 0000000000000000000000000000000000000000..976737f921ef69ed51487e05e882d25f6129fab3 GIT binary patch literal 650 zcmca|c+)~A1{MYw`2U}Qff2}wYu^~6ugT8P2xNmWGT>lvWnd^4{o%miz^2w+57Yp{ zlYfd@{A*iXaM^$1YnU zG!k_bl5`Z3H5JMdb4pW-HPmxc6HV216o7ORlukBP*R%#Zh)J8B;VRG=5Jm=I2OZaC z1v!Xc3+5nEi^)GhjsZGqJ=j6JksJhc6wnh4lY(7?g8YLRoQ;f44NMt)Q%VbRGLsWa zQWdgOD@C^a#qQX#b>v$&*KkHIZ3sRZJCy<`R-V@q>}p!lSc_~eY#h~+g}iJ(QS?esT@S_ocDZom~OpjJ$%+Y{(f$6W(s~^Cu41V z0+zq+!t$q=H^{|#C$)?`Uc!5sHK=XUxsyqk+Qi8#CFg}7b$BxgW&D?Ovb+13IbXl) zb56JR3+5x920)Ar5S5<`b1&CX`0um_!kQ2JJ)CvnoDX+gxZlIuCcNwZ*Ej7t zy=6|^Y;UyJH*x+l+@|X2HC9h6q-55p#&I~5>S?L_t5i=P`by@ndOB<#A3fchBK35U MWJ9H%SjiNB0A^l=kpKVy literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/pgsql_request_response.pcap b/packages/endace/_dev/deploy/docker/pcaps/pgsql_request_response.pcap new file mode 100644 index 0000000000000000000000000000000000000000..1754020f2fca07c9f31df34473fee5fd2754ff59 GIT binary patch literal 503 zcmca|c+)~A1{MYw`2U}Qff2|_Z`>F%qk@Sc8psA=WWd4T%D~_&`qY8Jflcj5Jx~J( zPyQ)t@vm*=i_8A=k{Tog82&i|1sOTG7(4Z6GIq)u1pz>% literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/pgsql_rt.pcap b/packages/endace/_dev/deploy/docker/pcaps/pgsql_rt.pcap new file mode 100644 index 0000000000000000000000000000000000000000..764f399252c93e3cc667915f29dbccf48be5144c GIT binary patch literal 3012 zcmb`JOH3PA6o!u;5mq=Z8RbW{)fYfZNs+B6GC{kBlB$h!?Cl&OZJ2Q?45B8>(t{?Y$ zzVqMz+&O1{{qg&6?cfCCb#w$Uk3T$ec50`;33&WY1Hj>gM)n2YI2ZvKEZ&Jgr147d zHh_&r9$G`5n~e(n>#jZ5c6b56?u@vdcFyI_?iFa>=5RQO{iqHbfY^iU2D>$shx~8T z9P-t>r*m+eO?-p>53+|b77YvC{l!n1?l%p#u3JTZbI#*&9G*p;Hcc~eN$>B$I$nIr znEjT_He{j~l}r@IIe&TaJhA^mb}hZDC1QWQWw3QGn$e3}s28mCeiv$@9I;{HL16U> zW8Sl5wjs02taqG*dIxF?Eq=yK7%-r^vA57z*Ga~PFEzneD3peU&|L9zVvattWRkI} zStvqyZ~!bQq6`^jJ^^t-6=noQ)P4z>OhSqYs+3MeQ$kXojU^;8rAEb6EFG6pb1*ge zR!F-Eu1__=I|!v=p>JsQDKm1-(5ENIg~{2%ae zjq7^w1M*j@E6o0`JG;MYuwO%Vtvi;_G2KJQbgv+P&3q$hT+$n8hVj8SD0sdANQ~>aAJk&zRH-3mP}KH(U{{T z)N#I!u^%%NE*a3gWXd1j&mwt}y$1bV$n;M!ElhqX5eoAc@C;hD8aR=2<^1c#QzMsSnZAO$=Z^#M-Cz zE*4-fgOsz$cp!E$<`?6knXn)P#CUwhAD{L2#e%_$v;O|xaCjEj(UUk>wgDT}!EM>@ zG1{Hyf)QNb-R9EvhKqK0gsS!62e`XE+8syxn85Lpbv37@cFU4ZE52bt6(`heLWI$Y zYv($~hOaYNyOdJJIZ=*c!w^*|DJqaov6YucaYbGf653Unw4%<*xJ)#!q(qg4j3~2) zqhHXD&1Vrw=6=Ey>npgbU<-n9Pj63efRSENM1|&}!h-sKT9%erlhV2tUD~OrLMkrE z@n|fanoY||Y*bN2mGPsj)HjK`Z=_QqB+@Y99zVm3>4 zZZ-BqQy4T7qn(Nk7uU7pHrIp$8z$z!i_GAJ3#Kswjp}5>7|$LM3a?r+sU{2=$u6}J zlbUXuA|}L`+VOhFtej4EsG_0{00q1Ew+mMB4>T--ebYV8?wc2kVA{#rapTGAWcSTV zIhfa-EwxM{r3dT+encFAM;3hGJi-^ij5cSloTK{h0h+S)(pz7}L?2D~FXQ`j6C?b{ i<;jjd(3~gXf1>c3-Ge>y9PfG?o#_0$+4&L)_x=aXv7EmE literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/redis_one_transaction.pcap b/packages/endace/_dev/deploy/docker/pcaps/redis_one_transaction.pcap new file mode 100644 index 0000000000000000000000000000000000000000..8f8d21733eb9bc1b36e9ca73dd7b59f2b972b999 GIT binary patch literal 233 zcmca|c+)~A1{MYw`2U}Qff300rgkqRF^QWY8OR1o58VRa;+h6rmAy>B zbWj0HKc@Wz>#uHdF)%m@j1qLou5DiZDPoU36QU7$RMx{D+cNXm{XeVSv} zs91L~VxxXEOdc(E4+4DvXe$U**2AFH*(=%W`lL;fz5@}6zq>PAx;Ty4JJldLQF;X$p zIMJTOr=zWjsF6HkbVlOGu@l4Sr|qCF5Xv>Jp92|#&CjTQq=YkdN{Q)vyff7RH}4ofXfi4?og?LUM=U#|J$Wnx=8HkTaS~>b(Zlf ztdtpoOqX3Ia97I(dTX%%W02YWsK`mCoMld`R4LO1ndf$y;2=`({$EC7dx3SB%ng>A zddHqa=AK=Ku))C^T;y@cyx8q>x?et)>7F8U4>B(~HLNBR8mH9h_p7jEMAG)Soch1X z{V!G|IgFR+|B1bSB8A4O|1U`0^vfd-W2LC9hc~Msv-q#Wc!K_4aq1S;e_aWs@-VPO zaa>39r0tqur7#FW{uHwXHj--^a!vLYix^WxUO^fdX*x)Ns}yh1|W2GZfj=QjH+Qb;+NVfaiia`MNAkoE7&gLqTl5F0sE z_TgMDBW48(yJ5l$NCvgLU&kbo1*j2&9-@KRu0?9_Ji>ENmPY^`=l8mC=14%1ubP3z&rp6ztY z4jkaXof}6!_6INt5C|?~H#QDv8aE_%KwRK7@g*d9UMFeXq}58>OhwwGKB^tRul@S> zJkRfaetz)v?e_!BIMcUrW(-a~zm;5DyLOU!3@6n6Ho@eXv7hdx=a{)u)enPA;05sK zPTxI!ckH{V6H0MaspgTRTars0cTV8Ld{_(%Q7OvDc%&-j88OUiZv~fBat(e*omYc%v*}{ZmAseS<+-8Y z1$=`mnD%vS*BlAOVbydFX}VmsZ4n7!%QAEgySmw&acWlo@)BuoxSJ9}NDya3!BB8Z zhRLSPp@>NTlp<2fkv>+Tpd)jkpe7GraAh9B+=h%>HQhupfC^Qr<(c$q8AU@uEZeTt zz?Kw6+faJH5^c+D8tqV!=D;720}Bv;>VETbK*A3h$bo;ppz)`9;N`%%$;;g!!!mhP zwcC1g<9{9R6^GbddIQ2Ip@L0_dQqun7r2I5yW*I29nT2iSXdA_k>}Qv0_Jh-%~)hz zcZb6Y@#x?>`_@UO1Z79vZxq+@H2$9A`uA-=uH)QU+{0A_TuY0`4O6e$h|?6z#e5ju%QH60t~28#^6NjQh-H(|U+qoOzK zCW{;cvq*1hMyp0II}T71S0j#Q>lUS_{>{VJJ2M(E2yejPR-=LKHeD?&q@U|gV7QzP zA#`+lZy?al1N)PE{3nXBP_RN8rc1aow%xWz&C@h1x_rMgLC&WvI!dN*26U6MY<&xB zZP~2XQ}8Z?H07r0y7qic_EszDSZsIO1b6u+F~q| zS%}8lc(+!h69`&Ad-p@T;Yz!x|I~Ipk^Ga%c$AOK&Qgj!6rCS4)~*ojPg>xQ{_zb~u%Dd?J4Ec6!h9`sC9IW*H<7b-z(y$FuccDX_o4 z=LdFt=B(BO_TVySq@a3xVSN4&iyL zC~Ofz+6&g9l+FN~_m$3mAm?Zn{6!wrh0|~Tmsq?hc^+Rf+j93q$PQoqc}ARSQk4s8FINEep%pxhAHmo!U-mJ25fv z1(?|w5epL%5?R;~>cRqi0hWG&a?XpCwx|UJSbBzg^qil&|NZ{Y;rrJwir^9$f5*oF z6vU!G_2KrL=TqQQ5ex#L2GBRax9^4M?Nv|##r~sZ0G>==li$586c3NC-d_tCMb=WF=`SiMJhiD{s3ShuA^}nLpis&dpfM zGkg|M8kD3)eBp+Ybcc01N_EkJ)U*g8Cb1RWFlf^>>HH|Ak#UNM`Z&s1kU8+wStgF` zP-Gyt6Gq%)0W*Bt44Ae_ImK+w<$K*Q;i-oSLhg=-REmUNm0{L_d0I57^Bo786prN{ z_T^Eg+~rX#YdcU>E%dT>oP-A~3**Rvi(!kW8SJGziP$#xqf``{HbYd`ux05sZ4%20Z0`FU1(t=G-wfoEbdT*ROL6j;CCyYwAg;MC zE~G59#N{2h%9A+fs#b^98mzVBh{Fw@q(T5Fz*8v}l$E5CloM`#ybK-+-18W+J>)zm zys!$uJTRx9ea-34DbEQnIIc8e7-EEABiRq5)*nD}_Wk}9zvntF;Q_N10)Z;8PSGg@BC6rhu$TSWE(%WbUo5?)0s?)x()Te!ra4ZVx{7`QEC! z)vw>f+`XIr8fisa&QDpH{ZDg-J>75RH}TeE@UM79!qvsHI+ix-XmyOStl5?ofmisa zKdfgiDKiiX|Fn9> zr|H1GYr`Ep6S)racff1|W8ft{Tkf1knbPwv;7-V@*6iET1|To}kcDoI7*5vzQjT<+ zfNmzvpMmoPxZovydL`dYIm9Okd^%B|tOzRtetT?2aAHR1sTo1|XDiBzctjL&BO|&j zKnL)MHV4roT;Mwo>7pMz?!!p}jxLHB6;aC;Z43jbGjnbX9Y9v1Im}G9N%Rdybo)pj z4ll}8bdIR#8b-8b79BuVG#jSA2Z$c#DjJikS2XpK4<`vYw^vbHv@Q&wRrE3)KvuK| zRCI+&H1e>{NloQyQpx^2SP(izCVw9+|WZO;A>958_qBfuBA-K zc)l>y{{V0=7<#C1beMktrn;`upQX&O?Rf#XUqW7Q4|VgVGn_X+p&aS(V~k+TM>I|6zp6wZ9}Hm`o|gLYR{XD zkH>?tx0$-h+x<&7UbfhWgFUL;cp|PCFvhT&u|IS#>abajcqRDtMV|?Ld9}aJfCzrM=B6b&eYP^dvzVALd zl3n8giBRJ{V4UkY!rU5{F~(PZU<;^VUz5+D8BW?M%8@>O{c?TGaDMwUilDd42FK zgEw9B{fY3AeOBCNcNv>G25T5=VOyvm`qdy9L(RNIxi9p%ZUR^DDduM0$ha=vWz4)O z3(o}I6=N!{Xl%P4V_Z}IM8}ZxvkB%0I~D7C|0z9l(F;DDM4r=~;k0{=a%AoLz&vj@ z`SfErorY45%(dAs*8+wU`j&Etk0IA`hO;=Iay&lR&)7O|`9a_JNi`MD#X#uhkJ-a; zmJRzp6JK-o=qZNzz!J)Yj2GuN{_Q`3n`+qinXvCO9p-sps(awA*_0W!JyU`EHRSc~ zd%?nepT}@kwxS&A_BFbhI8A?yw}wDwyyU(g6o{uB;)DCXm%HzUkKFf_@gBCzlo7%4 z8ENCjVj<(j=8sNEeJ&^(Kr#%bhTo+x8Z0PE&r>Gb4Zj>XPXZq=Dc!r*6e{frKTkA( z&YCp-R$W?{Ze>i1|A&qs%Q6paFPcp2oQbzmVHmum>5zH>9}c!EcqSv;>g|*__9>_0 zxGtK)fNF{Jj?)2UX)Z#E*MqqC4$CcZ4sb?;G+t7C)U!Q&ICzIOSQF<tWXS%QjxCG7es1I1_n0!wI2&)Jfj?d{L-2gA4+k?0(lX!yrY{qFZCA?} zHDTQ3XEVo+42~F`Iw3ex1b7DqRwtqBIy$gD3AOKmNjL=o4tZ{K-AO0`j=Ih(75Z?J zfYVtEz)ylOjX$TG&aFpBkflBarEX&?^=O9kc>^B~y$zg%EfSY+7Q>0}OF6P~ZJ=_e zmC7M!5^}N`PWo=jk-1JYxm?bAhI1l@a)?hNnMs$ko8hecf^s}QZIwE^oDr~N;7*1- z?!Hq!zAptrbymK$8-AJTn45&JMZ>zlTJ2|;MK!1!WW2Qf;i?Y+caPzi6OIn^5HQsp zaHI)khHcM1z-f=?Ys;p`u3==e|US~Kp z)m~xm9h*ZR54(}0FYBedC!YGq(gmS(MJAtkhI253a%8R|zg+DZPLH*eLwpRmQW(z7 zEtKQ&dCrvUjeNbAb{(s5E(bzYzxwzioMgjWhAH@(+xHk|%wo!fjF%5ByW=Www;Out z6j-)X9On1HRJXvScPTS$du|8rHOTAjrGkaK^$f%L>k!J3Zr9Mw#2H!;Zw-XZc*$Ox z(oB7H;q}2@+Rg2y!iVho)-ADwaTeZa;ZKCv`D0)hHTH@+M%|;J>+Pp*>@OJIMX&jA zuu18<0||nd;W^;qbaxOS}C$x_D9*3ujym zDKLy$-8AL7ro9-dC&FS-n}b{3rHt<7VN{oJu&>@$b&2k3Mt6w%IL2OcMNr+QP+jja z;OeGd(__!wM|I^a*&Nz~T+Td>bDDBw?50q@Vw2Bn45!Q6lp}qL{c_#7uIH*%Ksm&R z=9-HA2A4(R4V{w{M>!s!W=byPOhwK+MS5?&YmUOX5(s6S{%9_)Nkea)imy3+@HE4$ z@I7Th#w!IIn^gqvi-z7R93AErV5-|-{#nWl+nz51Hx}}Gd+RhO@2?E!{neBs-D1&= z;Y`E2%_)wzf{+<6*;`W&D?OU{U~ld3_Ez+nCVQ)RwAnLlVg}Z*D!$`}Qo@Cu0smeJ zHrNr-X&1quY7wTtY?R-qOu85p#H-`7to4Dj#`-4k|0Q z5oWNJNj~b9&Kdl<4~Om`w+J;D&RzQLJFe1JuoCbgx3^QdoLUTLNE++2$uC!LhSUCD z%8@J6_A%s2V>mq@qa0ah^l5F%wZ25}44cm=oV-Bji<&!%VA4&UVLHC%?BaZe`G-A} z2^sUA+&2F;;1(M?!*tj^(;a3pFx7Q+v@&IeZO>xhz7Bc4ok6g0Q^b_&oa_2Yfo`v( zn~C!raArbgykuvX`jPteBCij2hB0nu5I(Xqi2H(GspGMPm7y`<=Bj}I0zcRt@WLVR zijr3}zIlY7QqeJHFrk{(q{Wd1hfq7)D~rJ`PQ@}k)XsDt4t5MZ6pGSN)_)PICdjBW z9@&P<*fYMfJ`&>iO%C!68CoIp9U$hlDD4kn+43}>TyXDU|C&JKRL z!VKr$T|PdBT;DRB)-xza)){>cn{w5SOwgW%^{k+9@&lncSB5Tz1!C$XGw?NM*Y{_b z2k)dzsCoYCTiyEscZs2s%z#cZ!(k2urn;`)E27M>?YRWF{UNWnlL!`el2Ht2$S0H| z-TI@OiSsvx^Wh7WLwpi>pDhe$>QKt@_$)Q~Y-cz>_o5u>v(&FXXBketMwCN*47si| zoF{ryj>l(!Dc8Lf^!0gnU4>H+2sIgaY{c!Z&#nyfg*lW784Ehpp7%a*N8Zl*>;+79 zeV*$^nPJ;=ByiW6^7dmmR)BJ(+d6bJaee^KD^L);qTO_~1!5#Xad};@*=d zT_t>0+beT)Mj93vzMI@V7La9DSsWg0c%FUzb!96$CLUhJQxASk>hKY<;xw!fXT^yB zR8UYL4!uGqUxI#EVeK*B7RcxQXbrt);y!+`VuF ztz$T&AE6wN&m~ixUrErL$oVYd1wWkSZQd%ud^ z3)~_@GnoYodzQmI08DjV?X60gVcW9^xceZl_plQz+$4t>PW=}tN4o7pHxp-AEMKMu;JisHombg ziL>HyyTQ*d@a7foqTvUFrGt=Kpobo(Lgm3$byOCFTcC|q^k5kid^mXPtOvuID8aB# z{ujZ*AfyI+UHOE?uJo#od%vnw*%YjERh@HCJvPM(k{sGm+yeDuIB)B>&#<~HRbF~w zRVS0rGYlthHZ8Qw)yXf{VumwY`H0+}cd~8Gmve&Q1~F`P!quC!;fTb$o)F8qzY(*FJ@>Jz>m2rX~8XAex2Y4v8|YtBlGNYa_XQp$vy zU;o#zwGRU~$FO>{VD)A>%&NdtS8t*OZYItg z;Hay2Wk(+$x_X7re_p+d7~9n^(@|t4(e|XWTHMrofioCp2rs$Up2|}0P-OK^it3?l zPj|0rwka7C(#AfIb8es7F@2|IjDqhfVuf=V=jB&S&N)%w?7brvV}*dztS~~G@tbWm z4)#FkGu`5{$TwrJ?7-fKoB<4HaT(=!cFL=C#*uSn2XboMQ&FqoBU>q_d@djt-YB>= z%=;BrGt4-aU-T<)4Y86=4RNd?FqXR7kE)Mk#IDSVg89O4rFyy+j+OT-a!MFZ;wtKF z&%5N18kTcf->dtqeUfry_SEGKbE4^-mUFr>oFYC~v|p~jFr59$TU+8o?g7eub~7An z4b3I%gFeGeb$+RCMePwOW^zKiCSz*;DAnEAj|*VX>NQD)fo3;-7&8G5>?%|f?Z4CncmC`Y;-MmH1Z#_uay z!yq$WvM&v8nL#RJt{BnWrjlY$83t!#4VSU}Zzq(HCdFui5R$}tb zVL0`_rQWjMHiz~DH~%jTCp&_2WF1Rj{_#%&d+S(=YZB|2&_K`C;b+Q`K0TRS$SFn6 zP=@oF(&vZ|&E;|yGMpo=j6S7IF5wfpU+)LGF$(ABKq#i|&Ev2JO#Pq?Uvu_uLSvmd zZZc&;#-Ho23GW8(2}3_9gPN5&%-XT4hs`itclSsnWhG zrYhaafGQm<|2lhlwO@EZuTrNbKAa@r=vBf3vv(r@zg1cR>C`oOGM}ci*TAie`fEPL zj}6!=wP{jOyF;&f-iL!#a^GLt)%IIU_9;CIMp11`-=?G3EC160F>P-x1lw=8IklSV zwre;0aFT%I+U8rhtHIVdr?zcd7)7<+u!xQ#Yr7C?i!0D$i=*U=mHZyVsr8f(Cz0oz zV>rE)dvjU645;2BlTQ)DIX0d3S>%_iOEbMbnabCOh>s!HaE8;4U&H8=Y0A~QmEQ9Y z?oo0T20||_$bT4iv*8@c$JXbbBTE_P=HF2!WGsyOuJkx?+wx-`|MP=tu}7wXgIbf}`jZ|f%T&nXc^_P!<&g*VEOGk1O*seOcj{TZ zox#oG{K-O}hwdWFSa49Y93RQnb86IgWp|sh6fvC0PkcD!eOq}=>bKE--f2!b_8Km` z8`jA*lTR~-lcPKhlIwPwU#?jU=i6i-A49HX4Cj+El;iQKrR0jlJ&F5hQainGTzFmK z6v3b3t)2A@PB!!nbc}TR#x`K8>#EBN$_(3{ zlYv_XdA<8xurTi~hSTdBMZNAbzB`q8Hb9(*-C7$N5B739}ao9mhW;pGMt%T zP>x-~adlwU-!%F3WH@O*P>#&?reCi845!jI${{|6TxS^0f+))I_~6qO@6vGV^I1o| z3#7cSaEb$=;+-|O;S%MaO65o6YtD{s)k$ZzZA_VvvH1JlN6rBELqivchP4pwFgpQL z-3ldzlo_@?KLqYs$m{I_f`#iUnc;L9MLE*#EV`LE?*OM4WX4N&f#eU=?_zj;unV+z zyMXYKT|j&!JYZZJoX7Bkl6x4*Wc?8o77!&5D3j}kZO~blJQp^GJs|$D0fp%tODJ~D zBuX?PAwkf%w8|=0wrT=VY-AA%$fnVliXkzLVnBhANT|Q_-kIgzcjxIOmofwMo$vha zd3WCQT*vMY(nN-cJ$ibqzg-_QWtRIxub70Vw9>F93o+rJ%M-+eUP7!A!bR(JS#ER5 z#l_R;U2SPSJ-5f=|7H~Z;7U)=bh)zJK+FXiX8SUkncIB2tgf+SKe**> zIeI2>W6VWhK8_l+*mLZ`8#0qU%fW45-EZ{ww}(TX{fI?wO&U(uF`2_|?c|n<^A$Kx z!-W?6Og0K-j^ty&XPoS_+9h0gd&ZJrxE4RH@J?z3Zx+koBtahpFX$Sb)?ycYYrX@= z0LLy!y~%<;fYqIt6_ml;xeq&WG?n0hRt1~^4FTY7847Eb`9vFy@l zWII$^=_1rn zBYnM9uECLZA=1sMA|3UyJ<@qC4jehsT)L#;N^K^)#v+{xysA0pu#D$OHzU#;iYDQ6 zX=_e`^8#wn;z;MMd)a|Qn&t6GO-@pzg=4`HZe(daTyB#}Ppo(^X}qsg%Jn$j8;G|9 z-e;30Hty};;uW(&rN!RU?_1%(F~Gs`&!Z6Yj>Q}ECQ*7=bK8U>YRJ=9%SAZkj=ILu z0gyeXlkEbh22@%sTebJB1IGXdCx;?Sp?Wa43#uaxRiVIAJjLgptLX1X%twYuE4p@q z9-Zb@cSU1g+#pxAqAnePsIS8QjLv@LR7E4*2UL3#uZK5S{?$ zvgY_9R8URNXpf1~!jg+&4@|$)h5MeywBT3SlsC!Z7~mvKhthS-$AoIiSKKa*srx~> zf|Y65gG}k3AbAX^!cf{9_ja$ChX`nKrq6Z!=)j>dD2-=oa$sr>v6<=8Xg%K=c+6Kb z>jI%r#GHeBQA4p^30NCvvU|hJE$R$(D0&iqway&73PxOU=1WnGMc4 zikxS{`IIi_3p(dPva`f7z_B|ga!z(Ob51y4(m2Lcyg`a_vjE6Sxt=P^aNfx^_0BmYVb2sd6pOXCrcMg7ZmT&IO;?o%iKCa13zt zIa{Yi!Ws8LvU4$Nsm}FZ%e6S?Cggk|)oh#sNB#J?tT;;?nvKNAM;@I&d~Re}*I>Ym zxsN^OZjEvu<+Yfo@6fxkGCNH ztA&Xut+ueOTQ1GJ&{@}5mV*{f=vo-~nOB674K3b$wu3fw}`MvOppwTpv$!Bxu#kFq*>00wF&l{K<~ zwI7jm>_;g&`8KH&GRUVy#2)*8+`8$&F~CXehsoiqLhgijA-*4dt#9RSYd;VgRlf_> z)h@ogBv9LfxULwBO4qzG(2`$^JBF(5S4&)yCk8VMBU<32VLlydrtpn1}p!5-K6br;KA4t70)t%2WRU9dlE z{IZqb&vBnMW}pAl?+=aNmgbaxjj8 zx7!=_Pjuk)mkzf$XNZRLc2MSUU@e%qwW$Idq2YW!Qs!`9Yn}S4({R@NWRB$1U%!DX QG@SnXWKNP#t1jn%0cXRfrT_o{ literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/pcaps/tls-version-13.pcap b/packages/endace/_dev/deploy/docker/pcaps/tls-version-13.pcap new file mode 100644 index 0000000000000000000000000000000000000000..ddbe348284465785a6c8df0c04af8be8b9cbb645 GIT binary patch literal 14332 zcmbum1yogA7x#S*-Q8W%DIuVAiZlXJ0sN=Yb!bST{&(h@2N64G5F-`-fS zaPRYt_r4CNLk{p;bN*+nwKj***0L-Z2pr_kA2HRoV42UA|f6)3yvnG)| z?`=Nv=G{PoNI@W?;9pUM37DprP`dYm-9;NX(ApG1DkI>FAtf#6=XwAJ1`fUg3JZ$> zg(9J#4>a5XKL-c%gRa7h0g(ef2JHv;#~K&(TV*B?h#LY+7DxtHfYxr{5No>g04o@0 z;;d4M_g&D9;b4$Z6eI6{1L?p@NTA;z0kSwi1?`I8JU{)$xa7AnK$Xmc~&@K~U3Vskrlm3xNgaj7|DDji12@(llp)mGP2#hr>EbM^eoSHR^ zee;+OTKK2yijR*_7_4Q2q%>*i2Cl`RL8$atGJHqGBr2Wnb92(d33q9!#;cv+zn;IT{fXLq^1Wb?hIx0pQ0%G zSpldRT(mtFtL#zG)ZPQs>5s^SzIMW*LpKsAu+M~AzoRwB9Y|rIS@JZ`scZ$ln$7cS z?t}ZnBj$RnrY;zAS1!T0kXlsLLumYn*?yM@URH5NN`B-NC0fV(L`)X`y^8pQaCu`6LAgr;XS$&i2Vgj>9W zPy-{lqNc}FMvbZJf$!uSrhyI#1r(kp828~a?8s1S=25X)rs>kYO#hnq_xEUmRo#;0 zp2?=ThUMf~y%0?G!H38)A5v9Tr^$wrKaOe5u};+#e!_#TlrDQ zijn%rK*MQ*L|iir2mw$Gpj{?Hk;*JVBJ;pM5{V$&ZM?sU;DFF1fQ5zl0!`)#3%mOM zk+HM8%i~zKDmxBYPnwQilP_{1`kNyMs9h>rl*IqPt$_=8!~A)&oDh@_o zOL*fDNS3Z((Ye#u98OOyrp$wR7tj0C5sLJ6puk{Y;qU+_pin~KUrE;(w_p#QXA06{ zq{aK2f$79|Uhs1c_%FWfIDenTi<^D}(FjpkygqUXtMzSk`17eIN%3pmj?*oBt#S(rI$t$%`~y52Qn~{Aj&7d2gn0JdlZm(ZiNAP z4A4NkLUjB=93S|5B>f~3Awgc^|0WuN#6KbPioLj}Lq$-HRa=}-H)_(ALW868CQ(L4 z0tL$m_v3xky;Jg#?k>6Ex5JGmnF3GVpTofqoL~O-$Qbkpls}iOw0iY>8iq;k8bgIKE*rq_5@X-_;qG2m4u|E zi5560J!72$S*iy*dd_tj`}(L8^$a>xMkm?e`9&EDTh+%sTJ)gj zX?kw2#LOb*R13Ty_K(evtKb4RW^SU0x;hOt++eoLpICVl@Uq6!xW0TJT~O@{5r(Jd zSF)lTXNZB5hR0}lA|YXE>bI5ptOgUR55U+bf!I^wAs2QzcKGlgu@6;UioN|;e#g46 z#Ex)6s3}NZy$t^+efdq zgzf~3-6haj7@|x`@cusX%!dC%TLZZ$8@#v&ruZ z-wpUw`1%xHGfz5Dp>@jAO57idI-vIf$40Uwo*`moyAAS=91G6^D`u@C>Jn6GabS{? zCU`gU72^lpHi686?yu}HJlL7ik-^H#&Dxb5ACMsJH@_WkT)SiZE>?%$g(b$BNQ`j8 zH=(GkuOmXqrqHya^4TC_{q9i7x%XUjZ-+qVz=yQQOE*UImHMNWZ}~e{z93Y3ck18C z(&N)QfnPvJd*Z&^p6;Ojl4{2ZzLTiCYOTmbe7V+O45inQZDwjoB9*%B}m7W0#F z8^wVA{I=nxfUVPwnMwn<;3h4W1_J@DBhg;Jf}Ri6nYVj7&^>Yp3F=woj%mB|luvDx zr#C3!cO)jGE9=UnpJlhug!5}`AEGOmOBz!LU&F((fsbu7SP

DaGSFx1o}VP1ZD; zQ%XSB%T?teh~N4^)MP3(8ZJ74pZ;pQvQ6##5WZVZyr@Q!t*v+;jJoUMIgC&P*=m!h z-*7N@Qj5vC8^r*|)D)D&l|{vUo{D&PAk^9vZx;n2UpkIWQlQQzYd%L$L}tv9u6RaY z_QXh^q`10<`E~rXp?2$OhH;49NE}gA_A+ui5t@(?8@-me-5ideWz0OM=Qt7TTGwn4 z6(d349saW+C;b)u;a_>j>?B_K>}fhQY~~wU3kQ@&12s+rl&H6 z9*7C^xt!EGm#7mWJ)<>Vpfbw|(+b;f`po&Y@r*_yanSE|W`43KLs4<9=nVfx`5}=- zQwba#|D0+F_l;J+WhqfpvYU$^na=wSU#NS`5q>>|90V z7A*OorL zfXzto50YNkgNfTX3VeHuX@OzyzLr&tvKifEcdAkE#x2H$Ah;0`?9a6Li_=8b&+s_r zt(w^G>X=PgkTX`jx9jGgus04JrE#7ZkZ?7T3B)Rpcbfk~@|2PAo=9->p8OJ)nUA6g zzjd6n@rzqXh#0qfo_r~iO$oBr!XGzSlxS9{{=A})^CoQ9ZMCtP#rx4KPYh`)A*e;x zSajJ=K|RTS=hh&VVAo!L5eJW4npA;p5DC)m`{Doi504!0_!Xim<9+m!H+ zXn9#lUS^ytBy{JyK_5=t(o&yobJV|`)|}?)fEK?X>Rg<1$mP2_Q|cgo_{K|wma4t$ z)zh3~OgZ=zmz?9oD6Efq8_Teb3u%5};#r+BAP2zF1hmVEhb;d*o@oD_c;>cWi5J}X zJMrN0q&Q7HZe9BRJ*qM^Q+Q*cQV2_w{s%1x(P z>}`Lq>wLY5FhD50l!IkXt)=UCG9yQebnGy0nOQrpB9<3NIO$>9EpA!q<E%sZHw zuNL_1Xs_V&yVs+YXLDIFw`!Jx%uyrn$UKGOe-0zEB_ok8w?7yQkAyMEejU|MU`~DR zom`C)EAX;Ec#+bH>OP+tE4S(cZKp7H{2WYBg_T4Mh%*f2!Y&`zVIGwM2S+yqriXtY z*FBI^1Zhcqf#Z7mzz-FG0~$VXTsHz#fNmey^Jx#vHGL^NVMGX_@RulzFzZLXON1(5 zB}~2AiOJWG`P_!CY9_kB*l1be-m9?#SP=pwpYWJB9?#6h1Fp-*OB<=N>{ix=87;Qv zGWnDB;$U(1_D-bdOu>UIxR@<2`1ir2A*sDsc4ZBJ_r1@bqP+ zzWdtV>r~PtHqr0$b`8hTjaI+;xmt&i!F%xM`}9%@lLai4bM{O=uKnmm?enb3y^V*G zaXGe|L!o!nzJ8{om|y5cK#Bf+L87hfhE3cW6KhyOdPN0mBcmOXMl{)q(6Z?-(sIJk zllnDs#c$$w#;6Gjvg64lvtB&!$4(qdAeOp2!ZM|W%6y6_u!0pdzNx!Zz-0_)?6P#n zT70)4M*(M)82@$Jpy5WxKm=I=sRSN7s&82!v?y0~O8Z-ZNnWt%bMw4I;vs6E(?pX) zHG}zU>&LAP>1Qpz6hRY3>8KM=TC))x4Cf+t-tj*9a;M63xI{5NRhTVUsD_dWH8plY zc|un0Be6BNVv1xU%OH(zV|04{X+pbL0B5s3Qr8oAG-|74Y3vS-s&O51{s4|vG^M(m zoZM%EY^82IVC@T}G0rkmG+_A0okO(IOK~PkidM6PU;7$4q|UFKUxQPXddp)zw1OHm zGM_}{5b$*4l>-)5b|v$JO|S}8lm73oLoBYunqES_Scr$xs)6|#SaKm>*W5@D+TC(-qSn0S@Q;tCK6u2IoR^pL#>k>`7CJ&WAkXs^Tqjd~+QCnl)m6C-3nm|nJ=i#YBX zYy!)<=IPiJ_gR@f+|GNgjEN^vypC9C?}1lP;$tlIS4WBC#|vmiWE$`88*+XKdvr!8 z$d0=+AmF?5#=bCes{H-yTlWr3P{JqQ@UmJNHRa&12WU~j z&%$bZmN|I$n>a&4D(lDRqO-U#j30HAF(X#!97P6-=OyZ=(&TA-lRDfOI|}LP-Bb*Y z*g22vm7}*}yeXt!-0)azTur0R0JF=E=&gyJX@0CrxtMgOcv`U9YvrK8?Cl7T6{ue4 z=Vh@Cj0wj+%xzvFtS9`VO#BvwieHPp5<~QJ>GT<<8U>MZeY^N1Nv*(zKr?}zIOR5@~Qb!q^ zOg`s1|7L&Fm(<%eF?mBYI5xOj!h2WX$D%7nzSuiXcmp zFHmHX`&Wt#((N09FSBZd>p}ZYR;kR&Vc$_m{*_oAJn7I!bD7ucN9_ZOfw(X0BJQ?Q zJYSySUa%t%RaALE?P0Dox-Ff!5Y<1NpxDHsRz{c{iJz?aDgX(c4QE9C-Wj#5tG4rW z`&(>uq~<&&!9qql_daH?UMWDsb8h66x zieS4lQ}>T4-#+0sTkhGzN%BoqVbZ)V`QR}ue_}c6QEFJ6dL(1QQY~(w=-C;iN1BQ^ z*{AtHPf(v3K%bj{HlSV6hpjB~LZ2sp>*EVd&ma1DT3yv=?_tT#to3bAI!8ac^*!al z67T-oYn}VDl>z(`s@L^jDsMMzupX>E+EZ3YiE<7V&*WjHn7Cz2u8*&6B#e%e%--LO zwOlVbndeMhvT3)-p{(oex7|m-(o1rWsGmcxwl{T}*(A(hbBubqV|bXW%74y4FycOP zi1{l{!t((_VxyIh`++$}4Si6U)hv{+PQnf!;LlMA8mx(Kwe|COi*5I4nguM%M>|0M9r z#;)`8=(2R_=mKo)etN#Z(ItZ6Zz6b-pjpo{{EUuhW2Eb>WUV>bfYGYHO8*2KL6()g z^mN5tO{n8YiU!&8=UQ8{jxDn}2foCa`jm6iUnFpxZ1Fo~4_vGW5O z#1Uv|&@P7pefaZoJ##6PhF_ty{1#_Y45R{~K-mgOUo7Jpe%6v_GGvCXQv1{@BGJhS zqP|)uM{RwS-^_<@nlGFZ?P~U%80n2F5wD!wK<{|v0Fo4j5sRMbss}>l3yW4`>vKA*H$R;2F?ibC-tMti zXbf7t-(7>InaH+*)vL^oo$(U8xyFRN%Q#pK%z`8?hYGTBcAUlLGbtlq7QuS!Rg~n9qp6cw{vu-&yuW}J+Q>x zyS}L*3`yiQW3oLFo-|+%)`1+X0s4b>B?mtr!;f8h49~jtD+hzyzsl)P z4sy@$vG#E!ex(sGEl|A;`_j&j#i;FJ-_GtGm*Q(HQx14m)mYDazK)#a+tIG$Y#gTM zRIQ@o>+LGxl+6)gL4D#+_m$bgxoU%1yi{0T=FUr`atM`#D2u8@q9ygI zdJ8VN@t4}?bXGr}M{K3db7q@g{e5RK(tvtkSlq7EQPZYey;i z!BmtQ2did`ZJG@K17N3ZeE-THqWp}SSzF~hJ*;U+I84lFRW<+i7DkVDbBkCXbvm}2qIT@{;u1CXKr~aI$6qFv1nA|Lda2)* zx>}U=mD?~w&fqbZ_=DHw@tdsz@g*e;vNFHU;Sks{o&?763SsTn9>!rR`ZoI+)n-|1 zCuy<{2RQM-e@r)((tZ`eJF*epakXQCE5iYeDp&pTf? zxNC1i#;NA1>v59couawP%`xu#eZ`Q?5X3eIM+rxk!#;@$@zQkj~bm z6>^x+SxX*QJS`@(7nu9vk7y7K;9LvZ<=g`=K}3NcGmVM=-GA(=i$5L4R`J zX|qj2VRj~87%7WjpjH5@JNhi{T$iT~>dTLhrqwC4i<4*F2b<^H2{%k{p zTP*n)`g_Z=dG0l z^)!d(?nrvNRv46`6gNg>A>N}b(Y!`E9=;&72tTT*K=Z+guyf84-UrqMX}oO-Pzto2O-*CzKK*qQhOt-{0vOGuWSm=NUX9&+VU#*~%#w z7#!DQbE*);^TuA;GR93qOG}GYwuQ0<$kD{n}_>L5i%|Gi;f zo%iij;Jhc=xH|7yw}5$1g&qHE-n%2A4@`=IM2G)Pq`n}oUnR1q0z?+f-}k*gL?_h$ z=_AbraqTLR^C3Xw!$7*~qmu(VL;#qDpk0m{%F@mX5(!uTkw^sPv-bNRF;W*hhS{+}zV@EnM>@Dd%pN z&Rd}bopr;v+Sgv~Oh=@9n_H`P?h5a>jqu>OMPV79_YsdBkOn{fXpx|RAW%RccSjhW z=pm_(Xn<=ofA3;O%Q?ew#&Q|;8A6aQJTmL~NEy1Y{1K5;MTl?XsPhwuB+mRT%KXF~ zp6%-K;O_~@+@gaN#R*a|XmOc4IlAbH#JHV?pVJGcpUO$;XT}GQJlzmh!f5mtU)>eH zFR7O2ys$-!T9LmeiHK=9J6uCL$dUWWWS{o=`bUhmZ`>HhV6tNYA+-S!LAxTPd^_8P zkllX^`S@;%AdnhBNN?ahMn5jj?!SbD;y#XszNa=-7$8b@!BKjZoH0458QX%Y74TqXbJ-*On2?CZ^=`~!QP1*xrX()vhulg|O-Sn~?3n#nkJ-fN z-DVJ

)4s(LWr^|MGb=-t0a`(yPHS>cfdzD>2NHryX~M?iyNEuQ&-M7Vq%|?M&n+ zlqT$(DY8EJ{hft~95selPw2GM1fCkM0RE(<#~plEQ0W;!X>nj& zgLZk0|J%C-I3E&gKE4Z_F~1?8{7@PwS5w7EcUq80;rQQ({+0mo5bp3QQ3@cM1O9<_ zxf&q4?d%tg`sVLy@VER`4P5+JssTd#jkc6#@%;6}M|T+MVPCc#ayo|b4GUYJ?X|yX zBE(M(6&O+jV^IfI{`U({JI6n+9RF)&1;eW=)7*^Znbx(AG^Sax_mK?95nXwzM{T97 z_s((Fj*g1b^Sym=W8o?z9$U?RW-LJBzw~t!NuCXI$MWQCsMiN%($A6*U8bsq6x%K(sYVbUY z-(l*^V#_v08>}mF;BwE(S-8o}T?RvB^jz7Sp`ojOMN`ZKUl3U{h>`q|UE^MEOvA!G zR*o%m5bf3%zM0ibafr0=OdGBd)b%r<>pq|RF$EmNqlGsnkJ9*O==RGj|{c-}BCd&XLb! zZO+r)CGTM1)Jq-tg&BN6mv2o})? z{Ko@g)ckcQ=bUs3C7tdQDMeXY2CGhF&V)?%KYwLw7sa12(Lw4~L&o^nEMf58jfi*` z&AMHFG>v;hjq=Ymznu{CxF9T>&A=Mkjl;q{ASiF2)9}NesUzWKw#IrSHLJV8^6Z`+ zo1NK--vp-M?bj?<)*wyoHd z5|$bCAguQ3b$6Rm6Exh93ODAGJWer>-WxqL?4Uv|ZbJ;F;LGE@Dbmw-@^!QQ*Q`?x8A-(?7EaLRc3#u?%RHshY64=Kk3KI6UnXduZ;*! ztA*cL#jAz|BEy5;4i9`{4U07dn&IZ00);CLT}WeO+heGHt0BjZTaG z>c5Aq(lHa`%3ai-iIEc|?jP{txk++G`aFh3)5+N>E7jTyE$wWuIM#r-PX0Q7T%F}> zsNgK$fw?-%x#ECXE*ducYnHz?KnJETNF2iZpG33^BJ?VeTN)tV3B|igLwz(G4VmTj#dq zuIvV(U%@r`CK{GrUslXf&%nei%%s-RIYIAFrtk*+Mj92sb3UMJW*ySI$>m$7K8I#Uj-f4Tno0oP+3~-rzao!XQ-F>8l zB=CyaHLgsqR#DIDP5_=^;JI-N`fPb82LAPq5l9#_@sbY4DArT`VNZ!kK7_RogQSPv z{aVG7^tD=La3=(7eiGg09K+6IH64*(TAuO_`o1LW>RAPIy$9$x1!xG`6&?H5XfJeB z{aeR?(iA};Gk}g?s;=k=jeGI3nk8+mmHXtr%SU`{AA7yEHL|X=rns|$Jl|eDXS#;T zaPxGAG$J#fUE>U4#q3a*l1X(fh=Iwdh)y=If zH){Kyw!0$|HC{+vn&ohj+N$GK@+564f?0Fh(}Ae!@U|JB4vR=qlB(S&Nu95Wv?4~k zv9zsbtnW6F+#27X45~<^V~x>?cczSe%1kzlOR{esodPpMIA!2YAn_ouzII<_EbCxX zh`c9b7WU4Z_k*$Rn4qT-ceJ|)3V4h+|?ajAu9-O%vLupgtusspVE(erJ7PgF%@McI%O=l7-GPfkoD0 zrs9ZIZf1;LSo{1=JYC57b;B&TiqHtVU}rUQb>x}2?1RH}qdj$QQI3fcUapfJ{TWdh z*~wr6x%^~qFw?hO|McMHP2}J1DZJRkngONYJ;fLJ6_1O<<{;5)#mKjAATjr!&y8h@gSJl5kE|iA5{rn&m*%oP~u=NBG4uhTvBc%Bfwy_UQI>u;0#D|+f(t!)tur_ay zxIyB*(?q|b#JTr%^c0lnj0905Or!ZDH>xrl*;5lnpNy6ulySU%#HC0m%lGlIP7zH4 zPm^hiw$|ap8lPL1TyV_N?(KZH^yv)@rM7YEsb5nC(TIQvngZnf_siGXHBip&=D(Z! ziS#cypG*C2?%#6KxN6K(Cw5>feo_}K4Mv$3G!?TkoCwOpQrky8e=AsT=d=wj40Zc& zwe|$qK@hjSrv9omcaTW^Ux`*1#PX}eZI3_VTeJLwe zKvwv{%`kxIcUD4xB7Y6h2c9Iq{12h<{|Y4lc<;!M);`$;TIXUjr1=v1l~bfPcDABT zlumKt3zHsQR0*$dxcl* KkB|TF#QzUy%XSk0 literal 0 HcmV?d00001 diff --git a/packages/endace/_dev/deploy/docker/sample_logs/ipfix_cisco.pcap b/packages/endace/_dev/deploy/docker/sample_logs/ipfix_cisco.pcap new file mode 100644 index 0000000000000000000000000000000000000000..365e936d2eaafff8cf623af4de2aadbb55575265 GIT binary patch literal 4358 zcmb_eZ){XW5TAX$yIx;8q*7YIioH_APz*t9DlH{7M&cjDYS0R`AfXQ=pz#AjqGBS7 zAtVYh(P$*(4x0u|q==v*jT*{n#R3uOw~B_uKn2AZ4B8m+_j_;mZt1nPgida5W@l!1 z=grK{?um{)Nk>AGfsiN+$`{l$-qYsD;js89kKh%D(;qL;s%WI9u%nKhdd^sZZq~fYE_>W0E zacCZJF$N6j2!eA=FBZ1F*hS%BUMzxcguMu-v=kC&?7!xO|%EB#x70mShR83fnsqdym$*bGb?L*EnqzkAJoorZTx`k#cm1* z^5SWDu@$=i^Fl8=T%sP)mSJRM_MSfHA!I}ypfDyX)juOS@x))(LTA2pJovYP@YshX z_&2(x;A6lja2v20sCDH(fG2P*KyFPyrNEBGhZGJJi?zedh+cHKKB_q+za(7F7oG)meB^4=>b^)xHRI_Bm#Z@R=Ly z>92^nN4!Z5eHZr)nc+9%iPSXfyU$zv(5yN!7Y3#>m~jGY)CR{r?oF=ieRqi!i|k&! z4YA-UHZa{V{pgj(%GfLS=;?{8ihgR2NRO#@mGT$2sy!#3tSy1i%$ftX9b?mfUbpx+ z!1EM9$A#2Q;B_pDzW`6r=QDz{>q9Iye?t#y176e~|Cl0nL0^@*qdVpz7Tnc%;p?yd z&%LPEi12*4-tx+bJm1|yA@%jyNKFMY8@WJci#^D)i#>=jfqIgM11kB&E6>hFMm%I>|0xOw%E%eS;v{s& z3qAR2N%WXrA=kc_-lGuTQ12@OSY<$yt60(g3h7AX)#$lPrZ67`-_o>9O1C-PS#J zM=dfER2QqPe@6a@C%!T>x!^~GY-3g(M4c8JyEMg1u;_`3Z!cMOk#+7<5!^~V&jtpI zh0)v8enA?!+1-poIPPKBN~>l%qO%8qI37 ziv#Ui(NXrJO&xFaTY(iByGj$!0>}W9@oM&AEc->%_E*+f8OeGTr)I~Kb9mn~&xAE_ rh`qo(YuN|zvh{DNYS5iPe79N!oCjXpJ=G1Ku+jg|+47=KMb7;P4K$O_ literal 0 HcmV?d00001 diff --git a/packages/endace/changelog.yml b/packages/endace/changelog.yml new file mode 100644 index 00000000000..fe168b1461e --- /dev/null +++ b/packages/endace/changelog.yml @@ -0,0 +1,16 @@ +# newer versions go on top +- version: "0.0.4" + changes: + - description: Initial draft of the package + type: enhancement + link: https://github.com/elastic/integrations/pull/1 # FIXME Replace with the real PR link +- version: "0.0.3" + changes: + - description: Initial draft of the package + type: enhancement + link: https://github.com/elastic/integrations/pull/1 # FIXME Replace with the real PR link +- version: "0.0.1" + changes: + - description: Initial draft of the package + type: enhancement + link: https://github.com/elastic/integrations/pull/1 # FIXME Replace with the real PR link diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml new file mode 100644 index 00000000000..7d40f8b2d97 --- /dev/null +++ b/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml @@ -0,0 +1,6 @@ +vars: + interface: "{{SERVICE_LOGS_DIR}}/http_get_2k_file.pcap" +input: packet +data_stream: + vars: + period: '-1s' diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml new file mode 100644 index 00000000000..d185b5ac134 --- /dev/null +++ b/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml @@ -0,0 +1,7 @@ +vars: + interface: "{{SERVICE_LOGS_DIR}}/icmp_2_pings.pcap" +input: packet +data_stream: + vars: + timeout: '5s' + period: '-1s' diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml new file mode 100644 index 00000000000..af1d6962cbc --- /dev/null +++ b/packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml @@ -0,0 +1,6 @@ +vars: + interface: "{{SERVICE_LOGS_DIR}}/icmp4_ping.pcap" +input: packet +data_stream: + vars: + period: '1s' diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml new file mode 100644 index 00000000000..4b6304198e4 --- /dev/null +++ b/packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml @@ -0,0 +1,6 @@ +vars: + interface: "{{SERVICE_LOGS_DIR}}/icmp6_ping.pcap" +input: packet +data_stream: + vars: + period: '1s' diff --git a/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs new file mode 100644 index 00000000000..58d32879557 --- /dev/null +++ b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs @@ -0,0 +1,42 @@ +type: flow +{{#if timeout}} +timeout: '{{timeout}}' +{{/if}} +{{#if period}} +period: '{{period}}' +{{/if}} +fields_under_root: true +fields: + _conf: + geoip_enrich: {{geoip_enrich}} + map_to_ecs: {{map_to_ecs}} + endace_url: {{ endace_url }} +{{#if tags}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{/if}} +processors: +{{#contains "forwarded" tags}} +- add_observer_metadata: ~ +{{else}} +- add_host_metadata: ~ +{{/contains}} +{{processors}} +{{#if monitor_processes}} +procs: + enabled: true +{{/if}} +{{#if interface}} +interface: +{{#if (contains ".pcap" interface)}} + file: {{interface}} +{{else}} + device: {{interface}} +{{/if}} +{{/if}} +{{#if never_install}} +npcap: + never_install: true +{{/if}} diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/compatibility.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/compatibility.yml new file mode 100644 index 00000000000..c85edad3b01 --- /dev/null +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/compatibility.yml @@ -0,0 +1,32 @@ +--- +description: ECS compatibility layer pipeline. +processors: + - rename: + field: flow + target_field: network_traffic.flow + ignore_missing: true + - rename: + # Retained for legacy dashboard behaviour. + field: status + target_field: network_traffic.status + ignore_missing: true + - rename: + field: process.ppid + target_field: process.parent.pid + ignore_missing: true + # Remove packetbeat fields that are handled by agent or fleet. + - remove: + field: type + ignore_missing: true + - remove: + field: event.dataset + ignore_missing: true + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..212ffb757ce --- /dev/null +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,101 @@ +--- +description: Pipeline for processing traffic flows +processors: +- set: + field: ecs.version + value: '8.11.0' + +# ECS compatibility pipeline +- pipeline: + if: ctx._conf?.map_to_ecs != null && ctx._conf.map_to_ecs + name: '{{ IngestPipeline "compatibility" }}' + tag: compatibility_pipeline_processor + +## +# Set {host,source,destination}.mac to dash separated upper case value +# as per ECS recommendation +## +- gsub: + field: host.mac + pattern: '[-:.]' + replacement: '' + ignore_missing: true + tag: gsub_host_mac +- gsub: + field: host.mac + pattern: '(..)(?!$)' + replacement: '$1-' + ignore_missing: true + tag: gsub_host_mac +- uppercase: + field: host.mac + ignore_missing: true +- append: + field: related.hosts + value: "{{{observer.hostname}}}" + if: ctx.observer?.hostname != null && ctx.observer?.hostname != '' + allow_duplicates: false +- foreach: + if: ctx.observer?.ip != null && ctx.observer.ip instanceof List + tag: foreach_observer_ip + field: observer.ip + processor: + append: + field: related.ip + value: '{{{_ingest._value}}}' + allow_duplicates: false +- remove: + if: ctx.host != null && ctx.tags != null && ctx.tags.contains('forwarded') + field: host +- gsub: + field: source.mac + pattern: '[-:.]' + replacement: '' + ignore_missing: true + tag: gsub_source_mac +- gsub: + field: source.mac + pattern: '(..)(?!$)' + replacement: '$1-' + ignore_missing: true + tag: gsub_source_mac +- uppercase: + field: source.mac + ignore_missing: true +- gsub: + field: destination.mac + pattern: '[-:.]' + replacement: '' + ignore_missing: true + tag: gsub_destination_mac +- gsub: + field: destination.mac + pattern: '(..)(?!$)' + replacement: '$1-' + ignore_missing: true + tag: gsub_destination_mac +- uppercase: + field: destination.mac + ignore_missing: true + +- pipeline: + if: ctx._conf?.geoip_enrich != null && ctx._conf.geoip_enrich + name: '{{ IngestPipeline "geoip" }}' + tag: pipeline_processor + +- pipeline: + name: '{{ IngestPipeline "endace" }}' + tag: pipeline_processor + +- remove: + field: _conf + ignore_missing: true + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml new file mode 100644 index 00000000000..eb88d38caf0 --- /dev/null +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml @@ -0,0 +1,103 @@ +--- +description: GeoIP enrichment. +processors: + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + tag: source_geo + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + tag: source_geo + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + tag: destination_geo + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + tag: destination_geo + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + + - geoip: + field: server.ip + target_field: server.geo + ignore_missing: true + tag: server_geo + - geoip: + database_file: GeoLite2-ASN.mmdb + field: server.ip + target_field: server.as + properties: + - asn + - organization_name + ignore_missing: true + tag: server_geo + - rename: + field: server.as.asn + target_field: server.as.number + ignore_missing: true + - rename: + field: server.as.organization_name + target_field: server.as.organization.name + ignore_missing: true + + - geoip: + field: client.ip + target_field: client.geo + ignore_missing: true + tag: client_geo + - geoip: + database_file: GeoLite2-ASN.mmdb + field: client.ip + target_field: client.as + properties: + - asn + - organization_name + ignore_missing: true + tag: client_geo + - rename: + field: client.as.asn + target_field: client.as.number + ignore_missing: true + - rename: + field: client.as.organization_name + target_field: client.as.organization.name + ignore_missing: true + +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/endace/data_stream/flow/fields/agent.yml b/packages/endace/data_stream/flow/fields/agent.yml new file mode 100644 index 00000000000..a55e9f71b3e --- /dev/null +++ b/packages/endace/data_stream/flow/fields/agent.yml @@ -0,0 +1,196 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/endace/data_stream/flow/fields/base.yml b/packages/endace/data_stream/flow/fields/base.yml new file mode 100644 index 00000000000..0d1791ffed6 --- /dev/null +++ b/packages/endace/data_stream/flow/fields/base.yml @@ -0,0 +1,12 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: "@timestamp" + type: date + description: Event timestamp. diff --git a/packages/endace/data_stream/flow/fields/beats.yml b/packages/endace/data_stream/flow/fields/beats.yml new file mode 100644 index 00000000000..a7cc3bab23d --- /dev/null +++ b/packages/endace/data_stream/flow/fields/beats.yml @@ -0,0 +1,95 @@ +- name: request + type: text + description: > + For text protocols, this is the request as seen on the wire (application layer only). For binary protocols this is our representation of the request. + +- name: response + type: text + description: > + For text protocols, this is the response as seen on the wire (application layer only). For binary protocols this is our representation of the request. + +- name: query + type: keyword + description: > + The query in a human readable format. For HTTP, it will typically be something like `GET /users/_search?name=test`. For MySQL, it is something like `SELECT id from users where name=test`. + +- name: params + type: text + description: > + The request parameters. For HTTP, these are the POST or GET parameters. For Thrift-RPC, these are the parameters from the request. + +- name: status + type: keyword + description: > + The high level status of the transaction. The way to compute this value depends on the protocol, but the result has a meaning independent of the protocol. + +- name: method + type: keyword + description: > + The command/verb/method of the transaction. For HTTP, this is the method name (GET, POST, PUT, and so on), for SQL this is the verb (SELECT, UPDATE, DELETE, and so on). + +- name: resource + type: keyword + description: > + The logical resource that this transaction refers to. For HTTP, this is the URL path up to the last slash (/). For example, if the URL is `/users/1`, the resource is `/users`. For databases, the resource is typically the table name. The field is not filled for all transaction types. + +- name: path + type: keyword + description: > + The path the transaction refers to. For HTTP, this is the URL. For SQL databases, this is the table name. For key-value stores, this is the key. + +- name: type + type: keyword + description: > + The type of the transaction (for example, HTTP, MySQL, Redis, or RUM) or "flow" in case of flows. + +- name: server.process.name + type: keyword + description: > + The name of the process that served the transaction. + +- name: server.process.args + type: keyword + description: > + The command-line of the process that served the transaction. + +- name: server.process.executable + type: keyword + description: > + Absolute path to the server process executable. + +- name: server.process.working_directory + type: keyword + description: > + The working directory of the server process. + +- name: server.process.start + type: date + description: > + The time the server process started. + +- name: client.process.name + type: keyword + description: > + The name of the process that initiated the transaction. + +- name: client.process.args + type: keyword + description: > + The command-line of the process that initiated the transaction. + +- name: client.process.executable + type: keyword + description: > + Absolute path to the client process executable. + +- name: client.process.working_directory + type: keyword + description: > + The working directory of the client process. + +- name: client.process.start + type: date + description: > + The time the client process started. + diff --git a/packages/endace/data_stream/flow/fields/ecs.yml b/packages/endace/data_stream/flow/fields/ecs.yml new file mode 100644 index 00000000000..7b52299ab76 --- /dev/null +++ b/packages/endace/data_stream/flow/fields/ecs.yml @@ -0,0 +1,144 @@ +- external: ecs + name: client.bytes +- external: ecs + name: client.ip +- external: ecs + name: client.port +- external: ecs + name: destination.bytes +- external: ecs + name: destination.ip +- external: ecs + name: destination.mac +- external: ecs + name: destination.packets +- external: ecs + name: destination.port +- external: ecs + name: ecs.version +- external: ecs + name: event.category +- external: ecs + name: event.dataset +- external: ecs + name: event.duration +- external: ecs + name: event.end +- external: ecs + name: event.kind +- external: ecs + name: event.start +- external: ecs + name: event.type +- external: ecs + name: network.bytes +- external: ecs + name: network.community_id +- external: ecs + name: network.direction +- external: ecs + name: network.forwarded_ip +- external: ecs + name: network.protocol +- external: ecs + name: network.packets +- external: ecs + name: network.transport +- external: ecs + name: network.type +- external: ecs + name: observer.hostname +- external: ecs + name: observer.ip +- external: ecs + name: observer.mac +- external: ecs + name: observer.name +- external: ecs + name: process.name +- external: ecs + name: process.args +- external: ecs + name: process.executable +- external: ecs + name: process.working_directory +- external: ecs + name: process.start +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: server.bytes +- external: ecs + name: server.ip +- external: ecs + name: server.port +- external: ecs + name: source.bytes +- external: ecs + name: source.ip +- external: ecs + name: source.mac +- external: ecs + name: source.port +- external: ecs + name: source.packets +- external: ecs + name: client.geo.city_name +- external: ecs + name: client.geo.continent_name +- external: ecs + name: client.geo.country_iso_code +- external: ecs + name: client.geo.country_name +- external: ecs + name: client.geo.location +- external: ecs + name: client.geo.region_iso_code +- external: ecs + name: client.geo.region_name +- external: ecs + name: destination.geo.city_name +- external: ecs + name: destination.geo.continent_name +- external: ecs + name: destination.geo.country_iso_code +- external: ecs + name: destination.geo.country_name +- external: ecs + name: destination.geo.location +- external: ecs + name: destination.geo.region_iso_code +- external: ecs + name: destination.geo.region_name +- external: ecs + name: server.geo.city_name +- external: ecs + name: server.geo.continent_name +- external: ecs + name: server.geo.country_iso_code +- external: ecs + name: server.geo.country_name +- external: ecs + name: server.geo.location +- external: ecs + name: server.geo.region_iso_code +- external: ecs + name: server.geo.region_name +- external: ecs + name: source.geo.city_name +- external: ecs + name: source.geo.continent_name +- external: ecs + name: source.geo.country_iso_code +- external: ecs + name: source.geo.country_name +- external: ecs + name: source.geo.location +- external: ecs + name: source.geo.region_iso_code +- external: ecs + name: source.geo.region_name +- external: ecs + name: tags diff --git a/packages/endace/data_stream/flow/fields/protocol.yml b/packages/endace/data_stream/flow/fields/protocol.yml new file mode 100644 index 00000000000..ba73291c152 --- /dev/null +++ b/packages/endace/data_stream/flow/fields/protocol.yml @@ -0,0 +1,15 @@ +- name: flow.final + type: boolean + description: > + Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. + +- name: flow.id + type: keyword + description: > + Internal flow ID based on connection meta data and address. + +- name: flow.vlan + type: long + description: > + VLAN identifier from the 802.1q frame. In case of a multi-tagged frame this field will be an array with the outer tag's VLAN identifier listed first. + diff --git a/packages/endace/data_stream/flow/fields/protocol_ecs.yml b/packages/endace/data_stream/flow/fields/protocol_ecs.yml new file mode 100644 index 00000000000..99e3f417fcd --- /dev/null +++ b/packages/endace/data_stream/flow/fields/protocol_ecs.yml @@ -0,0 +1,23 @@ +- name: network_traffic.flow + type: group + fields: + - name: final + type: boolean + description: > + Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. + + - name: id + type: keyword + description: > + Internal flow ID based on connection meta data and address. + + - name: vlan + type: long + description: > + VLAN identifier from the 802.1q frame. In case of a multi-tagged frame this field will be an array with the outer tag's VLAN identifier listed first. + +- name: network_traffic.status + type: keyword + description: > + The high level status of the transaction. The way to compute this value depends on the protocol, but the result has a meaning independent of the protocol. + diff --git a/packages/endace/data_stream/flow/manifest.yml b/packages/endace/data_stream/flow/manifest.yml new file mode 100644 index 00000000000..ed73beef964 --- /dev/null +++ b/packages/endace/data_stream/flow/manifest.yml @@ -0,0 +1,67 @@ +title: Flows +type: logs +streams: + - input: packet + title: Flows + description: Track Network Flows + template_path: flow.yml.hbs + vars: + - name: geoip_enrich + required: true + show_user: true + title: GeoIP enrich IP addresses + description: Perform GeoIP enrichment on IP addresses in events. + type: bool + multi: false + default: true + - name: monitor_processes + type: bool + title: Monitor Processes + description: |- + If this option is enabled then network traffic events will be enriched + with information about the process associated with the events. + show_user: true + multi: false + required: false + - name: period + type: text + title: Period + required: false + show_user: false + description: Configure the reporting interval. All flows are reported at the very same point in time. Periodical reporting can be disabled by setting the value to -1s. If disabled, flows are still reported once being timed out. + default: '10s' + - name: timeout + type: text + title: Flow timeout + description: Timeout configures the lifetime of a flow. If no packets have been received for a flow within the timeout time window, the flow is killed and reported. Valid time units are ns, us, ms, s, m, h. + required: false + show_user: false + default: '30s' + - name: processors + type: yaml + title: Processors + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + show_user: false + multi: false + required: false + - name: tags + type: text + title: Tags + description: Tags to include in the published event. + show_user: false + multi: true + required: false + - name: map_to_ecs + type: bool + title: Map root Packetbeat fields to ECS + description: |- + Remap any non-ECS Packetbeat fields in root to their correct ECS fields. + This will rename fields that are moved so the fields will not be present + at the root of the document and so any rules that depend on the fields + will need to be updated. + + The legacy behaviour of this option is deprecated and users are encouraged + to set this option to true. See details in the [package overview describing `map_to_ecs`](../../../integrations/detail/network_traffic/overview). + show_user: true + multi: false + required: false diff --git a/packages/endace/data_stream/flow/sample_event.json b/packages/endace/data_stream/flow/sample_event.json new file mode 100644 index 00000000000..c5e261b80aa --- /dev/null +++ b/packages/endace/data_stream/flow/sample_event.json @@ -0,0 +1,86 @@ +{ + "@timestamp": "2023-10-16T22:40:20.005Z", + "agent": { + "ephemeral_id": "005dde79-7459-4b47-ae00-972086b4f5db", + "id": "f923dfe0-3acb-4f62-9ab4-1fabb8e8e112", + "name": "docker-fleet-agent", + "type": "packetbeat", + "version": "8.6.2" + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "bytes": 64, + "ip": "::1", + "packets": 1, + "port": 8000 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "f923dfe0-3acb-4f62-9ab4-1fabb8e8e112", + "snapshot": false, + "version": "8.6.2" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 73561, + "end": "2023-10-16T22:39:45.677Z", + "ingested": "2023-10-16T22:40:21Z", + "kind": "event", + "start": "2023-10-16T22:39:45.677Z", + "type": [ + "connection", + "end" + ] + }, + "flow": { + "final": true, + "id": "QAT///////8A////IP8AAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAUAfeMg" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "f91b175388d443fca5c155815dfc2279", + "ip": [ + "172.19.0.7" + ], + "mac": [ + "02-42-AC-13-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.15.49-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.5 LTS (Focal Fossa)" + } + }, + "network": { + "bytes": 152, + "community_id": "1:5y9AkdbV9U8xqD9dhlj6obkubHg=", + "packets": 2, + "transport": "tcp", + "type": "ipv6" + }, + "source": { + "bytes": 88, + "ip": "::1", + "packets": 1, + "port": 51320 + }, + "type": "flow" +} diff --git a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json new file mode 100644 index 00000000000..2507a856291 --- /dev/null +++ b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json @@ -0,0 +1,3373 @@ +{ + "events": [ + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "network": { + "iana_number": 6, + "bytes": 719, + "packets": 5, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp" + }, + "observer": { + "ip": "127.0.0.1" + }, + "agent": { + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat" + }, + "client": { + "bytes": 719, + "packets": 5 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "netflow": { + "art_network_time_sum": 0, + "flow_end_sys_up_time": 564184158, + "responder_octets": 0, + "art_count_responses": 0, + "initiator_octets": 719, + "art_server_response_time_maximum": 0, + "ingress_vrfid": 0, + "art_count_late_responses": 0, + "art_server_response_time_sum": 0, + "responder_packets": 0, + "waasoptimization_segment": 16, + "initiator_packets": 5, + "art_response_time_sum": 0, + "application_id": [ + 3, + 0, + 0, + 80 + ], + "connection_sum_duration_seconds": 0, + "protocol_identifier": 6, + "art_total_transaction_time_sum": 0, + "art_total_response_time_sum": 0, + "type": "netflow_flow", + "vlan_id": 0, + "biflow_direction": 1, + "ingress_interface": 10, + "art_client_network_time_sum": 0, + "art_count_transactions": 0, + "new_connection_delta_count": 1, + "flow_start_sys_up_time": 564184140, + "egress_interface": 13, + "art_server_network_time_sum": 0, + "art_count_retransmissions": 0, + "ip_ttl": 49, + "exporter": { + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10 + }, + "ip_diff_serv_code_point": 0 + }, + "server": { + "packets": 0, + "bytes": 0 + }, + "input": { + "type": "netflow" + }, + "host": { + "name": "mbp.local" + }, + "ecs": { + "version": "1.8.0" + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "source": { + "packets": 5, + "bytes": 719 + }, + "destination": { + "bytes": 0, + "packets": 0 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "event": { + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session" + }, + "observer": { + "ip": "127.0.0.1" + }, + "destination": { + "packets": 0, + "bytes": 0 + }, + "input": { + "type": "netflow" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "ecs": { + "version": "1.8.0" + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "netflow": { + "new_connection_delta_count": 1, + "art_count_transactions": 0, + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_server_network_time_sum": 0, + "art_response_time_sum": 0, + "initiator_packets": 6, + "type": "netflow_flow", + "ingress_interface": 10, + "art_count_retransmissions": 0, + "art_client_network_time_sum": 0, + "vlan_id": 0, + "connection_sum_duration_seconds": 0, + "protocol_identifier": 6, + "initiator_octets": 1477, + "art_count_responses": 0, + "responder_octets": 0, + "exporter": { + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z" + }, + "flow_end_sys_up_time": 564184154, + "ip_ttl": 49, + "biflow_direction": 1, + "ip_diff_serv_code_point": 0, + "art_total_transaction_time_sum": 0, + "art_count_late_responses": 0, + "egress_interface": 13, + "art_server_response_time_maximum": 0, + "responder_packets": 0, + "art_total_response_time_sum": 0, + "art_network_time_sum": 0, + "waasoptimization_segment": 16, + "art_server_response_time_sum": 0, + "ingress_vrfid": 0, + "flow_start_sys_up_time": 564184140 + }, + "host": { + "name": "mbp.local" + }, + "client": { + "bytes": 1477, + "packets": 6 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "source": { + "bytes": 1477, + "packets": 6 + }, + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 1477, + "packets": 6, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 1, + "packets": 2, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "destination": { + "packets": 1, + "bytes": 0 + }, + "observer": { + "ip": "127.0.0.1" + }, + "server": { + "bytes": 0, + "packets": 1 + }, + "source": { + "packets": 1, + "bytes": 1 + }, + "host": { + "name": "mbp.local" + }, + "netflow": { + "biflow_direction": 1, + "waasoptimization_segment": 16, + "art_count_responses": 0, + "responder_octets": 0, + "ingress_vrfid": 0, + "initiator_packets": 1, + "art_count_late_responses": 0, + "ip_ttl": 125, + "art_server_response_time_sum": 0, + "art_count_transactions": 0, + "protocol_identifier": 6, + "flow_end_sys_up_time": 564184144, + "type": "netflow_flow", + "art_server_response_time_maximum": 0, + "responder_packets": 1, + "ip_diff_serv_code_point": 0, + "art_network_time_sum": 0, + "connection_sum_duration_seconds": 89, + "art_total_response_time_sum": 0, + "egress_interface": 10, + "flow_start_sys_up_time": 564184142, + "art_response_time_sum": 0, + "exporter": { + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10 + }, + "new_connection_delta_count": 0, + "ingress_interface": 13, + "vlan_id": 290, + "art_client_network_time_sum": 0, + "art_total_transaction_time_sum": 0, + "art_count_retransmissions": 1, + "initiator_octets": 1, + "art_server_network_time_sum": 0, + "application_id": [ + 13, + 0, + 2, + 8 + ] + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "client": { + "bytes": 1, + "packets": 1 + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "destination": { + "packets": 0, + "bytes": 0 + }, + "netflow": { + "art_count_late_responses": 0, + "connection_sum_duration_seconds": 0, + "art_total_transaction_time_sum": 0, + "art_count_transactions": 0, + "biflow_direction": 1, + "waasoptimization_segment": 16, + "responder_packets": 0, + "art_response_time_sum": 0, + "flow_end_sys_up_time": 564184216, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "ingress_interface": 10, + "protocol_identifier": 6, + "art_total_response_time_sum": 0, + "egress_interface": 13, + "initiator_octets": 108580, + "new_connection_delta_count": 1, + "exporter": { + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512 + }, + "vlan_id": 0, + "flow_start_sys_up_time": 564184131, + "initiator_packets": 79, + "art_network_time_sum": 0, + "art_client_network_time_sum": 0, + "ingress_vrfid": 0, + "ip_ttl": 49, + "type": "netflow_flow", + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_count_retransmissions": 2, + "art_count_responses": 0, + "ip_diff_serv_code_point": 0, + "responder_octets": 0, + "art_server_response_time_sum": 0 + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "client": { + "packets": 79, + "bytes": 108580 + }, + "source": { + "bytes": 108580, + "packets": 79 + }, + "observer": { + "ip": "127.0.0.1" + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 108580, + "packets": 79, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "server": { + "bytes": 0, + "packets": 0 + }, + "observer": { + "ip": "127.0.0.1" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "client": { + "bytes": 342, + "packets": 5 + }, + "source": { + "packets": 5, + "bytes": 342 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "network": { + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 342, + "packets": 5 + }, + "netflow": { + "protocol_identifier": 6, + "art_total_response_time_sum": 0, + "type": "netflow_flow", + "ingress_interface": 10, + "waasoptimization_segment": 16, + "art_count_retransmissions": 0, + "biflow_direction": 1, + "art_server_response_time_sum": 0, + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_count_transactions": 0, + "responder_octets": 0, + "art_server_network_time_sum": 0, + "initiator_packets": 5, + "art_count_late_responses": 0, + "ingress_vrfid": 0, + "flow_end_sys_up_time": 564184208, + "art_client_network_time_sum": 0, + "art_total_transaction_time_sum": 0, + "new_connection_delta_count": 1, + "initiator_octets": 342, + "ip_ttl": 49, + "art_count_responses": 0, + "art_response_time_sum": 0, + "egress_interface": 13, + "responder_packets": 0, + "connection_sum_duration_seconds": 0, + "art_server_response_time_maximum": 0, + "art_network_time_sum": 0, + "vlan_id": 0, + "flow_start_sys_up_time": 564184176, + "ip_diff_serv_code_point": 0, + "exporter": { + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z" + } + }, + "ecs": { + "version": "1.8.0" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "client": { + "bytes": 1851, + "packets": 17 + }, + "source": { + "bytes": 1851, + "packets": 17 + }, + "netflow": { + "initiator_packets": 17, + "initiator_octets": 1851, + "type": "netflow_flow", + "responder_packets": 18, + "biflow_direction": 1, + "waasoptimization_segment": 16, + "art_count_retransmissions": 0, + "protocol_identifier": 6, + "art_server_response_time_sum": 13, + "exporter": { + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512 + }, + "art_client_network_time_sum": 2, + "ingress_vrfid": 0, + "art_total_transaction_time_sum": 100, + "art_response_time_sum": 153, + "new_connection_delta_count": 2, + "art_count_responses": 3, + "ip_diff_serv_code_point": 0, + "vlan_id": 290, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_server_network_time_sum": 95, + "art_count_late_responses": 0, + "art_total_response_time_sum": 156, + "ip_ttl": 125, + "art_server_response_time_maximum": 8, + "connection_sum_duration_seconds": 24, + "art_network_time_sum": 97, + "flow_end_sys_up_time": 564197394, + "art_count_transactions": 2, + "flow_start_sys_up_time": 564184067, + "ingress_interface": 13, + "egress_interface": 10, + "responder_octets": 9437 + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "agent": { + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "observer": { + "ip": "127.0.0.1" + }, + "server": { + "bytes": 9437, + "packets": 18 + }, + "event": { + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow" + }, + "input": { + "type": "netflow" + }, + "destination": { + "bytes": 9437, + "packets": 18 + }, + "network": { + "bytes": 11288, + "packets": 35, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "source": { + "bytes": 51480, + "packets": 39 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "netflow": { + "flow_start_sys_up_time": 564184182, + "ip_diff_serv_code_point": 0, + "application_id": [ + 3, + 0, + 0, + 80 + ], + "waasoptimization_segment": 16, + "art_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "type": "netflow_flow", + "art_server_response_time_maximum": 0, + "ingress_vrfid": 0, + "responder_packets": 0, + "exporter": { + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z" + }, + "art_count_retransmissions": 0, + "responder_octets": 0, + "ip_ttl": 49, + "art_total_response_time_sum": 0, + "initiator_packets": 39, + "ingress_interface": 10, + "art_server_response_time_sum": 0, + "initiator_octets": 51480, + "egress_interface": 13, + "art_server_network_time_sum": 0, + "art_client_network_time_sum": 0, + "new_connection_delta_count": 1, + "art_response_time_sum": 0, + "vlan_id": 0, + "protocol_identifier": 6, + "connection_sum_duration_seconds": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "art_count_transactions": 0, + "flow_end_sys_up_time": 564184216 + }, + "input": { + "type": "netflow" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "observer": { + "ip": "127.0.0.1" + }, + "server": { + "packets": 0, + "bytes": 0 + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "client": { + "bytes": 51480, + "packets": 39 + }, + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 51480, + "packets": 39, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "destination": { + "bytes": 36894, + "packets": 47 + }, + "network": { + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 42029, + "packets": 102, + "direction": "unknown" + }, + "server": { + "bytes": 36894, + "packets": 47 + }, + "host": { + "name": "mbp.local" + }, + "netflow": { + "responder_packets": 47, + "egress_interface": 10, + "art_client_network_time_sum": 10, + "art_response_time_sum": 516, + "ip_diff_serv_code_point": 0, + "art_count_late_responses": 0, + "art_count_transactions": 14, + "ip_ttl": 126, + "art_count_responses": 15, + "responder_octets": 36894, + "connection_sum_duration_seconds": 35, + "protocol_identifier": 6, + "new_connection_delta_count": 6, + "art_server_response_time_maximum": 27, + "art_server_response_time_sum": 117, + "art_server_network_time_sum": 364, + "art_total_response_time_sum": 541, + "art_total_transaction_time_sum": 512, + "biflow_direction": 1, + "art_count_retransmissions": 0, + "ingress_interface": 13, + "initiator_packets": 55, + "ingress_vrfid": 0, + "vlan_id": 290, + "type": "netflow_flow", + "initiator_octets": 5135, + "art_network_time_sum": 374, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "exporter": { + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809" + }, + "flow_end_sys_up_time": 564203810, + "flow_start_sys_up_time": 564184040, + "waasoptimization_segment": 16 + }, + "client": { + "bytes": 5135, + "packets": 55 + }, + "flow": { + "locality": "internal", + "id": "Vhs9T5k296w" + }, + "input": { + "type": "netflow" + }, + "agent": { + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c" + }, + "ecs": { + "version": "1.8.0" + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "source": { + "packets": 55, + "bytes": 5135 + }, + "observer": { + "ip": "127.0.0.1" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "client": { + "bytes": 6533, + "packets": 14 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "server": { + "bytes": 6400, + "packets": 20 + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "source": { + "packets": 14, + "bytes": 6533 + }, + "destination": { + "bytes": 6400, + "packets": 20 + }, + "network": { + "iana_number": 6, + "bytes": 12933, + "packets": 34, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp" + }, + "netflow": { + "responder_packets": 14, + "art_count_responses": 6, + "vlan_id": 0, + "new_connection_delta_count": 2, + "ingress_interface": 10, + "art_total_response_time_sum": 138, + "art_server_response_time_maximum": 31, + "ip_diff_serv_code_point": 0, + "art_server_response_time_sum": 78, + "art_count_retransmissions": 1, + "art_total_transaction_time_sum": 123, + "initiator_packets": 20, + "ip_ttl": 61, + "type": "netflow_flow", + "ingress_vrfid": 0, + "protocol_identifier": 6, + "art_server_network_time_sum": 18, + "art_count_transactions": 6, + "flow_start_sys_up_time": 564184163, + "exporter": { + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512 + }, + "art_network_time_sum": 23, + "egress_interface": 13, + "responder_octets": 6533, + "application_id": [ + 13, + 0, + 2, + 99 + ], + "biflow_direction": 2, + "waasoptimization_segment": 16, + "initiator_octets": 6400, + "flow_end_sys_up_time": 564200378, + "connection_sum_duration_seconds": 64, + "art_count_late_responses": 0, + "art_response_time_sum": 123, + "art_client_network_time_sum": 5 + }, + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event" + }, + "observer": { + "ip": "127.0.0.1" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "event": { + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z" + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "observer": { + "ip": "127.0.0.1" + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "source": { + "bytes": 5684, + "packets": 491 + }, + "network": { + "packets": 491, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 5684 + }, + "netflow": { + "new_connection_delta_count": 0, + "art_count_retransmissions": 0, + "vlan_id": 290, + "exporter": { + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10 + }, + "art_server_response_time_sum": 0, + "biflow_direction": 1, + "art_count_responses": 0, + "art_total_transaction_time_sum": 0, + "art_response_time_sum": 0, + "initiator_octets": 5684, + "ingress_vrfid": 0, + "responder_packets": 0, + "application_id": [ + 13, + 0, + 0, + 49 + ], + "connection_sum_duration_seconds": 109, + "art_total_response_time_sum": 0, + "type": "netflow_flow", + "flow_start_sys_up_time": 564184196, + "egress_interface": 10, + "ingress_interface": 13, + "art_server_network_time_sum": 0, + "ip_diff_serv_code_point": 0, + "initiator_packets": 491, + "ip_ttl": 125, + "responder_octets": 0, + "waasoptimization_segment": 16, + "art_network_time_sum": 0, + "protocol_identifier": 6, + "art_server_response_time_maximum": 0, + "art_count_late_responses": 0, + "art_client_network_time_sum": 0, + "flow_end_sys_up_time": 564185840, + "art_count_transactions": 0 + }, + "input": { + "type": "netflow" + }, + "host": { + "name": "mbp.local" + }, + "client": { + "bytes": 5684, + "packets": 491 + }, + "ecs": { + "version": "1.8.0" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "client": { + "bytes": 4965, + "packets": 13 + }, + "server": { + "packets": 0, + "bytes": 0 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event" + }, + "input": { + "type": "netflow" + }, + "host": { + "name": "mbp.local" + }, + "source": { + "bytes": 4965, + "packets": 13 + }, + "observer": { + "ip": "127.0.0.1" + }, + "netflow": { + "protocol_identifier": 6, + "art_server_response_time_maximum": 0, + "new_connection_delta_count": 1, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "type": "netflow_flow", + "art_count_responses": 0, + "art_server_network_time_sum": 0, + "responder_packets": 0, + "ingress_interface": 13, + "biflow_direction": 1, + "ip_diff_serv_code_point": 0, + "initiator_packets": 13, + "ingress_vrfid": 0, + "art_count_transactions": 0, + "art_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "connection_sum_duration_seconds": 0, + "flow_end_sys_up_time": 564184254, + "vlan_id": 290, + "initiator_octets": 4965, + "waasoptimization_segment": 16, + "responder_octets": 0, + "art_count_late_responses": 0, + "art_total_response_time_sum": 0, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_server_response_time_sum": 0, + "flow_start_sys_up_time": 564184154, + "ip_ttl": 125, + "art_count_retransmissions": 0, + "art_network_time_sum": 0, + "egress_interface": 10, + "art_client_network_time_sum": 0 + }, + "ecs": { + "version": "1.8.0" + }, + "agent": { + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75" + }, + "network": { + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 4965, + "packets": 13, + "direction": "unknown" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "server": { + "packets": 2, + "bytes": 0 + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "agent": { + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c" + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event" + }, + "client": { + "bytes": 138, + "packets": 4 + }, + "network": { + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 138, + "packets": 6, + "direction": "unknown" + }, + "netflow": { + "protocol_identifier": 6, + "ingress_interface": 10, + "vlan_id": 0, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_count_responses": 0, + "art_total_response_time_sum": 0, + "connection_sum_duration_seconds": 239, + "responder_octets": 138, + "art_count_retransmissions": 0, + "ingress_vrfid": 0, + "initiator_packets": 2, + "new_connection_delta_count": 0, + "application_id": [ + 13, + 0, + 2, + 99 + ], + "art_client_network_time_sum": 0, + "flow_start_sys_up_time": 564184214, + "biflow_direction": 2, + "art_network_time_sum": 0, + "type": "netflow_flow", + "art_count_late_responses": 0, + "art_count_transactions": 2, + "flow_end_sys_up_time": 564184362, + "egress_interface": 13, + "ip_diff_serv_code_point": 0, + "responder_packets": 4, + "art_response_time_sum": 0, + "art_total_transaction_time_sum": 119878, + "initiator_octets": 0, + "art_server_response_time_sum": 0, + "ip_ttl": 61, + "waasoptimization_segment": 16 + }, + "observer": { + "ip": "127.0.0.1" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "input": { + "type": "netflow" + }, + "source": { + "bytes": 138, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "netflow": { + "waasoptimization_segment": 16, + "art_total_transaction_time_sum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_count_responses": 0, + "ingress_interface": 13, + "art_server_network_time_sum": 0, + "art_client_network_time_sum": 0, + "flow_end_sys_up_time": 564184220, + "ingress_vrfid": 0, + "biflow_direction": 1, + "ip_ttl": 125, + "initiator_packets": 1, + "vlan_id": 290, + "ip_diff_serv_code_point": 0, + "art_count_retransmissions": 1, + "egress_interface": 10, + "art_response_time_sum": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "exporter": { + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809" + }, + "type": "netflow_flow", + "responder_octets": 0, + "responder_packets": 0, + "connection_sum_duration_seconds": 44, + "art_count_late_responses": 0, + "flow_start_sys_up_time": 564184220, + "protocol_identifier": 6, + "application_id": [ + 13, + 0, + 2, + 8 + ], + "initiator_octets": 1, + "new_connection_delta_count": 0, + "art_server_response_time_maximum": 0 + }, + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event" + }, + "observer": { + "ip": "127.0.0.1" + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "packets": 1, + "bytes": 1 + }, + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 1, + "packets": 1, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "client": { + "packets": 1, + "bytes": 1 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "input": { + "type": "netflow" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "netflow": { + "art_count_responses": 3, + "egress_interface": 13, + "initiator_octets": 1571, + "ingress_vrfid": 0, + "connection_sum_duration_seconds": 62, + "art_server_network_time_sum": 146, + "art_client_network_time_sum": 3, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_count_late_responses": 0, + "art_server_response_time_maximum": 3, + "art_total_response_time_sum": 453, + "type": "netflow_flow", + "ip_diff_serv_code_point": 0, + "exporter": { + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809" + }, + "protocol_identifier": 6, + "ip_ttl": 220, + "waasoptimization_segment": 16, + "responder_octets": 6079, + "vlan_id": 0, + "art_server_response_time_sum": 6, + "initiator_packets": 13, + "art_count_retransmissions": 0, + "flow_end_sys_up_time": 564215068, + "responder_packets": 10, + "flow_start_sys_up_time": 564184067, + "ingress_interface": 10, + "art_response_time_sum": 444, + "biflow_direction": 2, + "art_network_time_sum": 149, + "art_count_transactions": 2, + "new_connection_delta_count": 1, + "art_total_transaction_time_sum": 296 + }, + "input": { + "type": "netflow" + }, + "observer": { + "ip": "127.0.0.1" + }, + "client": { + "packets": 10, + "bytes": 6079 + }, + "network": { + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 7650, + "packets": 23 + }, + "server": { + "bytes": 1571, + "packets": 13 + }, + "source": { + "bytes": 6079, + "packets": 10 + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "agent": { + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "destination": { + "bytes": 1571, + "packets": 13 + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "client": { + "packets": 6, + "bytes": 2807 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "1.8.0" + }, + "event": { + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session" + }, + "network": { + "packets": 6, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 2807 + }, + "source": { + "packets": 6, + "bytes": 2807 + }, + "netflow": { + "biflow_direction": 1, + "art_response_time_sum": 0, + "responder_packets": 0, + "waasoptimization_segment": 16, + "egress_interface": 13, + "art_count_responses": 0, + "ingress_vrfid": 0, + "connection_sum_duration_seconds": 0, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "vlan_id": 0, + "art_count_late_responses": 0, + "type": "netflow_flow", + "ip_diff_serv_code_point": 0, + "flow_start_sys_up_time": 564183878, + "art_server_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "art_server_network_time_sum": 0, + "art_count_transactions": 0, + "responder_octets": 0, + "art_client_network_time_sum": 0, + "protocol_identifier": 6, + "initiator_packets": 6, + "initiator_octets": 2807, + "art_server_response_time_maximum": 0, + "art_network_time_sum": 0, + "art_total_response_time_sum": 0, + "flow_end_sys_up_time": 564184252, + "ip_ttl": 61, + "new_connection_delta_count": 1, + "ingress_interface": 10, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_count_retransmissions": 0 + }, + "observer": { + "ip": "127.0.0.1" + }, + "input": { + "type": "netflow" + }, + "host": { + "name": "mbp.local" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "event": { + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z" + }, + "host": { + "name": "mbp.local" + }, + "network": { + "packets": 1, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 0 + }, + "source": { + "bytes": 0, + "packets": 1 + }, + "observer": { + "ip": "127.0.0.1" + }, + "netflow": { + "ip_diff_serv_code_point": 0, + "new_connection_delta_count": 0, + "art_server_network_time_sum": 0, + "protocol_identifier": 6, + "exporter": { + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z" + }, + "initiator_packets": 1, + "ingress_vrfid": 0, + "art_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "ingress_interface": 1, + "vlan_id": 0, + "type": "netflow_flow", + "art_count_responses": 0, + "art_client_network_time_sum": 0, + "art_server_response_time_sum": 0, + "waasoptimization_segment": 16, + "initiator_octets": 0, + "art_count_transactions": 0, + "responder_packets": 0, + "art_total_response_time_sum": 0, + "ip_ttl": 124, + "biflow_direction": 1, + "flow_end_sys_up_time": 564184248, + "egress_interface": 4, + "responder_octets": 0, + "art_network_time_sum": 0, + "connection_sum_duration_seconds": 59, + "flow_start_sys_up_time": 564184248, + "art_count_retransmissions": 0, + "art_server_response_time_maximum": 0, + "art_count_late_responses": 0, + "application_id": [ + 13, + 0, + 0, + 1 + ] + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "client": { + "bytes": 0, + "packets": 1 + }, + "destination": { + "bytes": 0, + "packets": 0 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "network": { + "packets": 18, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 5286 + }, + "client": { + "bytes": 1877, + "packets": 11 + }, + "destination": { + "bytes": 3409, + "packets": 7 + }, + "input": { + "type": "netflow" + }, + "host": { + "name": "mbp.local" + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "server": { + "bytes": 3409, + "packets": 7 + }, + "source": { + "bytes": 1877, + "packets": 11 + }, + "agent": { + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75" + }, + "ecs": { + "version": "1.8.0" + }, + "observer": { + "ip": "127.0.0.1" + }, + "netflow": { + "responder_packets": 7, + "ingress_interface": 13, + "art_server_response_time_sum": 7, + "ip_ttl": 125, + "initiator_packets": 11, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "ingress_vrfid": 0, + "biflow_direction": 1, + "art_count_transactions": 4, + "art_server_network_time_sum": 4, + "art_count_responses": 4, + "type": "netflow_flow", + "art_total_transaction_time_sum": 23, + "ip_diff_serv_code_point": 0, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "flow_end_sys_up_time": 564200378, + "art_count_late_responses": 0, + "art_count_retransmissions": 0, + "vlan_id": 290, + "initiator_octets": 1877, + "responder_octets": 3409, + "flow_start_sys_up_time": 564184251, + "egress_interface": 10, + "art_server_response_time_maximum": 3, + "waasoptimization_segment": 16, + "connection_sum_duration_seconds": 32, + "art_network_time_sum": 6, + "new_connection_delta_count": 1, + "art_client_network_time_sum": 2, + "art_response_time_sum": 23, + "art_total_response_time_sum": 31, + "protocol_identifier": 6 + }, + "flow": { + "locality": "internal", + "id": "Vhs9T5k296w" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "destination": { + "bytes": 0, + "packets": 0 + }, + "network": { + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 2255, + "packets": 7, + "direction": "unknown" + }, + "host": { + "name": "mbp.local" + }, + "source": { + "bytes": 2255, + "packets": 7 + }, + "observer": { + "ip": "127.0.0.1" + }, + "client": { + "bytes": 2255, + "packets": 7 + }, + "server": { + "packets": 0, + "bytes": 0 + }, + "event": { + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "input": { + "type": "netflow" + }, + "agent": { + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat" + }, + "netflow": { + "ip_ttl": 61, + "art_network_time_sum": 0, + "responder_octets": 0, + "responder_packets": 0, + "art_count_retransmissions": 0, + "egress_interface": 13, + "biflow_direction": 1, + "vlan_id": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "new_connection_delta_count": 1, + "connection_sum_duration_seconds": 0, + "type": "netflow_flow", + "art_count_late_responses": 0, + "flow_start_sys_up_time": 564184040, + "art_response_time_sum": 0, + "exporter": { + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10 + }, + "art_client_network_time_sum": 0, + "protocol_identifier": 6, + "art_count_responses": 0, + "art_server_network_time_sum": 0, + "ingress_vrfid": 0, + "ingress_interface": 10, + "waasoptimization_segment": 16, + "initiator_packets": 7, + "art_server_response_time_maximum": 0, + "art_count_transactions": 0, + "ip_diff_serv_code_point": 0, + "art_total_transaction_time_sum": 0, + "initiator_octets": 2255, + "flow_end_sys_up_time": 564184286 + }, + "ecs": { + "version": "1.8.0" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "source": { + "packets": 5, + "bytes": 538 + }, + "netflow": { + "initiator_packets": 5, + "waasoptimization_segment": 16, + "art_total_transaction_time_sum": 0, + "vlan_id": 0, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "flow_start_sys_up_time": 564184284, + "ingress_interface": 10, + "connection_sum_duration_seconds": 0, + "biflow_direction": 1, + "art_server_response_time_sum": 0, + "responder_packets": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_network_time_sum": 0, + "responder_octets": 0, + "art_client_network_time_sum": 0, + "ingress_vrfid": 0, + "art_count_late_responses": 0, + "ip_ttl": 49, + "art_server_response_time_maximum": 0, + "type": "netflow_flow", + "ip_diff_serv_code_point": 0, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "art_server_network_time_sum": 0, + "art_response_time_sum": 0, + "art_total_response_time_sum": 0, + "egress_interface": 13, + "application_id": [ + 3, + 0, + 0, + 80 + ], + "initiator_octets": 538, + "art_count_transactions": 0, + "flow_end_sys_up_time": 564184314 + }, + "event": { + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow" + }, + "client": { + "packets": 5, + "bytes": 538 + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "input": { + "type": "netflow" + }, + "observer": { + "ip": "127.0.0.1" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 538, + "packets": 5, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "destination": { + "bytes": 0, + "packets": 0 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "observer": { + "ip": "127.0.0.1" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "network": { + "packets": 36, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 7792 + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + }, + "event": { + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow" + }, + "source": { + "bytes": 1487, + "packets": 21 + }, + "netflow": { + "art_server_response_time_maximum": 25, + "art_network_time_sum": 9, + "ip_diff_serv_code_point": 0, + "art_total_transaction_time_sum": 59870, + "art_count_late_responses": 0, + "responder_octets": 6305, + "art_total_response_time_sum": 77, + "flow_start_sys_up_time": 564184296, + "exporter": { + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z" + }, + "biflow_direction": 1, + "art_server_response_time_sum": 55, + "connection_sum_duration_seconds": 181, + "art_count_retransmissions": 0, + "waasoptimization_segment": 16, + "egress_interface": 10, + "new_connection_delta_count": 2, + "flow_end_sys_up_time": 564214304, + "initiator_packets": 21, + "vlan_id": 290, + "art_count_transactions": 5, + "art_server_network_time_sum": 7, + "ip_ttl": 125, + "application_id": [ + 13, + 0, + 2, + 102 + ], + "art_client_network_time_sum": 2, + "ingress_vrfid": 0, + "initiator_octets": 1487, + "art_count_responses": 5, + "art_response_time_sum": 72, + "responder_packets": 15, + "ingress_interface": 13, + "type": "netflow_flow", + "protocol_identifier": 6 + }, + "destination": { + "bytes": 6305, + "packets": 15 + }, + "server": { + "bytes": 6305, + "packets": 15 + }, + "host": { + "name": "mbp.local" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1487, + "packets": 21 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "server": { + "bytes": 1973, + "packets": 10 + }, + "observer": { + "ip": "127.0.0.1" + }, + "ecs": { + "version": "1.8.0" + }, + "netflow": { + "art_server_response_time_maximum": 14, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "vlan_id": 0, + "art_client_network_time_sum": 2, + "responder_packets": 7, + "initiator_octets": 1973, + "application_id": [ + 13, + 0, + 2, + 99 + ], + "flow_end_sys_up_time": 564200376, + "art_total_transaction_time_sum": 39, + "biflow_direction": 2, + "art_count_retransmissions": 0, + "waasoptimization_segment": 16, + "ip_diff_serv_code_point": 0, + "ingress_interface": 10, + "art_server_response_time_sum": 15, + "initiator_packets": 10, + "art_count_responses": 3, + "art_server_network_time_sum": 10, + "connection_sum_duration_seconds": 32, + "art_response_time_sum": 39, + "protocol_identifier": 6, + "flow_start_sys_up_time": 564184268, + "egress_interface": 13, + "art_count_transactions": 3, + "art_network_time_sum": 12, + "art_count_late_responses": 0, + "type": "netflow_flow", + "new_connection_delta_count": 1, + "responder_octets": 3110, + "ingress_vrfid": 0, + "ip_ttl": 61, + "art_total_response_time_sum": 45 + }, + "client": { + "bytes": 3110, + "packets": 7 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "source": { + "bytes": 3110, + "packets": 7 + }, + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event" + }, + "input": { + "type": "netflow" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "host": { + "name": "mbp.local" + }, + "destination": { + "packets": 10, + "bytes": 1973 + }, + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 5083, + "packets": 17, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "ecs": { + "version": "1.8.0" + }, + "server": { + "bytes": 2, + "packets": 4 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "destination": { + "bytes": 2, + "packets": 4 + }, + "client": { + "packets": 4, + "bytes": 2 + }, + "event": { + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ] + }, + "source": { + "bytes": 2, + "packets": 4 + }, + "input": { + "type": "netflow" + }, + "host": { + "name": "mbp.local" + }, + "network": { + "bytes": 4, + "packets": 8, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6 + }, + "netflow": { + "art_count_responses": 0, + "flow_start_sys_up_time": 564184300, + "flow_end_sys_up_time": 564214242, + "waasoptimization_segment": 16, + "art_response_time_sum": 0, + "art_client_network_time_sum": 0, + "initiator_octets": 2, + "initiator_packets": 4, + "ip_diff_serv_code_point": 0, + "art_total_response_time_sum": 0, + "ip_ttl": 124, + "art_count_retransmissions": 2, + "protocol_identifier": 6, + "responder_packets": 4, + "type": "netflow_flow", + "application_id": [ + 3, + 0, + 5, + 153 + ], + "art_count_transactions": 0, + "art_network_time_sum": 0, + "egress_interface": 13, + "ingress_interface": 10, + "vlan_id": 0, + "art_count_late_responses": 0, + "new_connection_delta_count": 0, + "art_total_transaction_time_sum": 0, + "art_server_network_time_sum": 0, + "biflow_direction": 2, + "art_server_response_time_maximum": 0, + "responder_octets": 2, + "ingress_vrfid": 0, + "exporter": { + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512 + }, + "art_server_response_time_sum": 0, + "connection_sum_duration_seconds": 119 + }, + "observer": { + "ip": "127.0.0.1" + }, + "agent": { + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "network": { + "packets": 4, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 2 + }, + "netflow": { + "flow_start_sys_up_time": 564184306, + "art_network_time_sum": 0, + "art_total_response_time_sum": 0, + "flow_end_sys_up_time": 564184580, + "application_id": [ + 3, + 0, + 0, + 80 + ], + "new_connection_delta_count": 0, + "biflow_direction": 1, + "waasoptimization_segment": 16, + "exporter": { + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809" + }, + "vlan_id": 290, + "art_total_transaction_time_sum": 0, + "initiator_packets": 2, + "art_server_network_time_sum": 0, + "egress_interface": 10, + "ip_diff_serv_code_point": 0, + "protocol_identifier": 6, + "art_response_time_sum": 0, + "ip_ttl": 125, + "art_count_responses": 0, + "initiator_octets": 2, + "art_server_response_time_maximum": 0, + "type": "netflow_flow", + "responder_packets": 2, + "art_server_response_time_sum": 0, + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "connection_sum_duration_seconds": 179, + "art_count_transactions": 0, + "ingress_interface": 13, + "ingress_vrfid": 0, + "art_count_retransmissions": 2, + "responder_octets": 0 + }, + "source": { + "bytes": 2, + "packets": 2 + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "server": { + "packets": 2, + "bytes": 0 + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "event": { + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z" + }, + "observer": { + "ip": "127.0.0.1" + }, + "client": { + "bytes": 2, + "packets": 2 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "agent": { + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat" + }, + "server": { + "bytes": 0, + "packets": 2 + }, + "event": { + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "observer": { + "ip": "127.0.0.1" + }, + "source": { + "bytes": 0, + "packets": 4 + }, + "network": { + "packets": 6, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 0 + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + }, + "client": { + "bytes": 0, + "packets": 4 + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "netflow": { + "art_server_response_time_sum": 0, + "art_server_network_time_sum": 0, + "ip_diff_serv_code_point": 0, + "art_response_time_sum": 0, + "flow_start_sys_up_time": 564184326, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "biflow_direction": 1, + "ip_ttl": 125, + "responder_packets": 2, + "responder_octets": 0, + "art_server_response_time_maximum": 0, + "initiator_packets": 4, + "type": "netflow_flow", + "art_total_transaction_time_sum": 18, + "egress_interface": 10, + "flow_end_sys_up_time": 564184326, + "art_total_response_time_sum": 0, + "vlan_id": 290, + "waasoptimization_segment": 16, + "ingress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "initiator_octets": 0, + "art_client_network_time_sum": 0, + "connection_sum_duration_seconds": 119, + "art_network_time_sum": 0, + "art_count_retransmissions": 0, + "art_count_late_responses": 0, + "art_count_transactions": 2, + "ingress_vrfid": 0, + "protocol_identifier": 6, + "new_connection_delta_count": 0, + "art_count_responses": 0 + }, + "host": { + "name": "mbp.local" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "network": { + "transport": "tcp", + "iana_number": 6, + "bytes": 1179, + "packets": 7, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "observer": { + "ip": "127.0.0.1" + }, + "host": { + "name": "mbp.local" + }, + "server": { + "bytes": 174, + "packets": 3 + }, + "destination": { + "bytes": 174, + "packets": 3 + }, + "netflow": { + "waasoptimization_segment": 16, + "initiator_packets": 4, + "art_count_retransmissions": 1, + "flow_start_sys_up_time": 564184326, + "connection_sum_duration_seconds": 119, + "initiator_octets": 1005, + "application_id": [ + 3, + 0, + 5, + 153 + ], + "ingress_interface": 13, + "art_server_response_time_sum": 5, + "responder_packets": 3, + "ip_ttl": 125, + "art_client_network_time_sum": 0, + "art_count_transactions": 1, + "art_total_transaction_time_sum": 12, + "protocol_identifier": 6, + "art_network_time_sum": 0, + "new_connection_delta_count": 0, + "art_server_response_time_maximum": 5, + "art_response_time_sum": 5, + "type": "netflow_flow", + "responder_octets": 174, + "art_server_network_time_sum": 0, + "art_count_responses": 1, + "egress_interface": 10, + "flow_end_sys_up_time": 564214476, + "biflow_direction": 1, + "ingress_vrfid": 0, + "art_total_response_time_sum": 8, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0 + }, + "ip_diff_serv_code_point": 0, + "vlan_id": 290, + "art_count_late_responses": 0 + }, + "event": { + "kind": "event", + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z" + }, + "client": { + "bytes": 1005, + "packets": 4 + }, + "input": { + "type": "netflow" + }, + "ecs": { + "version": "1.8.0" + }, + "agent": { + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0", + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75" + }, + "source": { + "bytes": 1005, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "netflow": { + "art_server_network_time_sum": 0, + "vlan_id": 0, + "art_count_transactions": 2, + "responder_packets": 4, + "type": "netflow_flow", + "ingress_interface": 10, + "flow_end_sys_up_time": 564184490, + "protocol_identifier": 6, + "ingress_vrfid": 0, + "initiator_octets": 0, + "exporter": { + "version": 10, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512 + }, + "art_total_transaction_time_sum": 119644, + "art_response_time_sum": 0, + "responder_octets": 138, + "art_client_network_time_sum": 0, + "initiator_packets": 2, + "flow_start_sys_up_time": 564184336, + "ip_diff_serv_code_point": 0, + "connection_sum_duration_seconds": 238, + "egress_interface": 13, + "art_total_response_time_sum": 0, + "waasoptimization_segment": 16, + "art_network_time_sum": 0, + "art_server_response_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_count_late_responses": 0, + "art_count_retransmissions": 0, + "biflow_direction": 2, + "art_count_responses": 0, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "new_connection_delta_count": 0, + "ip_ttl": 61 + }, + "network": { + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 138, + "packets": 6, + "direction": "unknown" + }, + "source": { + "packets": 4, + "bytes": 138 + }, + "input": { + "type": "netflow" + }, + "server": { + "bytes": 0, + "packets": 2 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "observer": { + "ip": "127.0.0.1" + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "event": { + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "category": "network_session" + }, + "client": { + "bytes": 138, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "host": { + "name": "mbp.local" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "netflow": { + "art_total_response_time_sum": 0, + "initiator_octets": 0, + "flow_end_sys_up_time": 564184350, + "art_network_time_sum": 0, + "ingress_interface": 10, + "responder_octets": 31, + "art_server_response_time_sum": 0, + "art_count_transactions": 1, + "ingress_vrfid": 0, + "vlan_id": 0, + "application_id": [ + 13, + 0, + 1, + 197 + ], + "biflow_direction": 2, + "new_connection_delta_count": 0, + "initiator_packets": 1, + "art_client_network_time_sum": 0, + "exporter": { + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10 + }, + "art_response_time_sum": 0, + "type": "netflow_flow", + "art_count_responses": 0, + "waasoptimization_segment": 16, + "art_count_retransmissions": 0, + "ip_diff_serv_code_point": 0, + "ip_ttl": 43, + "art_count_late_responses": 0, + "art_total_transaction_time_sum": 59790, + "protocol_identifier": 6, + "flow_start_sys_up_time": 564184348, + "responder_packets": 2, + "art_server_response_time_maximum": 0, + "art_server_network_time_sum": 0, + "connection_sum_duration_seconds": 119, + "egress_interface": 13 + }, + "network": { + "iana_number": 6, + "bytes": 31, + "packets": 3, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp" + }, + "observer": { + "ip": "127.0.0.1" + }, + "client": { + "bytes": 31, + "packets": 2 + }, + "source": { + "bytes": 31, + "packets": 2 + }, + "ecs": { + "version": "1.8.0" + }, + "server": { + "packets": 1, + "bytes": 0 + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event" + }, + "destination": { + "bytes": 0, + "packets": 1 + }, + "input": { + "type": "netflow" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "event": { + "category": "network_session", + "action": "netflow_flow", + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event" + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "input": { + "type": "netflow" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "ecs": { + "version": "1.8.0" + }, + "client": { + "bytes": 13482, + "packets": 17 + }, + "destination": { + "bytes": 8989, + "packets": 19 + }, + "server": { + "bytes": 8989, + "packets": 19 + }, + "source": { + "bytes": 13482, + "packets": 17 + }, + "network": { + "packets": 36, + "direction": "unknown", + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 22471 + }, + "host": { + "name": "mbp.local" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "responder_packets": 17, + "new_connection_delta_count": 1, + "art_count_retransmissions": 0, + "art_count_transactions": 6, + "exporter": { + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10 + }, + "art_count_responses": 6, + "art_server_response_time_sum": 33, + "flow_end_sys_up_time": 564184586, + "art_total_transaction_time_sum": 43, + "egress_interface": 13, + "flow_start_sys_up_time": 564184356, + "art_network_time_sum": 3, + "initiator_packets": 19, + "type": "netflow_flow", + "art_response_time_sum": 33, + "ingress_interface": 10, + "art_server_network_time_sum": 0, + "waasoptimization_segment": 16, + "ingress_vrfid": 0, + "art_client_network_time_sum": 3, + "protocol_identifier": 6, + "responder_octets": 13482, + "ip_diff_serv_code_point": 0, + "art_total_response_time_sum": 51, + "art_count_late_responses": 0, + "ip_ttl": 124, + "art_server_response_time_maximum": 28, + "vlan_id": 0, + "biflow_direction": 2, + "initiator_octets": 8989, + "connection_sum_duration_seconds": 0 + }, + "observer": { + "ip": "127.0.0.1" + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "network": { + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "transport": "tcp", + "iana_number": 6, + "bytes": 261718, + "packets": 369, + "direction": "unknown" + }, + "netflow": { + "ip_diff_serv_code_point": 0, + "connection_sum_duration_seconds": 116, + "art_count_transactions": 25, + "egress_interface": 13, + "new_connection_delta_count": 8, + "vlan_id": 0, + "biflow_direction": 2, + "art_response_time_sum": 301, + "art_total_response_time_sum": 363, + "art_network_time_sum": 58, + "art_server_network_time_sum": 38, + "type": "netflow_flow", + "flow_end_sys_up_time": 564215336, + "art_server_response_time_maximum": 31, + "art_server_response_time_sum": 168, + "ip_ttl": 61, + "art_total_transaction_time_sum": 332, + "responder_octets": 28373, + "protocol_identifier": 6, + "ingress_interface": 10, + "application_id": [ + 13, + 0, + 2, + 99 + ], + "responder_packets": 133, + "art_count_responses": 25, + "art_count_late_responses": 0, + "flow_start_sys_up_time": 564184380, + "ingress_vrfid": 0, + "waasoptimization_segment": 16, + "art_count_retransmissions": 4, + "exporter": { + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "address": "127.0.0.1:62809", + "source_id": 512, + "version": 10 + }, + "initiator_octets": 233345, + "initiator_packets": 236, + "art_client_network_time_sum": 20 + }, + "client": { + "bytes": 28373, + "packets": 133 + }, + "server": { + "bytes": 233345, + "packets": 236 + }, + "source": { + "bytes": 28373, + "packets": 133 + }, + "observer": { + "ip": "127.0.0.1" + }, + "input": { + "type": "netflow" + }, + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "flow": { + "locality": "internal", + "id": "Vhs9T5k296w" + }, + "destination": { + "packets": 236, + "bytes": 233345 + }, + "event": { + "type": [ + "connection" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "category": "network_session", + "action": "netflow_flow" + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "mbp.local" + } + }, + { + "@timestamp": "2020-04-16T23:22:51Z", + "destination": { + "ip": "10.36.236.100", + "locality": "internal", + "port": 54594 + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "6mUV1nPVG80", + "locality": "internal" + }, + "netflow": { + "destination_ipv4_address": "10.36.236.100", + "destination_transport_port": 54594, + "egress_interface": 1, + "exporter": { + "address": "81.2.69.144:10000", + "source_id": 1, + "timestamp": "2020-04-16T23:22:51Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_milliseconds": "2020-04-16T23:22:48.963Z", + "flow_end_reason": 3, + "flow_start_milliseconds": "2020-04-16T23:22:48.96Z", + "ingress_interface": 1, + "octet_delta_count": 1855, + "packet_delta_count": 5, + "protocol_identifier": 6, + "source_ipv4_address": "10.127.32.11", + "source_transport_port": 53, + "tcp_control_bits": 27, + "type": "netflow_flow" + }, + "network": { + "bytes": 1855, + "community_id": "1:+/kh1SKruHHnZ5JGSMfWk9nZx8o=", + "direction": "unknown", + "iana_number": 6, + "packets": 5, + "transport": "tcp" + }, + "observer": { + "ip": "81.2.69.144" + }, + "related": { + "ip": [ + "10.36.236.100", + "10.127.32.11" + ] + }, + "source": { + "bytes": 1855, + "ip": "10.127.32.11", + "locality": "internal", + "packets": 5, + "port": 53 + } + }, + { + "@timestamp": "2020-04-16T23:22:51Z", + "destination": { + "ip": "10.36.236.100", + "locality": "internal", + "port": 49180 + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "HVg4SttTufc", + "locality": "external" + }, + "netflow": { + "destination_ipv4_address": "10.36.236.100", + "destination_transport_port": 49180, + "egress_interface": 1, + "exporter": { + "address": "81.2.69.144:10000", + "source_id": 1, + "timestamp": "2020-04-16T23:22:51Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_milliseconds": "2020-04-16T23:22:48.404Z", + "flow_end_reason": 3, + "flow_start_milliseconds": "2020-04-16T23:22:47.995Z", + "ingress_interface": 1, + "octet_delta_count": 7158, + "packet_delta_count": 10, + "protocol_identifier": 6, + "source_ipv4_address": "89.160.20.112", + "source_transport_port": 443, + "tcp_control_bits": 27, + "type": "netflow_flow" + }, + "network": { + "bytes": 7158, + "community_id": "1:Zyly7BCJ6D7luuRJJazRxZ/mFZM=", + "direction": "unknown", + "iana_number": 6, + "packets": 10, + "transport": "tcp" + }, + "observer": { + "ip": "81.2.69.144" + }, + "related": { + "ip": [ + "10.36.236.100", + "89.160.20.112" + ] + }, + "source": { + "bytes": 7158, + "ip": "89.160.20.112", + "locality": "external", + "packets": 10, + "port": 443 + } + }, + { + "@timestamp": "2020-04-16T23:22:51Z", + "destination": { + "ip": "89.160.20.112", + "locality": "external", + "port": 443 + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "HVg4SttTufc", + "locality": "external" + }, + "netflow": { + "destination_ipv4_address": "89.160.20.112", + "destination_transport_port": 443, + "egress_interface": 1, + "exporter": { + "address": "81.2.69.144:10000", + "source_id": 1, + "timestamp": "2020-04-16T23:22:51Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_milliseconds": "2020-04-16T23:22:48.404Z", + "flow_end_reason": 3, + "flow_start_milliseconds": "2020-04-16T23:22:47.92Z", + "ingress_interface": 1, + "octet_delta_count": 1538, + "packet_delta_count": 11, + "protocol_identifier": 6, + "source_ipv4_address": "10.36.236.100", + "source_transport_port": 49180, + "tcp_control_bits": 27, + "type": "netflow_flow" + }, + "network": { + "bytes": 1538, + "community_id": "1:Zyly7BCJ6D7luuRJJazRxZ/mFZM=", + "direction": "unknown", + "iana_number": 6, + "packets": 11, + "transport": "tcp" + }, + "observer": { + "ip": "81.2.69.144" + }, + "related": { + "ip": [ + "10.36.236.100", + "89.160.20.112" + ] + }, + "source": { + "bytes": 1538, + "ip": "10.36.236.100", + "locality": "internal", + "packets": 11, + "port": 49180 + } + }, + { + "@timestamp": "2018-04-15T03:30:00Z", + "destination": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 135 + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "GYmhjYyvaAI", + "locality": "internal" + }, + "netflow": { + "bgp_destination_as_number": 0, + "bgp_source_as_number": 0, + "destination_ipv4_address": "0.0.0.0", + "destination_ipv6_address": "2a02:cf40::2", + "destination_transport_port": 135, + "exporter": { + "address": "81.2.69.144:4444", + "source_id": 2875616939, + "timestamp": "2018-04-15T03:30:00Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_seconds": "2018-04-15T03:29:02Z", + "flow_start_seconds": "2018-04-15T03:28:44Z", + "procera_base_service": "IP protocol 58 (IPv6-ICMP)", + "procera_content_categories": "", + "procera_flow_behavior": "INITIAL,SERVER_IS_LOCAL,BEGINNING,ESTABLISHED", + "procera_http_content_type": "", + "procera_http_file_length": 0, + "procera_http_location": "", + "procera_http_url": "", + "procera_incoming_octets": 86, + "procera_outgoing_octets": 78, + "procera_service": "IP protocol 58 (IPv6-ICMP)", + "procera_subscriber_identifier": "", + "procera_template_name": "IPFIX", + "protocol_identifier": 58, + "source_ipv4_address": "0.0.0.0", + "source_ipv6_address": "2a02:cf40::1", + "source_transport_port": 136, + "type": "netflow_flow" + }, + "network": { + "community_id": "1:vK+Zeop1Y3GHxfFGVF2/COcNBWw=", + "direction": "unknown", + "iana_number": 58, + "transport": "ipv6-icmp" + }, + "observer": { + "ip": "81.2.69.144" + }, + "related": { + "ip": [ + "0.0.0.0" + ] + }, + "source": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 136 + } + }, + { + "@timestamp": "2018-04-15T03:30:00Z", + "destination": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 135 + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "GYmhjYyvaAI", + "locality": "internal" + }, + "netflow": { + "bgp_destination_as_number": 0, + "bgp_source_as_number": 0, + "destination_ipv6_address": "2a02:cf40::2", + "destination_transport_port": 135, + "exporter": { + "address": "81.2.69.144:4444", + "source_id": 2875616939, + "timestamp": "2018-04-15T03:30:00Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_seconds": "2018-04-15T03:29:02Z", + "flow_start_seconds": "2018-04-15T03:28:44Z", + "procera_base_service": "IP protocol 58 (IPv6-ICMP)", + "procera_content_categories": "", + "procera_flow_behavior": "INITIAL,SERVER_IS_LOCAL,BEGINNING,ESTABLISHED", + "procera_http_content_type": "", + "procera_http_file_length": 0, + "procera_http_location": "", + "procera_http_url": "", + "procera_incoming_octets": 86, + "procera_outgoing_octets": 78, + "procera_service": "IP protocol 58 (IPv6-ICMP)", + "procera_subscriber_identifier": "", + "procera_template_name": "IPFIX", + "protocol_identifier": 58, + "source_ipv6_address": "2a02:cf40::1", + "source_transport_port": 136, + "type": "netflow_flow" + }, + "network": { + "community_id": "1:vK+Zeop1Y3GHxfFGVF2/COcNBWw=", + "direction": "unknown", + "iana_number": 58, + "transport": "ipv6-icmp" + }, + "observer": { + "ip": "81.2.69.144" + }, + "related": { + "ip": [ + "0.0.0.0" + ] + }, + "source": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 136 + } + } + ] +} \ No newline at end of file diff --git a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json new file mode 100644 index 00000000000..8b3f75a1aec --- /dev/null +++ b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json @@ -0,0 +1,3587 @@ +{ + "expected": [ + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 719, + "packets": 5 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184158, + "flow_start_sys_up_time": 564184140, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 719, + "initiator_packets": 5, + "ip_diff_serv_code_point": 0, + "ip_ttl": 49, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 719, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 5, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 719, + "packets": 5 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1477, + "packets": 6 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184154, + "flow_start_sys_up_time": 564184140, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 1477, + "initiator_packets": 6, + "ip_diff_serv_code_point": 0, + "ip_ttl": 49, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 1477, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 6, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 1477, + "packets": 6 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1, + "packets": 1 + }, + "destination": { + "bytes": 0, + "packets": 1 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 2, + 8 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 1, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 89, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184144, + "flow_start_sys_up_time": 564184142, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 1, + "initiator_packets": 1, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 1, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 1, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 2, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 1 + }, + "source": { + "bytes": 1, + "packets": 1 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 108580, + "packets": 79 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 2, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184216, + "flow_start_sys_up_time": 564184131, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 108580, + "initiator_packets": 79, + "ip_diff_serv_code_point": 0, + "ip_ttl": 49, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 108580, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 79, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 108580, + "packets": 79 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 342, + "packets": 5 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184208, + "flow_start_sys_up_time": 564184176, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 342, + "initiator_packets": 5, + "ip_diff_serv_code_point": 0, + "ip_ttl": 49, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 342, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 5, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 342, + "packets": 5 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1851, + "packets": 17 + }, + "destination": { + "bytes": 9437, + "packets": 18 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 2, + "art_count_late_responses": 0, + "art_count_responses": 3, + "art_count_retransmissions": 0, + "art_count_transactions": 2, + "art_network_time_sum": 97, + "art_response_time_sum": 153, + "art_server_network_time_sum": 95, + "art_server_response_time_maximum": 8, + "art_server_response_time_sum": 13, + "art_total_response_time_sum": 156, + "art_total_transaction_time_sum": 100, + "biflow_direction": 1, + "connection_sum_duration_seconds": 24, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564197394, + "flow_start_sys_up_time": 564184067, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 1851, + "initiator_packets": 17, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 2, + "protocol_identifier": 6, + "responder_octets": 9437, + "responder_packets": 18, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 11288, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 35, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 9437, + "packets": 18 + }, + "source": { + "bytes": 1851, + "packets": 17 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 51480, + "packets": 39 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184216, + "flow_start_sys_up_time": 564184182, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 51480, + "initiator_packets": 39, + "ip_diff_serv_code_point": 0, + "ip_ttl": 49, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 51480, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 39, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 51480, + "packets": 39 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 5135, + "packets": 55 + }, + "destination": { + "bytes": 36894, + "packets": 47 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 10, + "art_count_late_responses": 0, + "art_count_responses": 15, + "art_count_retransmissions": 0, + "art_count_transactions": 14, + "art_network_time_sum": 374, + "art_response_time_sum": 516, + "art_server_network_time_sum": 364, + "art_server_response_time_maximum": 27, + "art_server_response_time_sum": 117, + "art_total_response_time_sum": 541, + "art_total_transaction_time_sum": 512, + "biflow_direction": 1, + "connection_sum_duration_seconds": 35, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564203810, + "flow_start_sys_up_time": 564184040, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 5135, + "initiator_packets": 55, + "ip_diff_serv_code_point": 0, + "ip_ttl": 126, + "new_connection_delta_count": 6, + "protocol_identifier": 6, + "responder_octets": 36894, + "responder_packets": 47, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 42029, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 102, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 36894, + "packets": 47 + }, + "source": { + "bytes": 5135, + "packets": 55 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 6533, + "packets": 14 + }, + "destination": { + "bytes": 6400, + "packets": 20 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 2, + 99 + ], + "art_client_network_time_sum": 5, + "art_count_late_responses": 0, + "art_count_responses": 6, + "art_count_retransmissions": 1, + "art_count_transactions": 6, + "art_network_time_sum": 23, + "art_response_time_sum": 123, + "art_server_network_time_sum": 18, + "art_server_response_time_maximum": 31, + "art_server_response_time_sum": 78, + "art_total_response_time_sum": 138, + "art_total_transaction_time_sum": 123, + "biflow_direction": 2, + "connection_sum_duration_seconds": 64, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564200378, + "flow_start_sys_up_time": 564184163, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 6400, + "initiator_packets": 20, + "ip_diff_serv_code_point": 0, + "ip_ttl": 61, + "new_connection_delta_count": 2, + "protocol_identifier": 6, + "responder_octets": 6533, + "responder_packets": 14, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 12933, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 34, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 6400, + "packets": 20 + }, + "source": { + "bytes": 6533, + "packets": 14 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 5684, + "packets": 491 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 0, + 49 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 109, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564185840, + "flow_start_sys_up_time": 564184196, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 5684, + "initiator_packets": 491, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 5684, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 491, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 5684, + "packets": 491 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 4965, + "packets": 13 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184254, + "flow_start_sys_up_time": 564184154, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 4965, + "initiator_packets": 13, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 4965, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 13, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 4965, + "packets": 13 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 138, + "packets": 4 + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 2, + 99 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 2, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 119878, + "biflow_direction": 2, + "connection_sum_duration_seconds": 239, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184362, + "flow_start_sys_up_time": 564184214, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 0, + "initiator_packets": 2, + "ip_diff_serv_code_point": 0, + "ip_ttl": 61, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 138, + "responder_packets": 4, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 138, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 6, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 2 + }, + "source": { + "bytes": 138, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1, + "packets": 1 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 2, + 8 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 1, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 44, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184220, + "flow_start_sys_up_time": 564184220, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 1, + "initiator_packets": 1, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 1, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 1, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 1, + "packets": 1 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 6079, + "packets": 10 + }, + "destination": { + "bytes": 1571, + "packets": 13 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 3, + "art_count_late_responses": 0, + "art_count_responses": 3, + "art_count_retransmissions": 0, + "art_count_transactions": 2, + "art_network_time_sum": 149, + "art_response_time_sum": 444, + "art_server_network_time_sum": 146, + "art_server_response_time_maximum": 3, + "art_server_response_time_sum": 6, + "art_total_response_time_sum": 453, + "art_total_transaction_time_sum": 296, + "biflow_direction": 2, + "connection_sum_duration_seconds": 62, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564215068, + "flow_start_sys_up_time": 564184067, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 1571, + "initiator_packets": 13, + "ip_diff_serv_code_point": 0, + "ip_ttl": 220, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 6079, + "responder_packets": 10, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 7650, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 23, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 1571, + "packets": 13 + }, + "source": { + "bytes": 6079, + "packets": 10 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 2807, + "packets": 6 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184252, + "flow_start_sys_up_time": 564183878, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 2807, + "initiator_packets": 6, + "ip_diff_serv_code_point": 0, + "ip_ttl": 61, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 2807, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 6, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 2807, + "packets": 6 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 0, + "packets": 1 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 0, + 1 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 59, + "egress_interface": 4, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184248, + "flow_start_sys_up_time": 564184248, + "ingress_interface": 1, + "ingress_vrfid": 0, + "initiator_octets": 0, + "initiator_packets": 1, + "ip_diff_serv_code_point": 0, + "ip_ttl": 124, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 0, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 1, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 0, + "packets": 1 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1877, + "packets": 11 + }, + "destination": { + "bytes": 3409, + "packets": 7 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 2, + "art_count_late_responses": 0, + "art_count_responses": 4, + "art_count_retransmissions": 0, + "art_count_transactions": 4, + "art_network_time_sum": 6, + "art_response_time_sum": 23, + "art_server_network_time_sum": 4, + "art_server_response_time_maximum": 3, + "art_server_response_time_sum": 7, + "art_total_response_time_sum": 31, + "art_total_transaction_time_sum": 23, + "biflow_direction": 1, + "connection_sum_duration_seconds": 32, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564200378, + "flow_start_sys_up_time": 564184251, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 1877, + "initiator_packets": 11, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 3409, + "responder_packets": 7, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 5286, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 18, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 3409, + "packets": 7 + }, + "source": { + "bytes": 1877, + "packets": 11 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 2255, + "packets": 7 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184286, + "flow_start_sys_up_time": 564184040, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 2255, + "initiator_packets": 7, + "ip_diff_serv_code_point": 0, + "ip_ttl": 61, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 2255, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 7, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 2255, + "packets": 7 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 538, + "packets": 5 + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.938Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184314, + "flow_start_sys_up_time": 564184284, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 538, + "initiator_packets": 5, + "ip_diff_serv_code_point": 0, + "ip_ttl": 49, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 538, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 5, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 538, + "packets": 5 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1487, + "packets": 21 + }, + "destination": { + "bytes": 6305, + "packets": 15 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 2, + 102 + ], + "art_client_network_time_sum": 2, + "art_count_late_responses": 0, + "art_count_responses": 5, + "art_count_retransmissions": 0, + "art_count_transactions": 5, + "art_network_time_sum": 9, + "art_response_time_sum": 72, + "art_server_network_time_sum": 7, + "art_server_response_time_maximum": 25, + "art_server_response_time_sum": 55, + "art_total_response_time_sum": 77, + "art_total_transaction_time_sum": 59870, + "biflow_direction": 1, + "connection_sum_duration_seconds": 181, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564214304, + "flow_start_sys_up_time": 564184296, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 1487, + "initiator_packets": 21, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 2, + "protocol_identifier": 6, + "responder_octets": 6305, + "responder_packets": 15, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 7792, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 36, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 6305, + "packets": 15 + }, + "source": { + "bytes": 1487, + "packets": 21 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 3110, + "packets": 7 + }, + "destination": { + "bytes": 1973, + "packets": 10 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 2, + 99 + ], + "art_client_network_time_sum": 2, + "art_count_late_responses": 0, + "art_count_responses": 3, + "art_count_retransmissions": 0, + "art_count_transactions": 3, + "art_network_time_sum": 12, + "art_response_time_sum": 39, + "art_server_network_time_sum": 10, + "art_server_response_time_maximum": 14, + "art_server_response_time_sum": 15, + "art_total_response_time_sum": 45, + "art_total_transaction_time_sum": 39, + "biflow_direction": 2, + "connection_sum_duration_seconds": 32, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564200376, + "flow_start_sys_up_time": 564184268, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 1973, + "initiator_packets": 10, + "ip_diff_serv_code_point": 0, + "ip_ttl": 61, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 3110, + "responder_packets": 7, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 5083, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 17, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 1973, + "packets": 10 + }, + "source": { + "bytes": 3110, + "packets": 7 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 2, + "packets": 4 + }, + "destination": { + "bytes": 2, + "packets": 4 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 5, + 153 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 2, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 2, + "connection_sum_duration_seconds": 119, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564214242, + "flow_start_sys_up_time": 564184300, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 2, + "initiator_packets": 4, + "ip_diff_serv_code_point": 0, + "ip_ttl": 124, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 2, + "responder_packets": 4, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 4, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 8, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 2, + "packets": 4 + }, + "source": { + "bytes": 2, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 2, + "packets": 2 + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 2, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 179, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184580, + "flow_start_sys_up_time": 564184306, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 2, + "initiator_packets": 2, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 2, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 2, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 4, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 2 + }, + "source": { + "bytes": 2, + "packets": 2 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 0, + "packets": 4 + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 2, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 18, + "biflow_direction": 1, + "connection_sum_duration_seconds": 119, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184326, + "flow_start_sys_up_time": 564184326, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 0, + "initiator_packets": 4, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 2, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 0, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 6, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 2 + }, + "source": { + "bytes": 0, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 1005, + "packets": 4 + }, + "destination": { + "bytes": 174, + "packets": 3 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 5, + 153 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 1, + "art_count_retransmissions": 1, + "art_count_transactions": 1, + "art_network_time_sum": 0, + "art_response_time_sum": 5, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 5, + "art_server_response_time_sum": 5, + "art_total_response_time_sum": 8, + "art_total_transaction_time_sum": 12, + "biflow_direction": 1, + "connection_sum_duration_seconds": 119, + "egress_interface": 10, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564214476, + "flow_start_sys_up_time": 564184326, + "ingress_interface": 13, + "ingress_vrfid": 0, + "initiator_octets": 1005, + "initiator_packets": 4, + "ip_diff_serv_code_point": 0, + "ip_ttl": 125, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 174, + "responder_packets": 3, + "type": "netflow_flow", + "vlan_id": 290, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 1179, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 7, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 174, + "packets": 3 + }, + "source": { + "bytes": 1005, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 138, + "packets": 4 + }, + "destination": { + "bytes": 0, + "packets": 2 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 2, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 119644, + "biflow_direction": 2, + "connection_sum_duration_seconds": 238, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184490, + "flow_start_sys_up_time": 564184336, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 0, + "initiator_packets": 2, + "ip_diff_serv_code_point": 0, + "ip_ttl": 61, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 138, + "responder_packets": 4, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 138, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 6, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 2 + }, + "source": { + "bytes": 138, + "packets": 4 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 31, + "packets": 2 + }, + "destination": { + "bytes": 0, + "packets": 1 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 1, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 59790, + "biflow_direction": 2, + "connection_sum_duration_seconds": 119, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184350, + "flow_start_sys_up_time": 564184348, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 0, + "initiator_packets": 1, + "ip_diff_serv_code_point": 0, + "ip_ttl": 43, + "new_connection_delta_count": 0, + "protocol_identifier": 6, + "responder_octets": 31, + "responder_packets": 2, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 31, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 3, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 0, + "packets": 1 + }, + "source": { + "bytes": 31, + "packets": 2 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 13482, + "packets": 17 + }, + "destination": { + "bytes": 8989, + "packets": 19 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 1, + 197 + ], + "art_client_network_time_sum": 3, + "art_count_late_responses": 0, + "art_count_responses": 6, + "art_count_retransmissions": 0, + "art_count_transactions": 6, + "art_network_time_sum": 3, + "art_response_time_sum": 33, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 28, + "art_server_response_time_sum": 33, + "art_total_response_time_sum": 51, + "art_total_transaction_time_sum": 43, + "biflow_direction": 2, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184586, + "flow_start_sys_up_time": 564184356, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 8989, + "initiator_packets": 19, + "ip_diff_serv_code_point": 0, + "ip_ttl": 124, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 13482, + "responder_packets": 17, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 22471, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 36, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 8989, + "packets": 19 + }, + "source": { + "bytes": 13482, + "packets": 17 + } + }, + { + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", + "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", + "name": "mbp.local", + "type": "filebeat", + "version": "8.0.0" + }, + "client": { + "bytes": 28373, + "packets": 133 + }, + "destination": { + "bytes": 233345, + "packets": 236 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network", + "session" + ], + "created": "2021-05-19T09:08:51.939Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "host": { + "name": "mbp.local" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 13, + 0, + 2, + 99 + ], + "art_client_network_time_sum": 20, + "art_count_late_responses": 0, + "art_count_responses": 25, + "art_count_retransmissions": 4, + "art_count_transactions": 25, + "art_network_time_sum": 58, + "art_response_time_sum": 301, + "art_server_network_time_sum": 38, + "art_server_response_time_maximum": 31, + "art_server_response_time_sum": 168, + "art_total_response_time_sum": 363, + "art_total_transaction_time_sum": 332, + "biflow_direction": 2, + "connection_sum_duration_seconds": 116, + "egress_interface": 13, + "exporter": { + "address": "127.0.0.1:62809", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564215336, + "flow_start_sys_up_time": 564184380, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 233345, + "initiator_packets": 236, + "ip_diff_serv_code_point": 0, + "ip_ttl": 61, + "new_connection_delta_count": 8, + "protocol_identifier": 6, + "responder_octets": 28373, + "responder_packets": 133, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 261718, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 369, + "transport": "tcp" + }, + "observer": { + "ip": [ + "127.0.0.1" + ] + }, + "server": { + "bytes": 233345, + "packets": 236 + }, + "source": { + "bytes": 28373, + "packets": 133 + } + }, + { + "@timestamp": "2020-04-16T23:22:51Z", + "destination": { + "ip": "10.36.236.100", + "locality": "internal", + "port": 54594 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "6mUV1nPVG80", + "locality": "internal" + }, + "netflow": { + "destination_ipv4_address": "10.36.236.100", + "destination_transport_port": 54594, + "egress_interface": 1, + "exporter": { + "address": "81.2.69.144:10000", + "source_id": 1, + "timestamp": "2020-04-16T23:22:51Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_milliseconds": "2020-04-16T23:22:48.963Z", + "flow_end_reason": 3, + "flow_start_milliseconds": "2020-04-16T23:22:48.96Z", + "ingress_interface": 1, + "octet_delta_count": 1855, + "packet_delta_count": 5, + "protocol_identifier": 6, + "source_ipv4_address": "10.127.32.11", + "source_transport_port": 53, + "tcp_control_bits": 27, + "type": "netflow_flow" + }, + "network": { + "bytes": 1855, + "community_id": "1:+/kh1SKruHHnZ5JGSMfWk9nZx8o=", + "direction": "internal", + "iana_number": "6", + "packets": 5, + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ip": [ + "81.2.69.144" + ] + }, + "related": { + "ip": [ + "10.36.236.100", + "10.127.32.11" + ] + }, + "source": { + "bytes": 1855, + "ip": "10.127.32.11", + "locality": "internal", + "packets": 5, + "port": 53 + } + }, + { + "@timestamp": "2020-04-16T23:22:51Z", + "destination": { + "ip": "10.36.236.100", + "locality": "internal", + "port": 49180 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "HVg4SttTufc", + "locality": "external" + }, + "netflow": { + "destination_ipv4_address": "10.36.236.100", + "destination_transport_port": 49180, + "egress_interface": 1, + "exporter": { + "address": "81.2.69.144:10000", + "source_id": 1, + "timestamp": "2020-04-16T23:22:51Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_milliseconds": "2020-04-16T23:22:48.404Z", + "flow_end_reason": 3, + "flow_start_milliseconds": "2020-04-16T23:22:47.995Z", + "ingress_interface": 1, + "octet_delta_count": 7158, + "packet_delta_count": 10, + "protocol_identifier": 6, + "source_ipv4_address": "89.160.20.112", + "source_transport_port": 443, + "tcp_control_bits": 27, + "type": "netflow_flow" + }, + "network": { + "bytes": 7158, + "community_id": "1:Zyly7BCJ6D7luuRJJazRxZ/mFZM=", + "direction": "inbound", + "iana_number": "6", + "packets": 10, + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ip": [ + "81.2.69.144" + ] + }, + "related": { + "ip": [ + "10.36.236.100", + "89.160.20.112" + ] + }, + "source": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "bytes": 7158, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "locality": "external", + "packets": 10, + "port": 443 + } + }, + { + "@timestamp": "2020-04-16T23:22:51Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "locality": "external", + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "HVg4SttTufc", + "locality": "external" + }, + "netflow": { + "destination_ipv4_address": "89.160.20.112", + "destination_transport_port": 443, + "egress_interface": 1, + "exporter": { + "address": "81.2.69.144:10000", + "source_id": 1, + "timestamp": "2020-04-16T23:22:51Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_milliseconds": "2020-04-16T23:22:48.404Z", + "flow_end_reason": 3, + "flow_start_milliseconds": "2020-04-16T23:22:47.92Z", + "ingress_interface": 1, + "octet_delta_count": 1538, + "packet_delta_count": 11, + "protocol_identifier": 6, + "source_ipv4_address": "10.36.236.100", + "source_transport_port": 49180, + "tcp_control_bits": 27, + "type": "netflow_flow" + }, + "network": { + "bytes": 1538, + "community_id": "1:Zyly7BCJ6D7luuRJJazRxZ/mFZM=", + "direction": "outbound", + "iana_number": "6", + "packets": 11, + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "ip": [ + "81.2.69.144" + ] + }, + "related": { + "ip": [ + "10.36.236.100", + "89.160.20.112" + ] + }, + "source": { + "bytes": 1538, + "ip": "10.36.236.100", + "locality": "internal", + "packets": 11, + "port": 49180 + } + }, + { + "@timestamp": "2018-04-15T03:30:00Z", + "destination": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 135 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "GYmhjYyvaAI", + "locality": "internal" + }, + "netflow": { + "bgp_destination_as_number": 0, + "bgp_source_as_number": 0, + "destination_ipv4_address": "0.0.0.0", + "destination_ipv6_address": "2a02:cf40::2", + "destination_transport_port": 135, + "exporter": { + "address": "81.2.69.144:4444", + "source_id": 2875616939, + "timestamp": "2018-04-15T03:30:00Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_seconds": "2018-04-15T03:29:02Z", + "flow_start_seconds": "2018-04-15T03:28:44Z", + "procera_base_service": "IP protocol 58 (IPv6-ICMP)", + "procera_content_categories": "", + "procera_flow_behavior": "INITIAL,SERVER_IS_LOCAL,BEGINNING,ESTABLISHED", + "procera_http_content_type": "", + "procera_http_file_length": 0, + "procera_http_location": "", + "procera_http_url": "", + "procera_incoming_octets": 86, + "procera_outgoing_octets": 78, + "procera_service": "IP protocol 58 (IPv6-ICMP)", + "procera_subscriber_identifier": "", + "procera_template_name": "IPFIX", + "protocol_identifier": 58, + "source_ipv4_address": "0.0.0.0", + "source_ipv6_address": "2a02:cf40::1", + "source_transport_port": 136, + "type": "netflow_flow" + }, + "network": { + "community_id": "1:vK+Zeop1Y3GHxfFGVF2/COcNBWw=", + "direction": "internal", + "iana_number": "58", + "transport": "ipv6-icmp", + "type": [ + "ipv4", + "ipv6" + ] + }, + "observer": { + "ip": [ + "81.2.69.144" + ] + }, + "related": { + "ip": [ + "0.0.0.0" + ] + }, + "source": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 136 + } + }, + { + "@timestamp": "2018-04-15T03:30:00Z", + "destination": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 135 + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "netflow_flow", + "category": [ + "network" + ], + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "GYmhjYyvaAI", + "locality": "internal" + }, + "netflow": { + "bgp_destination_as_number": 0, + "bgp_source_as_number": 0, + "destination_ipv6_address": "2a02:cf40::2", + "destination_transport_port": 135, + "exporter": { + "address": "81.2.69.144:4444", + "source_id": 2875616939, + "timestamp": "2018-04-15T03:30:00Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_seconds": "2018-04-15T03:29:02Z", + "flow_start_seconds": "2018-04-15T03:28:44Z", + "procera_base_service": "IP protocol 58 (IPv6-ICMP)", + "procera_content_categories": "", + "procera_flow_behavior": "INITIAL,SERVER_IS_LOCAL,BEGINNING,ESTABLISHED", + "procera_http_content_type": "", + "procera_http_file_length": 0, + "procera_http_location": "", + "procera_http_url": "", + "procera_incoming_octets": 86, + "procera_outgoing_octets": 78, + "procera_service": "IP protocol 58 (IPv6-ICMP)", + "procera_subscriber_identifier": "", + "procera_template_name": "IPFIX", + "protocol_identifier": 58, + "source_ipv6_address": "2a02:cf40::1", + "source_transport_port": 136, + "type": "netflow_flow" + }, + "network": { + "community_id": "1:vK+Zeop1Y3GHxfFGVF2/COcNBWw=", + "direction": "internal", + "iana_number": "58", + "transport": "ipv6-icmp", + "type": "ipv6" + }, + "observer": { + "ip": [ + "81.2.69.144" + ] + }, + "related": { + "ip": [ + "0.0.0.0" + ] + }, + "source": { + "ip": "0.0.0.0", + "locality": "internal", + "port": 136 + } + } + ] +} \ No newline at end of file diff --git a/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml b/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml new file mode 100644 index 00000000000..d55e2268d3c --- /dev/null +++ b/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml @@ -0,0 +1,9 @@ +service: netflow-log-netflow +service_notify_signal: SIGHUP +input: netflow +data_stream: + vars: + host: 0.0.0.0 + port: 2055 +numeric_keyword_fields: + - network.iana_number diff --git a/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs new file mode 100644 index 00000000000..c2d192f3c75 --- /dev/null +++ b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs @@ -0,0 +1,37 @@ +protocols: [v1, v5, v6, v7, v8, v9, ipfix] +host: '{{host}}:{{port}}' +max_message_size: '{{max_message_size}}' +expiration_timeout: '{{expiration_timeout}}' +queue_size: {{queue_size}} +{{#if timeout}} +timeout: '{{timeout}}' +{{/if}} +{{#if read_buffer}} +read_buffer: '{{read_buffer}}' +{{/if}} +{{#if internal_networks}} +internal_networks: +{{#each internal_networks as |network|}} + - {{network}} +{{/each}} +{{/if}} +{{#if custom_definitions}} +custom_definitions: +{{#each custom_definitions as |def|}} +- '{{def}}' +{{/each}} +{{/if}} +{{#if detect_sequence_reset}} +detect_sequence_reset: {{detect_sequence_reset}} +{{/if}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..2dd1531816f --- /dev/null +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,115 @@ +--- +description: Pipeline for NetFlow + +processors: + - set: + field: ecs.version + value: '8.11.0' + - convert: + field: network.iana_number + type: string + ignore_missing: true + ignore_failure: true + - rename: + field: observer.ip + target_field: _tmp_.observer.ip + ignore_missing: true + - append: + field: observer.ip + value: '{{_tmp_.observer.ip}}' + if: ctx._tmp_?.observer?.ip != null + - set: + field: event.category + value: + - network + - session + if: ctx.event?.category != null && ctx.event?.category == "network_session" + - set: + field: network.type + value: ipv4 + if: ctx.netflow?.source_ipv4_address != null || ctx.netflow?.destination_ipv4_address != null + - set: + field: network.type + value: ipv6 + if: (ctx.netflow?.source_ipv6_address != null || ctx.netflow?.destination_ipv6_address != null) && ctx.network?.type == null + - append: + field: network.type + value: ipv6 + if: (ctx.netflow?.source_ipv6_address != null || ctx.netflow?.destination_ipv6_address != null) && ctx.network?.type == "ipv4" + - set: + field: network.direction + value: inbound + if: ctx.source?.locality == "external" && ctx.destination?.locality == "internal" + - set: + field: network.direction + value: outbound + if: ctx.source?.locality == "internal" && ctx.destination?.locality == "external" + - set: + field: network.direction + value: internal + if: ctx.source?.locality == "internal" && ctx.destination?.locality == "internal" + - set: + field: network.direction + value: external + if: ctx.source?.locality == "external" && ctx.destination?.locality == "external" + - set: + field: network.direction + value: unknown + if: ctx.network?.direction == null + + # IP Geolocation Lookup + - geoip: + if: ctx.source?.geo == null + field: source.ip + target_field: source.geo + ignore_missing: true + - geoip: + if: ctx.destination?.geo == null + field: destination.ip + target_field: destination.geo + ignore_missing: true + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + - remove: + field: + - _tmp_ + ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/endace/data_stream/log/fields/agent.yml b/packages/endace/data_stream/log/fields/agent.yml new file mode 100644 index 00000000000..58486db7990 --- /dev/null +++ b/packages/endace/data_stream/log/fields/agent.yml @@ -0,0 +1,71 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + external: ecs + - name: image.name + external: ecs + - name: labels + external: ecs + - name: name + external: ecs +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: os.kernel + external: ecs + - name: os.platform + external: ecs + - name: os.version + external: ecs + - name: type + external: ecs + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/endace/data_stream/log/fields/base-fields.yml b/packages/endace/data_stream/log/fields/base-fields.yml new file mode 100644 index 00000000000..c29343334e3 --- /dev/null +++ b/packages/endace/data_stream/log/fields/base-fields.yml @@ -0,0 +1,17 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: netflow +- name: event.dataset + type: constant_keyword + description: Event dataset + value: endace.log diff --git a/packages/endace/data_stream/log/fields/ecs.yml b/packages/endace/data_stream/log/fields/ecs.yml new file mode 100644 index 00000000000..c25e61cef3c --- /dev/null +++ b/packages/endace/data_stream/log/fields/ecs.yml @@ -0,0 +1,712 @@ +- external: ecs + name: '@timestamp' +- external: ecs + name: agent.ephemeral_id +- external: ecs + name: agent.id +- external: ecs + name: agent.name +- external: ecs + name: agent.type +- external: ecs + name: agent.version +- external: ecs + name: client.address +- external: ecs + name: client.as.organization.name +- external: ecs + name: client.bytes +- external: ecs + name: client.domain +- external: ecs + name: client.geo.city_name +- external: ecs + name: client.geo.continent_name +- external: ecs + name: client.geo.country_iso_code +- external: ecs + name: client.geo.country_name +- external: ecs + name: client.geo.location +- external: ecs + name: client.geo.name +- external: ecs + name: client.geo.region_iso_code +- external: ecs + name: client.geo.region_name +- external: ecs + name: client.ip +- external: ecs + name: client.mac +- external: ecs + name: client.nat.ip +- external: ecs + name: client.nat.port +- external: ecs + name: client.packets +- external: ecs + name: client.port +- external: ecs + name: client.registered_domain +- external: ecs + name: client.top_level_domain +- external: ecs + name: client.user.domain +- external: ecs + name: client.user.email +- external: ecs + name: client.user.full_name +- external: ecs + name: client.user.group.domain +- external: ecs + name: client.user.group.id +- external: ecs + name: client.user.group.name +- external: ecs + name: client.user.hash +- external: ecs + name: client.user.id +- external: ecs + name: client.user.name +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.availability_zone +- external: ecs + name: cloud.instance.id +- external: ecs + name: cloud.instance.name +- external: ecs + name: cloud.machine.type +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: container.image.tag +- external: ecs + name: container.runtime +- external: ecs + name: destination.address +- external: ecs + name: destination.as.number +- external: ecs + name: destination.as.organization.name +- external: ecs + name: destination.bytes +- external: ecs + name: destination.domain +- external: ecs + name: destination.geo.city_name +- external: ecs + name: destination.geo.continent_name +- external: ecs + name: destination.geo.country_iso_code +- external: ecs + name: destination.geo.country_name +- external: ecs + name: destination.geo.location +- external: ecs + name: destination.geo.name +- external: ecs + name: destination.geo.region_iso_code +- external: ecs + name: destination.geo.region_name +- external: ecs + name: destination.ip +- external: ecs + name: destination.mac +- external: ecs + name: destination.nat.ip +- external: ecs + name: destination.nat.port +- external: ecs + name: destination.packets +- external: ecs + name: destination.port +- external: ecs + name: destination.registered_domain +- external: ecs + name: destination.top_level_domain +- external: ecs + name: destination.user.domain +- external: ecs + name: destination.user.email +- external: ecs + name: destination.user.full_name +- external: ecs + name: destination.user.group.domain +- external: ecs + name: destination.user.group.id +- external: ecs + name: destination.user.group.name +- external: ecs + name: destination.user.hash +- external: ecs + name: destination.user.id +- external: ecs + name: destination.user.name +- external: ecs + name: dns.answers + type: group +- external: ecs + name: dns.answers.class +- external: ecs + name: dns.answers.data +- external: ecs + name: dns.answers.name +- external: ecs + name: dns.answers.ttl +- external: ecs + name: dns.answers.type +- external: ecs + name: dns.header_flags +- external: ecs + name: dns.id +- external: ecs + name: dns.op_code +- external: ecs + name: dns.question.class +- external: ecs + name: dns.question.name +- external: ecs + name: dns.question.registered_domain +- external: ecs + name: dns.question.subdomain +- external: ecs + name: dns.question.top_level_domain +- external: ecs + name: dns.question.type +- external: ecs + name: dns.resolved_ip +- external: ecs + name: dns.response_code +- external: ecs + name: dns.type +- external: ecs + name: ecs.version +- external: ecs + name: error.code +- external: ecs + name: error.id +- external: ecs + name: error.message +- external: ecs + name: error.stack_trace +- external: ecs + name: error.type +- external: ecs + name: event.action +- external: ecs + name: event.category +- external: ecs + name: event.code +- external: ecs + name: event.created +- external: ecs + name: event.duration +- external: ecs + name: event.end +- external: ecs + name: event.hash +- external: ecs + name: event.id +- external: ecs + name: event.ingested +- external: ecs + name: event.kind +- external: ecs + name: event.original +- external: ecs + name: event.outcome +- external: ecs + name: event.provider +- external: ecs + name: event.risk_score +- external: ecs + name: event.risk_score_norm +- external: ecs + name: event.sequence +- external: ecs + name: event.severity +- external: ecs + name: event.start +- external: ecs + name: event.timezone +- external: ecs + name: event.type +- external: ecs + name: file.accessed +- external: ecs + name: file.created +- external: ecs + name: file.ctime +- external: ecs + name: file.device +- external: ecs + name: file.directory +- external: ecs + name: file.extension +- external: ecs + name: file.gid +- external: ecs + name: file.group +- external: ecs + name: file.hash.md5 +- external: ecs + name: file.hash.sha1 +- external: ecs + name: file.hash.sha256 +- external: ecs + name: file.hash.sha512 +- external: ecs + name: file.inode +- external: ecs + name: file.mode +- external: ecs + name: file.mtime +- external: ecs + name: file.name +- external: ecs + name: file.owner +- external: ecs + name: file.path +- external: ecs + name: file.size +- external: ecs + name: file.target_path +- external: ecs + name: file.type +- external: ecs + name: file.uid +- external: ecs + name: group.domain +- external: ecs + name: group.id +- external: ecs + name: group.name +- external: ecs + name: host.architecture +- external: ecs + name: host.geo.city_name +- external: ecs + name: host.geo.continent_name +- external: ecs + name: host.geo.country_iso_code +- external: ecs + name: host.geo.country_name +- external: ecs + name: host.geo.location +- external: ecs + name: host.geo.name +- external: ecs + name: host.geo.region_iso_code +- external: ecs + name: host.geo.region_name +- external: ecs + name: host.hostname +- external: ecs + name: host.id +- external: ecs + name: host.ip +- external: ecs + name: host.mac +- external: ecs + name: host.name +- external: ecs + name: host.os.family +- external: ecs + name: host.os.full +- external: ecs + name: host.os.name +- external: ecs + name: host.uptime +- external: ecs + name: http.request.body.bytes +- external: ecs + name: http.request.body.content +- external: ecs + name: http.request.bytes +- external: ecs + name: http.request.method +- external: ecs + name: http.request.referrer +- external: ecs + name: http.response.body.bytes +- external: ecs + name: http.response.body.content +- external: ecs + name: http.response.bytes +- external: ecs + name: http.response.status_code +- external: ecs + name: http.version +- external: ecs + name: labels +- external: ecs + name: log.level +- external: ecs + name: log.logger +- external: ecs + name: log.origin.file.line +- external: ecs + name: log.origin.file.name +- external: ecs + name: log.origin.function +- external: ecs + name: log.syslog + type: group +- external: ecs + name: log.syslog.facility.code +- external: ecs + name: log.syslog.facility.name +- external: ecs + name: log.syslog.priority +- external: ecs + name: log.syslog.severity.code +- external: ecs + name: log.syslog.severity.name +- external: ecs + name: message +- external: ecs + name: network.application +- external: ecs + name: network.bytes +- external: ecs + name: network.community_id +- external: ecs + name: network.direction +- external: ecs + name: network.forwarded_ip +- external: ecs + name: network.iana_number +- external: ecs + name: network.name +- external: ecs + name: network.packets +- external: ecs + name: network.protocol +- external: ecs + name: network.transport +- external: ecs + name: network.type +- external: ecs + name: observer.geo.city_name +- external: ecs + name: observer.geo.continent_name +- external: ecs + name: observer.geo.country_iso_code +- external: ecs + name: observer.geo.country_name +- external: ecs + name: observer.geo.location +- external: ecs + name: observer.geo.name +- external: ecs + name: observer.geo.region_iso_code +- external: ecs + name: observer.geo.region_name +- external: ecs + name: observer.hostname +- external: ecs + name: observer.ip +- external: ecs + name: observer.mac +- external: ecs + name: observer.name +- external: ecs + name: observer.os.family +- external: ecs + name: observer.os.full +- external: ecs + name: observer.os.kernel +- external: ecs + name: observer.os.name +- external: ecs + name: observer.os.platform +- external: ecs + name: observer.os.version +- external: ecs + name: observer.product +- external: ecs + name: observer.serial_number +- external: ecs + name: observer.type +- external: ecs + name: observer.vendor +- external: ecs + name: observer.version +- external: ecs + name: organization.id +- external: ecs + name: organization.name +- external: ecs + name: package.architecture +- external: ecs + name: package.checksum +- external: ecs + name: package.description +- external: ecs + name: package.install_scope +- external: ecs + name: package.installed +- external: ecs + name: package.license +- external: ecs + name: package.name +- external: ecs + name: package.path +- external: ecs + name: package.size +- external: ecs + name: package.version +- external: ecs + name: process.args +- external: ecs + name: process.executable +- external: ecs + name: process.hash.md5 +- external: ecs + name: process.hash.sha1 +- external: ecs + name: process.hash.sha256 +- external: ecs + name: process.hash.sha512 +- external: ecs + name: process.name +- external: ecs + name: process.pgid +- external: ecs + name: process.pid +- external: ecs + name: process.parent.pid +- external: ecs + name: process.start +- external: ecs + name: process.thread.id +- external: ecs + name: process.thread.name +- external: ecs + name: process.title +- external: ecs + name: process.uptime +- external: ecs + name: process.working_directory +- external: ecs + name: related.ip +- external: ecs + name: server.address +- external: ecs + name: server.as.organization.name +- external: ecs + name: server.bytes +- external: ecs + name: server.domain +- external: ecs + name: server.geo.city_name +- external: ecs + name: server.geo.continent_name +- external: ecs + name: server.geo.country_iso_code +- external: ecs + name: server.geo.country_name +- external: ecs + name: server.geo.location +- external: ecs + name: server.geo.name +- external: ecs + name: server.geo.region_iso_code +- external: ecs + name: server.geo.region_name +- external: ecs + name: server.ip +- external: ecs + name: server.mac +- external: ecs + name: server.nat.ip +- external: ecs + name: server.nat.port +- external: ecs + name: server.packets +- external: ecs + name: server.port +- external: ecs + name: server.registered_domain +- external: ecs + name: server.top_level_domain +- external: ecs + name: server.user.domain +- external: ecs + name: server.user.email +- external: ecs + name: server.user.full_name +- external: ecs + name: server.user.group.domain +- external: ecs + name: server.user.group.id +- external: ecs + name: server.user.group.name +- external: ecs + name: server.user.hash +- external: ecs + name: server.user.id +- external: ecs + name: server.user.name +- external: ecs + name: service.ephemeral_id +- external: ecs + name: service.id +- external: ecs + name: service.name +- external: ecs + name: service.node.name +- external: ecs + name: service.state +- external: ecs + name: service.type +- external: ecs + name: service.version +- external: ecs + name: source.address +- external: ecs + name: source.as.number +- external: ecs + name: source.as.organization.name +- external: ecs + name: source.bytes +- external: ecs + name: source.domain +- external: ecs + name: source.geo.city_name +- external: ecs + name: source.geo.continent_name +- external: ecs + name: source.geo.country_iso_code +- external: ecs + name: source.geo.country_name +- external: ecs + name: source.geo.location +- external: ecs + name: source.geo.name +- external: ecs + name: source.geo.region_iso_code +- external: ecs + name: source.geo.region_name +- external: ecs + name: source.ip +- external: ecs + name: source.mac +- external: ecs + name: source.nat.ip +- external: ecs + name: source.nat.port +- external: ecs + name: source.packets +- external: ecs + name: source.port +- external: ecs + name: source.registered_domain +- external: ecs + name: source.top_level_domain +- external: ecs + name: source.user.domain +- external: ecs + name: source.user.email +- external: ecs + name: source.user.full_name +- external: ecs + name: source.user.group.domain +- external: ecs + name: source.user.group.id +- external: ecs + name: source.user.group.name +- external: ecs + name: source.user.hash +- external: ecs + name: source.user.id +- external: ecs + name: source.user.name +- external: ecs + name: tags +- external: ecs + name: threat.framework +- external: ecs + name: threat.tactic.id +- external: ecs + name: threat.tactic.name +- external: ecs + name: threat.tactic.reference +- external: ecs + name: threat.technique.id +- external: ecs + name: threat.technique.name +- external: ecs + name: threat.technique.reference +- external: ecs + name: trace.id +- external: ecs + name: transaction.id +- external: ecs + name: url.domain +- external: ecs + name: url.extension +- external: ecs + name: url.fragment +- external: ecs + name: url.full +- external: ecs + name: url.original +- external: ecs + name: url.password +- external: ecs + name: url.path +- external: ecs + name: url.port +- external: ecs + name: url.query +- external: ecs + name: url.registered_domain +- external: ecs + name: url.scheme +- external: ecs + name: url.top_level_domain +- external: ecs + name: url.username +- external: ecs + name: user.domain +- external: ecs + name: user.email +- external: ecs + name: user.full_name +- external: ecs + name: user.group.domain +- external: ecs + name: user.group.id +- external: ecs + name: user.group.name +- external: ecs + name: user.hash +- external: ecs + name: user.id +- external: ecs + name: user.name +- external: ecs + name: user_agent.device.name +- external: ecs + name: user_agent.name +- external: ecs + name: user_agent.original +- external: ecs + name: user_agent.os.family +- external: ecs + name: user_agent.os.full +- external: ecs + name: user_agent.os.kernel +- external: ecs + name: user_agent.os.name +- external: ecs + name: user_agent.os.platform +- external: ecs + name: user_agent.os.version +- external: ecs + name: user_agent.version diff --git a/packages/endace/data_stream/log/fields/package-fields.yml b/packages/endace/data_stream/log/fields/package-fields.yml new file mode 100644 index 00000000000..1915b6a75d0 --- /dev/null +++ b/packages/endace/data_stream/log/fields/package-fields.yml @@ -0,0 +1,2689 @@ +- name: input.type + description: Type of Filebeat input. + type: keyword +- name: flow.locality + type: keyword + description: Identifies whether the flow involved public IP addresses or only private address. +- name: flow.id + type: keyword + description: Hash of source and destination IPs. +- name: destination.locality + type: keyword + description: Whether the destination IP is private or public. +- name: source.locality + type: keyword + description: Whether the source IP is private or public. +- name: netflow + type: group + description: > + Fields from NetFlow and IPFIX. + + fields: + - name: type + type: keyword + description: > + The type of NetFlow record described by this event. + + - name: exporter + type: group + description: > + Metadata related to the exporter device that generated this record. + + fields: + - name: address + type: keyword + description: > + Exporter's network address in IP:port format. + + - name: source_id + type: long + description: > + Observation domain ID to which this record belongs. + + - name: timestamp + type: date + description: > + Time and date of export. + + - name: uptime_millis + type: long + description: > + How long the exporter process has been running, in milliseconds. + + - name: version + type: integer + description: > + NetFlow version used. + + - name: absolute_error + type: double + - name: address_pool_high_threshold + type: long + - name: address_pool_low_threshold + type: long + - name: address_port_mapping_high_threshold + type: long + - name: address_port_mapping_low_threshold + type: long + - name: address_port_mapping_per_user_high_threshold + type: long + - name: afc_protocol + type: integer + - name: afc_protocol_name + type: keyword + - name: anonymization_flags + type: integer + - name: anonymization_technique + type: integer + - name: application_business-relevance + type: long + - name: application_category_name + type: keyword + - name: application_description + type: keyword + - name: application_group_name + type: keyword + - name: application_http_uri_statistics + type: short + - name: application_http_user-agent + type: short + - name: application_id + type: short + - name: application_name + type: keyword + - name: application_sub_category_name + type: keyword + - name: application_traffic-class + type: long + - name: art_client_network_time_maximum + type: long + - name: art_client_network_time_minimum + type: long + - name: art_client_network_time_sum + type: long + - name: art_clientpackets + type: long + - name: art_count_late_responses + type: long + - name: art_count_new_connections + type: long + - name: art_count_responses + type: long + - name: art_count_responses_histogram_bucket1 + type: long + - name: art_count_responses_histogram_bucket2 + type: long + - name: art_count_responses_histogram_bucket3 + type: long + - name: art_count_responses_histogram_bucket4 + type: long + - name: art_count_responses_histogram_bucket5 + type: long + - name: art_count_responses_histogram_bucket6 + type: long + - name: art_count_responses_histogram_bucket7 + type: long + - name: art_count_retransmissions + type: long + - name: art_count_transactions + type: long + - name: art_network_time_maximum + type: long + - name: art_network_time_minimum + type: long + - name: art_network_time_sum + type: long + - name: art_response_time_maximum + type: long + - name: art_response_time_minimum + type: long + - name: art_response_time_sum + type: long + - name: art_server_network_time_maximum + type: long + - name: art_server_network_time_minimum + type: long + - name: art_server_network_time_sum + type: long + - name: art_server_response_time_maximum + type: long + - name: art_server_response_time_minimum + type: long + - name: art_server_response_time_sum + type: long + - name: art_serverpackets + type: long + - name: art_total_response_time_maximum + type: long + - name: art_total_response_time_minimum + type: long + - name: art_total_response_time_sum + type: long + - name: art_total_transaction_time_maximum + type: long + - name: art_total_transaction_time_minimum + type: long + - name: art_total_transaction_time_sum + type: long + - name: assembled_fragment_count + type: long + - name: audit_counter + type: long + - name: average_interarrival_time + type: long + - name: bgp_destination_as_number + type: long + - name: bgp_next_adjacent_as_number + type: long + - name: bgp_next_hop_ipv4_address + type: ip + - name: bgp_next_hop_ipv6_address + type: ip + - name: bgp_prev_adjacent_as_number + type: long + - name: bgp_source_as_number + type: long + - name: bgp_validity_state + type: short + - name: biflow_direction + type: short + - name: bind_ipv4_address + type: ip + - name: bind_transport_port + type: integer + - name: class_id + type: long + - name: class_name + type: keyword + - name: classification_engine_id + type: short + - name: collection_time_milliseconds + type: date + - name: collector_certificate + type: short + - name: collector_ipv4_address + type: ip + - name: collector_ipv6_address + type: ip + - name: collector_transport_port + type: integer + - name: common_properties_id + type: long + - name: confidence_level + type: double + - name: conn_ipv4_address + type: ip + - name: conn_transport_port + type: integer + - name: connection_sum_duration_seconds + type: long + - name: connection_transaction_id + type: long + - name: conntrack_id + type: long + - name: data_byte_count + type: long + - name: data_link_frame_section + type: short + - name: data_link_frame_size + type: integer + - name: data_link_frame_type + type: integer + - name: data_records_reliability + type: boolean + - name: delta_flow_count + type: long + - name: destination_ipv4_address + type: ip + - name: destination_ipv4_prefix + type: ip + - name: destination_ipv4_prefix_length + type: short + - name: destination_ipv6_address + type: ip + - name: destination_ipv6_prefix + type: ip + - name: destination_ipv6_prefix_length + type: short + - name: destination_mac_address + type: keyword + - name: destination_transport_port + type: integer + - name: digest_hash_value + type: long + - name: distinct_count_of_destination_ip_address + type: long + - name: distinct_count_of_destination_ipv4_address + type: long + - name: distinct_count_of_destination_ipv6_address + type: long + - name: distinct_count_of_source_ip_address + type: long + - name: distinct_count_of_source_ipv4_address + type: long + - name: distinct_count_of_source_ipv6_address + type: long + - name: dns_authoritative + type: short + - name: dns_cname + type: keyword + - name: dns_id + type: integer + - name: dns_mx_exchange + type: keyword + - name: dns_mx_preference + type: integer + - name: dns_nsd_name + type: keyword + - name: dns_nx_domain + type: short + - name: dns_ptrd_name + type: keyword + - name: dns_qname + type: keyword + - name: dns_qr_type + type: integer + - name: dns_query_response + type: short + - name: dns_rr_section + type: short + - name: dns_soa_expire + type: long + - name: dns_soa_minimum + type: long + - name: dns_soa_refresh + type: long + - name: dns_soa_retry + type: long + - name: dns_soa_serial + type: long + - name: dns_soam_name + type: keyword + - name: dns_soar_name + type: keyword + - name: dns_srv_port + type: integer + - name: dns_srv_priority + type: integer + - name: dns_srv_target + type: integer + - name: dns_srv_weight + type: integer + - name: dns_ttl + type: long + - name: dns_txt_data + type: keyword + - name: dot1q_customer_dei + type: boolean + - name: dot1q_customer_destination_mac_address + type: keyword + - name: dot1q_customer_priority + type: short + - name: dot1q_customer_source_mac_address + type: keyword + - name: dot1q_customer_vlan_id + type: integer + - name: dot1q_dei + type: boolean + - name: dot1q_priority + type: short + - name: dot1q_service_instance_id + type: long + - name: dot1q_service_instance_priority + type: short + - name: dot1q_service_instance_tag + type: short + - name: dot1q_vlan_id + type: integer + - name: dropped_layer2_octet_delta_count + type: long + - name: dropped_layer2_octet_total_count + type: long + - name: dropped_octet_delta_count + type: long + - name: dropped_octet_total_count + type: long + - name: dropped_packet_delta_count + type: long + - name: dropped_packet_total_count + type: long + - name: dst_traffic_index + type: long + - name: egress_broadcast_packet_total_count + type: long + - name: egress_interface + type: long + - name: egress_interface_type + type: long + - name: egress_physical_interface + type: long + - name: egress_unicast_packet_total_count + type: long + - name: egress_vrfid + type: long + - name: encrypted_technology + type: keyword + - name: engine_id + type: short + - name: engine_type + type: short + - name: ethernet_header_length + type: short + - name: ethernet_payload_length + type: integer + - name: ethernet_total_length + type: integer + - name: ethernet_type + type: integer + - name: expired_fragment_count + type: long + - name: export_interface + type: long + - name: export_protocol_version + type: short + - name: export_sctp_stream_id + type: integer + - name: export_transport_protocol + type: short + - name: exported_flow_record_total_count + type: long + - name: exported_message_total_count + type: long + - name: exported_octet_total_count + type: long + - name: exporter_certificate + type: short + - name: exporter_ipv4_address + type: ip + - name: exporter_ipv6_address + type: ip + - name: exporter_transport_port + type: integer + - name: exporting_process_id + type: long + - name: external_address_realm + type: short + - name: firewall_event + type: short + - name: first_eight_non_empty_packet_directions + type: short + - name: first_non_empty_packet_size + type: integer + - name: first_packet_banner + type: keyword + - name: flags_and_sampler_id + type: long + - name: flow_active_timeout + type: integer + - name: flow_attributes + type: integer + - name: flow_direction + type: short + - name: flow_duration_microseconds + type: long + - name: flow_duration_milliseconds + type: long + - name: flow_end_delta_microseconds + type: long + - name: flow_end_microseconds + type: date + - name: flow_end_milliseconds + type: date + - name: flow_end_nanoseconds + type: date + - name: flow_end_reason + type: short + - name: flow_end_seconds + type: date + - name: flow_end_sys_up_time + type: long + - name: flow_id + type: long + - name: flow_idle_timeout + type: integer + - name: flow_key_indicator + type: long + - name: flow_label_ipv6 + type: long + - name: flow_sampling_time_interval + type: long + - name: flow_sampling_time_spacing + type: long + - name: flow_selected_flow_delta_count + type: long + - name: flow_selected_octet_delta_count + type: long + - name: flow_selected_packet_delta_count + type: long + - name: flow_selector_algorithm + type: integer + - name: flow_start_delta_microseconds + type: long + - name: flow_start_microseconds + type: date + - name: flow_start_milliseconds + type: date + - name: flow_start_nanoseconds + type: date + - name: flow_start_seconds + type: date + - name: flow_start_sys_up_time + type: long + - name: flow_table_flush_event_count + type: long + - name: flow_table_peak_count + type: long + - name: forwarding_status + type: short + - name: fragment_flags + type: short + - name: fragment_identification + type: long + - name: fragment_offset + type: integer + - name: fw_blackout_secs + type: long + - name: fw_configured_value + type: long + - name: fw_cts_src_sgt + type: long + - name: fw_event_level + type: long + - name: fw_event_level_id + type: long + - name: fw_ext_event + type: integer + - name: fw_ext_event_alt + type: long + - name: fw_ext_event_desc + type: keyword + - name: fw_half_open_count + type: long + - name: fw_half_open_high + type: long + - name: fw_half_open_rate + type: long + - name: fw_max_sessions + type: long + - name: fw_rule + type: keyword + - name: fw_summary_pkt_count + type: long + - name: fw_zone_pair_id + type: long + - name: fw_zone_pair_name + type: long + - name: global_address_mapping_high_threshold + type: long + - name: gre_key + type: long + - name: hash_digest_output + type: boolean + - name: hash_flow_domain + type: integer + - name: hash_initialiser_value + type: long + - name: hash_ip_payload_offset + type: long + - name: hash_ip_payload_size + type: long + - name: hash_output_range_max + type: long + - name: hash_output_range_min + type: long + - name: hash_selected_range_max + type: long + - name: hash_selected_range_min + type: long + - name: http_content_type + type: keyword + - name: http_message_version + type: keyword + - name: http_reason_phrase + type: keyword + - name: http_request_host + type: keyword + - name: http_request_method + type: keyword + - name: http_request_target + type: keyword + - name: http_status_code + type: integer + - name: http_user_agent + type: keyword + - name: icmp_code_ipv4 + type: short + - name: icmp_code_ipv6 + type: short + - name: icmp_type_code_ipv4 + type: integer + - name: icmp_type_code_ipv6 + type: integer + - name: icmp_type_ipv4 + type: short + - name: icmp_type_ipv6 + type: short + - name: igmp_type + type: short + - name: ignored_data_record_total_count + type: long + - name: ignored_layer2_frame_total_count + type: long + - name: ignored_layer2_octet_total_count + type: long + - name: ignored_octet_total_count + type: long + - name: ignored_packet_total_count + type: long + - name: information_element_data_type + type: short + - name: information_element_description + type: keyword + - name: information_element_id + type: integer + - name: information_element_index + type: integer + - name: information_element_name + type: keyword + - name: information_element_range_begin + type: long + - name: information_element_range_end + type: long + - name: information_element_semantics + type: short + - name: information_element_units + type: integer + - name: ingress_broadcast_packet_total_count + type: long + - name: ingress_interface + type: long + - name: ingress_interface_type + type: long + - name: ingress_multicast_packet_total_count + type: long + - name: ingress_physical_interface + type: long + - name: ingress_unicast_packet_total_count + type: long + - name: ingress_vrfid + type: long + - name: initial_tcp_flags + type: short + - name: initiator_octets + type: long + - name: initiator_packets + type: long + - name: interface_description + type: keyword + - name: interface_name + type: keyword + - name: intermediate_process_id + type: long + - name: internal_address_realm + type: short + - name: ip_class_of_service + type: short + - name: ip_diff_serv_code_point + type: short + - name: ip_header_length + type: short + - name: ip_header_packet_section + type: short + - name: ip_next_hop_ipv4_address + type: ip + - name: ip_next_hop_ipv6_address + type: ip + - name: ip_payload_length + type: long + - name: ip_payload_packet_section + type: short + - name: ip_precedence + type: short + - name: ip_sec_spi + type: long + - name: ip_total_length + type: long + - name: ip_ttl + type: short + - name: ip_version + type: short + - name: ipv4_ihl + type: short + - name: ipv4_options + type: long + - name: ipv4_router_sc + type: ip + - name: ipv6_extension_headers + type: long + - name: is_multicast + type: short + - name: ixia_browser_id + type: short + - name: ixia_browser_name + type: keyword + - name: ixia_device_id + type: short + - name: ixia_device_name + type: keyword + - name: ixia_dns_answer + type: keyword + - name: ixia_dns_classes + type: keyword + - name: ixia_dns_query + type: keyword + - name: ixia_dns_record_txt + type: keyword + - name: ixia_dst_as_name + type: keyword + - name: ixia_dst_city_name + type: keyword + - name: ixia_dst_country_code + type: keyword + - name: ixia_dst_country_name + type: keyword + - name: ixia_dst_latitude + type: float + - name: ixia_dst_longitude + type: float + - name: ixia_dst_region_code + type: keyword + - name: ixia_dst_region_node + type: keyword + - name: ixia_encrypt_cipher + type: keyword + - name: ixia_encrypt_key_length + type: integer + - name: ixia_encrypt_type + type: keyword + - name: ixia_http_host_name + type: keyword + - name: ixia_http_uri + type: keyword + - name: ixia_http_user_agent + type: keyword + - name: ixia_imsi_subscriber + type: keyword + - name: ixia_l7_app_id + type: long + - name: ixia_l7_app_name + type: keyword + - name: ixia_latency + type: long + - name: ixia_rev_octet_delta_count + type: long + - name: ixia_rev_packet_delta_count + type: long + - name: ixia_src_as_name + type: keyword + - name: ixia_src_city_name + type: keyword + - name: ixia_src_country_code + type: keyword + - name: ixia_src_country_name + type: keyword + - name: ixia_src_latitude + type: float + - name: ixia_src_longitude + type: float + - name: ixia_src_region_code + type: keyword + - name: ixia_src_region_name + type: keyword + - name: ixia_threat_ipv4 + type: ip + - name: ixia_threat_ipv6 + type: ip + - name: ixia_threat_type + type: keyword + - name: large_packet_count + type: long + - name: layer2_frame_delta_count + type: long + - name: layer2_frame_total_count + type: long + - name: layer2_octet_delta_count + type: long + - name: layer2_octet_delta_sum_of_squares + type: long + - name: layer2_octet_total_count + type: long + - name: layer2_octet_total_sum_of_squares + type: long + - name: layer2_segment_id + type: long + - name: layer2packet_section_data + type: short + - name: layer2packet_section_offset + type: integer + - name: layer2packet_section_size + type: integer + - name: line_card_id + type: long + - name: log_op + type: short + - name: lower_ci_limit + type: double + - name: mark + type: long + - name: max_bib_entries + type: long + - name: max_entries_per_user + type: long + - name: max_export_seconds + type: date + - name: max_flow_end_microseconds + type: date + - name: max_flow_end_milliseconds + type: date + - name: max_flow_end_nanoseconds + type: date + - name: max_flow_end_seconds + type: date + - name: max_fragments_pending_reassembly + type: long + - name: max_packet_size + type: integer + - name: max_session_entries + type: long + - name: max_subscribers + type: long + - name: maximum_ip_total_length + type: long + - name: maximum_layer2_total_length + type: long + - name: maximum_ttl + type: short + - name: mean_flow_rate + type: long + - name: mean_packet_rate + type: long + - name: message_md5_checksum + type: short + - name: message_scope + type: short + - name: metering_process_id + type: long + - name: metro_evc_id + type: keyword + - name: metro_evc_type + type: short + - name: mib_capture_time_semantics + type: short + - name: mib_context_engine_id + type: short + - name: mib_context_name + type: keyword + - name: mib_index_indicator + type: long + - name: mib_module_name + type: keyword + - name: mib_object_description + type: keyword + - name: mib_object_identifier + type: short + - name: mib_object_name + type: keyword + - name: mib_object_syntax + type: keyword + - name: mib_object_value_bits + type: short + - name: mib_object_value_counter + type: long + - name: mib_object_value_gauge + type: long + - name: mib_object_value_integer + type: integer + - name: mib_object_value_ip_address + type: ip + - name: mib_object_value_octet_string + type: short + - name: mib_object_value_oid + type: short + - name: mib_object_value_time_ticks + type: long + - name: mib_object_value_unsigned + type: long + - name: mib_sub_identifier + type: long + - name: min_export_seconds + type: date + - name: min_flow_start_microseconds + type: date + - name: min_flow_start_milliseconds + type: date + - name: min_flow_start_nanoseconds + type: date + - name: min_flow_start_seconds + type: date + - name: minimum_ip_total_length + type: long + - name: minimum_layer2_total_length + type: long + - name: minimum_ttl + type: short + - name: mobile_imsi + type: keyword + - name: mobile_msisdn + type: keyword + - name: monitoring_interval_end_milli_seconds + type: date + - name: monitoring_interval_start_milli_seconds + type: date + - name: mpls_label_stack_depth + type: long + - name: mpls_label_stack_length + type: long + - name: mpls_label_stack_section + type: short + - name: mpls_label_stack_section10 + type: short + - name: mpls_label_stack_section2 + type: short + - name: mpls_label_stack_section3 + type: short + - name: mpls_label_stack_section4 + type: short + - name: mpls_label_stack_section5 + type: short + - name: mpls_label_stack_section6 + type: short + - name: mpls_label_stack_section7 + type: short + - name: mpls_label_stack_section8 + type: short + - name: mpls_label_stack_section9 + type: short + - name: mpls_payload_length + type: long + - name: mpls_payload_packet_section + type: short + - name: mpls_top_label_exp + type: short + - name: mpls_top_label_ipv4_address + type: ip + - name: mpls_top_label_ipv6_address + type: ip + - name: mpls_top_label_prefix_length + type: short + - name: mpls_top_label_stack_section + type: short + - name: mpls_top_label_ttl + type: short + - name: mpls_top_label_type + type: short + - name: mpls_vpn_route_distinguisher + type: short + - name: mptcp_address_id + type: short + - name: mptcp_flags + type: short + - name: mptcp_initial_data_sequence_number + type: long + - name: mptcp_maximum_segment_size + type: integer + - name: mptcp_receiver_token + type: long + - name: multicast_replication_factor + type: long + - name: nat_event + type: short + - name: nat_inside_svcid + type: integer + - name: nat_instance_id + type: long + - name: nat_originating_address_realm + type: short + - name: nat_outside_svcid + type: integer + - name: nat_pool_id + type: long + - name: nat_pool_name + type: keyword + - name: nat_quota_exceeded_event + type: long + - name: nat_sub_string + type: keyword + - name: nat_threshold_event + type: long + - name: nat_type + type: short + - name: netscale_ica_client_version + type: keyword + - name: netscaler_aaa_username + type: keyword + - name: netscaler_app_name + type: keyword + - name: netscaler_app_name_app_id + type: long + - name: netscaler_app_name_incarnation_number + type: long + - name: netscaler_app_template_name + type: keyword + - name: netscaler_app_unit_name_app_id + type: long + - name: netscaler_application_startup_duration + type: long + - name: netscaler_application_startup_time + type: long + - name: netscaler_cache_redir_client_connection_core_id + type: long + - name: netscaler_cache_redir_client_connection_transaction_id + type: long + - name: netscaler_client_rtt + type: long + - name: netscaler_connection_chain_hop_count + type: long + - name: netscaler_connection_chain_id + type: short + - name: netscaler_connection_id + type: long + - name: netscaler_current_license_consumed + type: long + - name: netscaler_db_clt_host_name + type: keyword + - name: netscaler_db_database_name + type: keyword + - name: netscaler_db_login_flags + type: long + - name: netscaler_db_protocol_name + type: short + - name: netscaler_db_req_string + type: keyword + - name: netscaler_db_req_type + type: short + - name: netscaler_db_resp_length + type: long + - name: netscaler_db_resp_status + type: long + - name: netscaler_db_resp_status_string + type: keyword + - name: netscaler_db_user_name + type: keyword + - name: netscaler_flow_flags + type: long + - name: netscaler_http_client_interaction_end_time + type: keyword + - name: netscaler_http_client_interaction_start_time + type: keyword + - name: netscaler_http_client_render_end_time + type: keyword + - name: netscaler_http_client_render_start_time + type: keyword + - name: netscaler_http_content_type + type: keyword + - name: netscaler_http_domain_name + type: keyword + - name: netscaler_http_req_authorization + type: keyword + - name: netscaler_http_req_cookie + type: keyword + - name: netscaler_http_req_forw_fb + type: long + - name: netscaler_http_req_forw_lb + type: long + - name: netscaler_http_req_host + type: keyword + - name: netscaler_http_req_method + type: keyword + - name: netscaler_http_req_rcv_fb + type: long + - name: netscaler_http_req_rcv_lb + type: long + - name: netscaler_http_req_referer + type: keyword + - name: netscaler_http_req_url + type: keyword + - name: netscaler_http_req_user_agent + type: keyword + - name: netscaler_http_req_via + type: keyword + - name: netscaler_http_req_xforwarded_for + type: keyword + - name: netscaler_http_res_forw_fb + type: long + - name: netscaler_http_res_forw_lb + type: long + - name: netscaler_http_res_location + type: keyword + - name: netscaler_http_res_rcv_fb + type: long + - name: netscaler_http_res_rcv_lb + type: long + - name: netscaler_http_res_set_cookie + type: keyword + - name: netscaler_http_res_set_cookie2 + type: keyword + - name: netscaler_http_rsp_len + type: long + - name: netscaler_http_rsp_status + type: integer + - name: netscaler_ica_app_module_path + type: keyword + - name: netscaler_ica_app_process_id + type: long + - name: netscaler_ica_application_name + type: keyword + - name: netscaler_ica_application_termination_time + type: long + - name: netscaler_ica_application_termination_type + type: integer + - name: netscaler_ica_channel_id1 + type: long + - name: netscaler_ica_channel_id1_bytes + type: long + - name: netscaler_ica_channel_id2 + type: long + - name: netscaler_ica_channel_id2_bytes + type: long + - name: netscaler_ica_channel_id3 + type: long + - name: netscaler_ica_channel_id3_bytes + type: long + - name: netscaler_ica_channel_id4 + type: long + - name: netscaler_ica_channel_id4_bytes + type: long + - name: netscaler_ica_channel_id5 + type: long + - name: netscaler_ica_channel_id5_bytes + type: long + - name: netscaler_ica_client_host_name + type: keyword + - name: netscaler_ica_client_ip + type: ip + - name: netscaler_ica_client_launcher + type: integer + - name: netscaler_ica_client_side_rto_count + type: integer + - name: netscaler_ica_client_side_window_size + type: integer + - name: netscaler_ica_client_type + type: integer + - name: netscaler_ica_clientside_delay + type: long + - name: netscaler_ica_clientside_jitter + type: long + - name: netscaler_ica_clientside_packets_retransmit + type: integer + - name: netscaler_ica_clientside_rtt + type: long + - name: netscaler_ica_clientside_rx_bytes + type: long + - name: netscaler_ica_clientside_srtt + type: long + - name: netscaler_ica_clientside_tx_bytes + type: long + - name: netscaler_ica_connection_priority + type: integer + - name: netscaler_ica_device_serial_no + type: long + - name: netscaler_ica_domain_name + type: keyword + - name: netscaler_ica_flags + type: long + - name: netscaler_ica_host_delay + type: long + - name: netscaler_ica_l7_client_latency + type: long + - name: netscaler_ica_l7_server_latency + type: long + - name: netscaler_ica_launch_mechanism + type: integer + - name: netscaler_ica_network_update_end_time + type: long + - name: netscaler_ica_network_update_start_time + type: long + - name: netscaler_ica_rtt + type: long + - name: netscaler_ica_server_name + type: keyword + - name: netscaler_ica_server_side_rto_count + type: integer + - name: netscaler_ica_server_side_window_size + type: integer + - name: netscaler_ica_serverside_delay + type: long + - name: netscaler_ica_serverside_jitter + type: long + - name: netscaler_ica_serverside_packets_retransmit + type: integer + - name: netscaler_ica_serverside_rtt + type: long + - name: netscaler_ica_serverside_srtt + type: long + - name: netscaler_ica_session_end_time + type: long + - name: netscaler_ica_session_guid + type: short + - name: netscaler_ica_session_reconnects + type: short + - name: netscaler_ica_session_setup_time + type: long + - name: netscaler_ica_session_update_begin_sec + type: long + - name: netscaler_ica_session_update_end_sec + type: long + - name: netscaler_ica_username + type: keyword + - name: netscaler_license_type + type: short + - name: netscaler_main_page_core_id + type: long + - name: netscaler_main_page_id + type: long + - name: netscaler_max_license_count + type: long + - name: netscaler_msi_client_cookie + type: short + - name: netscaler_round_trip_time + type: long + - name: netscaler_server_ttfb + type: long + - name: netscaler_server_ttlb + type: long + - name: netscaler_syslog_message + type: keyword + - name: netscaler_syslog_priority + type: short + - name: netscaler_syslog_timestamp + type: long + - name: netscaler_transaction_id + type: long + - name: netscaler_unknown270 + type: long + - name: netscaler_unknown271 + type: long + - name: netscaler_unknown272 + type: long + - name: netscaler_unknown273 + type: long + - name: netscaler_unknown274 + type: long + - name: netscaler_unknown275 + type: long + - name: netscaler_unknown276 + type: long + - name: netscaler_unknown277 + type: long + - name: netscaler_unknown278 + type: long + - name: netscaler_unknown279 + type: long + - name: netscaler_unknown280 + type: long + - name: netscaler_unknown281 + type: long + - name: netscaler_unknown282 + type: long + - name: netscaler_unknown283 + type: long + - name: netscaler_unknown284 + type: long + - name: netscaler_unknown285 + type: long + - name: netscaler_unknown286 + type: long + - name: netscaler_unknown287 + type: long + - name: netscaler_unknown288 + type: long + - name: netscaler_unknown289 + type: long + - name: netscaler_unknown290 + type: long + - name: netscaler_unknown291 + type: long + - name: netscaler_unknown292 + type: long + - name: netscaler_unknown293 + type: long + - name: netscaler_unknown294 + type: long + - name: netscaler_unknown295 + type: long + - name: netscaler_unknown296 + type: long + - name: netscaler_unknown297 + type: long + - name: netscaler_unknown298 + type: long + - name: netscaler_unknown299 + type: long + - name: netscaler_unknown300 + type: long + - name: netscaler_unknown301 + type: long + - name: netscaler_unknown302 + type: long + - name: netscaler_unknown303 + type: long + - name: netscaler_unknown304 + type: long + - name: netscaler_unknown305 + type: long + - name: netscaler_unknown306 + type: long + - name: netscaler_unknown307 + type: long + - name: netscaler_unknown308 + type: long + - name: netscaler_unknown309 + type: long + - name: netscaler_unknown310 + type: long + - name: netscaler_unknown311 + type: long + - name: netscaler_unknown312 + type: long + - name: netscaler_unknown313 + type: long + - name: netscaler_unknown314 + type: long + - name: netscaler_unknown315 + type: long + - name: netscaler_unknown316 + type: keyword + - name: netscaler_unknown317 + type: long + - name: netscaler_unknown318 + type: long + - name: netscaler_unknown319 + type: keyword + - name: netscaler_unknown320 + type: integer + - name: netscaler_unknown321 + type: long + - name: netscaler_unknown322 + type: long + - name: netscaler_unknown323 + type: integer + - name: netscaler_unknown324 + type: integer + - name: netscaler_unknown325 + type: integer + - name: netscaler_unknown326 + type: integer + - name: netscaler_unknown327 + type: long + - name: netscaler_unknown328 + type: integer + - name: netscaler_unknown329 + type: integer + - name: netscaler_unknown330 + type: integer + - name: netscaler_unknown331 + type: integer + - name: netscaler_unknown332 + type: long + - name: netscaler_unknown333 + type: keyword + - name: netscaler_unknown334 + type: keyword + - name: netscaler_unknown335 + type: long + - name: netscaler_unknown336 + type: long + - name: netscaler_unknown337 + type: long + - name: netscaler_unknown338 + type: long + - name: netscaler_unknown339 + type: long + - name: netscaler_unknown340 + type: long + - name: netscaler_unknown341 + type: long + - name: netscaler_unknown342 + type: long + - name: netscaler_unknown343 + type: long + - name: netscaler_unknown344 + type: long + - name: netscaler_unknown345 + type: long + - name: netscaler_unknown346 + type: long + - name: netscaler_unknown347 + type: long + - name: netscaler_unknown348 + type: integer + - name: netscaler_unknown349 + type: keyword + - name: netscaler_unknown350 + type: keyword + - name: netscaler_unknown351 + type: keyword + - name: netscaler_unknown352 + type: integer + - name: netscaler_unknown353 + type: long + - name: netscaler_unknown354 + type: long + - name: netscaler_unknown355 + type: long + - name: netscaler_unknown356 + type: long + - name: netscaler_unknown357 + type: long + - name: netscaler_unknown363 + type: short + - name: netscaler_unknown383 + type: short + - name: netscaler_unknown391 + type: long + - name: netscaler_unknown398 + type: long + - name: netscaler_unknown404 + type: long + - name: netscaler_unknown405 + type: long + - name: netscaler_unknown427 + type: long + - name: netscaler_unknown429 + type: short + - name: netscaler_unknown432 + type: short + - name: netscaler_unknown433 + type: short + - name: netscaler_unknown453 + type: long + - name: netscaler_unknown465 + type: long + - name: new_connection_delta_count + type: long + - name: next_header_ipv6 + type: short + - name: non_empty_packet_count + type: long + - name: not_sent_flow_total_count + type: long + - name: not_sent_layer2_octet_total_count + type: long + - name: not_sent_octet_total_count + type: long + - name: not_sent_packet_total_count + type: long + - name: observation_domain_id + type: long + - name: observation_domain_name + type: keyword + - name: observation_point_id + type: long + - name: observation_point_type + type: short + - name: observation_time_microseconds + type: date + - name: observation_time_milliseconds + type: date + - name: observation_time_nanoseconds + type: date + - name: observation_time_seconds + type: date + - name: observed_flow_total_count + type: long + - name: octet_delta_count + type: long + - name: octet_delta_sum_of_squares + type: long + - name: octet_total_count + type: long + - name: octet_total_sum_of_squares + type: long + - name: opaque_octets + type: short + - name: original_exporter_ipv4_address + type: ip + - name: original_exporter_ipv6_address + type: ip + - name: original_flows_completed + type: long + - name: original_flows_initiated + type: long + - name: original_flows_present + type: long + - name: original_observation_domain_id + type: long + - name: os_finger_print + type: keyword + - name: os_name + type: keyword + - name: os_version + type: keyword + - name: p2p_technology + type: keyword + - name: packet_delta_count + type: long + - name: packet_total_count + type: long + - name: padding_octets + type: short + - name: payload + type: keyword + - name: payload_entropy + type: short + - name: payload_length_ipv6 + type: integer + - name: policy_qos_classification_hierarchy + type: long + - name: policy_qos_queue_index + type: long + - name: policy_qos_queuedrops + type: long + - name: policy_qos_queueindex + type: long + - name: port_id + type: long + - name: port_range_end + type: integer + - name: port_range_num_ports + type: integer + - name: port_range_start + type: integer + - name: port_range_step_size + type: integer + - name: post_destination_mac_address + type: keyword + - name: post_dot1q_customer_vlan_id + type: integer + - name: post_dot1q_vlan_id + type: integer + - name: post_ip_class_of_service + type: short + - name: post_ip_diff_serv_code_point + type: short + - name: post_ip_precedence + type: short + - name: post_layer2_octet_delta_count + type: long + - name: post_layer2_octet_total_count + type: long + - name: post_mcast_layer2_octet_delta_count + type: long + - name: post_mcast_layer2_octet_total_count + type: long + - name: post_mcast_octet_delta_count + type: long + - name: post_mcast_octet_total_count + type: long + - name: post_mcast_packet_delta_count + type: long + - name: post_mcast_packet_total_count + type: long + - name: post_mpls_top_label_exp + type: short + - name: post_napt_destination_transport_port + type: integer + - name: post_napt_source_transport_port + type: integer + - name: post_nat_destination_ipv4_address + type: ip + - name: post_nat_destination_ipv6_address + type: ip + - name: post_nat_source_ipv4_address + type: ip + - name: post_nat_source_ipv6_address + type: ip + - name: post_octet_delta_count + type: long + - name: post_octet_total_count + type: long + - name: post_packet_delta_count + type: long + - name: post_packet_total_count + type: long + - name: post_source_mac_address + type: keyword + - name: post_vlan_id + type: integer + - name: private_enterprise_number + type: long + - name: procera_apn + type: keyword + - name: procera_base_service + type: keyword + - name: procera_content_categories + type: keyword + - name: procera_device_id + type: long + - name: procera_external_rtt + type: integer + - name: procera_flow_behavior + type: keyword + - name: procera_ggsn + type: keyword + - name: procera_http_content_type + type: keyword + - name: procera_http_file_length + type: long + - name: procera_http_language + type: keyword + - name: procera_http_location + type: keyword + - name: procera_http_referer + type: keyword + - name: procera_http_request_method + type: keyword + - name: procera_http_request_version + type: keyword + - name: procera_http_response_status + type: integer + - name: procera_http_url + type: keyword + - name: procera_http_user_agent + type: keyword + - name: procera_imsi + type: long + - name: procera_incoming_octets + type: long + - name: procera_incoming_packets + type: long + - name: procera_incoming_shaping_drops + type: long + - name: procera_incoming_shaping_latency + type: integer + - name: procera_internal_rtt + type: integer + - name: procera_local_ipv4_host + type: ip + - name: procera_local_ipv6_host + type: ip + - name: procera_msisdn + type: long + - name: procera_outgoing_octets + type: long + - name: procera_outgoing_packets + type: long + - name: procera_outgoing_shaping_drops + type: long + - name: procera_outgoing_shaping_latency + type: integer + - name: procera_property + type: keyword + - name: procera_qoe_incoming_external + type: float + - name: procera_qoe_incoming_internal + type: float + - name: procera_qoe_outgoing_external + type: float + - name: procera_qoe_outgoing_internal + type: float + - name: procera_rat + type: keyword + - name: procera_remote_ipv4_host + type: ip + - name: procera_remote_ipv6_host + type: ip + - name: procera_rnc + type: integer + - name: procera_server_hostname + type: keyword + - name: procera_service + type: keyword + - name: procera_sgsn + type: keyword + - name: procera_subscriber_identifier + type: keyword + - name: procera_template_name + type: keyword + - name: procera_user_location_information + type: keyword + - name: protocol_identifier + type: short + - name: pseudo_wire_control_word + type: long + - name: pseudo_wire_destination_ipv4_address + type: ip + - name: pseudo_wire_id + type: long + - name: pseudo_wire_type + type: integer + - name: reason + type: long + - name: reason_text + type: keyword + - name: relative_error + type: double + - name: responder_octets + type: long + - name: responder_packets + type: long + - name: reverse_absolute_error + type: double + - name: reverse_anonymization_flags + type: integer + - name: reverse_anonymization_technique + type: integer + - name: reverse_application_category_name + type: keyword + - name: reverse_application_description + type: keyword + - name: reverse_application_group_name + type: keyword + - name: reverse_application_id + type: keyword + - name: reverse_application_name + type: keyword + - name: reverse_application_sub_category_name + type: keyword + - name: reverse_average_interarrival_time + type: long + - name: reverse_bgp_destination_as_number + type: long + - name: reverse_bgp_next_adjacent_as_number + type: long + - name: reverse_bgp_next_hop_ipv4_address + type: ip + - name: reverse_bgp_next_hop_ipv6_address + type: ip + - name: reverse_bgp_prev_adjacent_as_number + type: long + - name: reverse_bgp_source_as_number + type: long + - name: reverse_bgp_validity_state + type: short + - name: reverse_class_id + type: short + - name: reverse_class_name + type: keyword + - name: reverse_classification_engine_id + type: short + - name: reverse_collection_time_milliseconds + type: long + - name: reverse_collector_certificate + type: keyword + - name: reverse_confidence_level + type: double + - name: reverse_connection_sum_duration_seconds + type: long + - name: reverse_connection_transaction_id + type: long + - name: reverse_data_byte_count + type: long + - name: reverse_data_link_frame_section + type: keyword + - name: reverse_data_link_frame_size + type: integer + - name: reverse_data_link_frame_type + type: integer + - name: reverse_data_records_reliability + type: short + - name: reverse_delta_flow_count + type: long + - name: reverse_destination_ipv4_address + type: ip + - name: reverse_destination_ipv4_prefix + type: ip + - name: reverse_destination_ipv4_prefix_length + type: short + - name: reverse_destination_ipv6_address + type: ip + - name: reverse_destination_ipv6_prefix + type: ip + - name: reverse_destination_ipv6_prefix_length + type: short + - name: reverse_destination_mac_address + type: keyword + - name: reverse_destination_transport_port + type: integer + - name: reverse_digest_hash_value + type: long + - name: reverse_distinct_count_of_destination_ip_address + type: long + - name: reverse_distinct_count_of_destination_ipv4_address + type: long + - name: reverse_distinct_count_of_destination_ipv6_address + type: long + - name: reverse_distinct_count_of_source_ip_address + type: long + - name: reverse_distinct_count_of_source_ipv4_address + type: long + - name: reverse_distinct_count_of_source_ipv6_address + type: long + - name: reverse_dot1q_customer_dei + type: short + - name: reverse_dot1q_customer_destination_mac_address + type: keyword + - name: reverse_dot1q_customer_priority + type: short + - name: reverse_dot1q_customer_source_mac_address + type: keyword + - name: reverse_dot1q_customer_vlan_id + type: integer + - name: reverse_dot1q_dei + type: short + - name: reverse_dot1q_priority + type: short + - name: reverse_dot1q_service_instance_id + type: long + - name: reverse_dot1q_service_instance_priority + type: short + - name: reverse_dot1q_service_instance_tag + type: keyword + - name: reverse_dot1q_vlan_id + type: integer + - name: reverse_dropped_layer2_octet_delta_count + type: long + - name: reverse_dropped_layer2_octet_total_count + type: long + - name: reverse_dropped_octet_delta_count + type: long + - name: reverse_dropped_octet_total_count + type: long + - name: reverse_dropped_packet_delta_count + type: long + - name: reverse_dropped_packet_total_count + type: long + - name: reverse_dst_traffic_index + type: long + - name: reverse_egress_broadcast_packet_total_count + type: long + - name: reverse_egress_interface + type: long + - name: reverse_egress_interface_type + type: long + - name: reverse_egress_physical_interface + type: long + - name: reverse_egress_unicast_packet_total_count + type: long + - name: reverse_egress_vrfid + type: long + - name: reverse_encrypted_technology + type: keyword + - name: reverse_engine_id + type: short + - name: reverse_engine_type + type: short + - name: reverse_ethernet_header_length + type: short + - name: reverse_ethernet_payload_length + type: integer + - name: reverse_ethernet_total_length + type: integer + - name: reverse_ethernet_type + type: integer + - name: reverse_export_sctp_stream_id + type: integer + - name: reverse_exporter_certificate + type: keyword + - name: reverse_exporting_process_id + type: long + - name: reverse_firewall_event + type: short + - name: reverse_first_non_empty_packet_size + type: integer + - name: reverse_first_packet_banner + type: keyword + - name: reverse_flags_and_sampler_id + type: long + - name: reverse_flow_active_timeout + type: integer + - name: reverse_flow_attributes + type: integer + - name: reverse_flow_delta_milliseconds + type: long + - name: reverse_flow_direction + type: short + - name: reverse_flow_duration_microseconds + type: long + - name: reverse_flow_duration_milliseconds + type: long + - name: reverse_flow_end_delta_microseconds + type: long + - name: reverse_flow_end_microseconds + type: long + - name: reverse_flow_end_milliseconds + type: long + - name: reverse_flow_end_nanoseconds + type: long + - name: reverse_flow_end_reason + type: short + - name: reverse_flow_end_seconds + type: long + - name: reverse_flow_end_sys_up_time + type: long + - name: reverse_flow_idle_timeout + type: integer + - name: reverse_flow_label_ipv6 + type: long + - name: reverse_flow_sampling_time_interval + type: long + - name: reverse_flow_sampling_time_spacing + type: long + - name: reverse_flow_selected_flow_delta_count + type: long + - name: reverse_flow_selected_octet_delta_count + type: long + - name: reverse_flow_selected_packet_delta_count + type: long + - name: reverse_flow_selector_algorithm + type: integer + - name: reverse_flow_start_delta_microseconds + type: long + - name: reverse_flow_start_microseconds + type: long + - name: reverse_flow_start_milliseconds + type: long + - name: reverse_flow_start_nanoseconds + type: long + - name: reverse_flow_start_seconds + type: long + - name: reverse_flow_start_sys_up_time + type: long + - name: reverse_forwarding_status + type: long + - name: reverse_fragment_flags + type: short + - name: reverse_fragment_identification + type: long + - name: reverse_fragment_offset + type: integer + - name: reverse_gre_key + type: long + - name: reverse_hash_digest_output + type: short + - name: reverse_hash_flow_domain + type: integer + - name: reverse_hash_initialiser_value + type: long + - name: reverse_hash_ip_payload_offset + type: long + - name: reverse_hash_ip_payload_size + type: long + - name: reverse_hash_output_range_max + type: long + - name: reverse_hash_output_range_min + type: long + - name: reverse_hash_selected_range_max + type: long + - name: reverse_hash_selected_range_min + type: long + - name: reverse_icmp_code_ipv4 + type: short + - name: reverse_icmp_code_ipv6 + type: short + - name: reverse_icmp_type_code_ipv4 + type: integer + - name: reverse_icmp_type_code_ipv6 + type: integer + - name: reverse_icmp_type_ipv4 + type: short + - name: reverse_icmp_type_ipv6 + type: short + - name: reverse_igmp_type + type: short + - name: reverse_ignored_data_record_total_count + type: long + - name: reverse_ignored_layer2_frame_total_count + type: long + - name: reverse_ignored_layer2_octet_total_count + type: long + - name: reverse_information_element_data_type + type: short + - name: reverse_information_element_description + type: keyword + - name: reverse_information_element_id + type: integer + - name: reverse_information_element_index + type: integer + - name: reverse_information_element_name + type: keyword + - name: reverse_information_element_range_begin + type: long + - name: reverse_information_element_range_end + type: long + - name: reverse_information_element_semantics + type: short + - name: reverse_information_element_units + type: integer + - name: reverse_ingress_broadcast_packet_total_count + type: long + - name: reverse_ingress_interface + type: long + - name: reverse_ingress_interface_type + type: long + - name: reverse_ingress_multicast_packet_total_count + type: long + - name: reverse_ingress_physical_interface + type: long + - name: reverse_ingress_unicast_packet_total_count + type: long + - name: reverse_ingress_vrfid + type: long + - name: reverse_initial_tcp_flags + type: short + - name: reverse_initiator_octets + type: long + - name: reverse_initiator_packets + type: long + - name: reverse_interface_description + type: keyword + - name: reverse_interface_name + type: keyword + - name: reverse_intermediate_process_id + type: long + - name: reverse_ip_class_of_service + type: short + - name: reverse_ip_diff_serv_code_point + type: short + - name: reverse_ip_header_length + type: short + - name: reverse_ip_header_packet_section + type: keyword + - name: reverse_ip_next_hop_ipv4_address + type: ip + - name: reverse_ip_next_hop_ipv6_address + type: ip + - name: reverse_ip_payload_length + type: long + - name: reverse_ip_payload_packet_section + type: keyword + - name: reverse_ip_precedence + type: short + - name: reverse_ip_sec_spi + type: long + - name: reverse_ip_total_length + type: long + - name: reverse_ip_ttl + type: short + - name: reverse_ip_version + type: short + - name: reverse_ipv4_ihl + type: short + - name: reverse_ipv4_options + type: long + - name: reverse_ipv4_router_sc + type: ip + - name: reverse_ipv6_extension_headers + type: long + - name: reverse_is_multicast + type: short + - name: reverse_large_packet_count + type: long + - name: reverse_layer2_frame_delta_count + type: long + - name: reverse_layer2_frame_total_count + type: long + - name: reverse_layer2_octet_delta_count + type: long + - name: reverse_layer2_octet_delta_sum_of_squares + type: long + - name: reverse_layer2_octet_total_count + type: long + - name: reverse_layer2_octet_total_sum_of_squares + type: long + - name: reverse_layer2_segment_id + type: long + - name: reverse_layer2packet_section_data + type: keyword + - name: reverse_layer2packet_section_offset + type: integer + - name: reverse_layer2packet_section_size + type: integer + - name: reverse_line_card_id + type: long + - name: reverse_lower_ci_limit + type: double + - name: reverse_max_export_seconds + type: long + - name: reverse_max_flow_end_microseconds + type: long + - name: reverse_max_flow_end_milliseconds + type: long + - name: reverse_max_flow_end_nanoseconds + type: long + - name: reverse_max_flow_end_seconds + type: long + - name: reverse_max_packet_size + type: integer + - name: reverse_maximum_ip_total_length + type: long + - name: reverse_maximum_layer2_total_length + type: long + - name: reverse_maximum_ttl + type: short + - name: reverse_message_md5_checksum + type: keyword + - name: reverse_message_scope + type: short + - name: reverse_metering_process_id + type: long + - name: reverse_metro_evc_id + type: keyword + - name: reverse_metro_evc_type + type: short + - name: reverse_min_export_seconds + type: long + - name: reverse_min_flow_start_microseconds + type: long + - name: reverse_min_flow_start_milliseconds + type: long + - name: reverse_min_flow_start_nanoseconds + type: long + - name: reverse_min_flow_start_seconds + type: long + - name: reverse_minimum_ip_total_length + type: long + - name: reverse_minimum_layer2_total_length + type: long + - name: reverse_minimum_ttl + type: short + - name: reverse_monitoring_interval_end_milli_seconds + type: long + - name: reverse_monitoring_interval_start_milli_seconds + type: long + - name: reverse_mpls_label_stack_depth + type: long + - name: reverse_mpls_label_stack_length + type: long + - name: reverse_mpls_label_stack_section + type: keyword + - name: reverse_mpls_label_stack_section10 + type: keyword + - name: reverse_mpls_label_stack_section2 + type: keyword + - name: reverse_mpls_label_stack_section3 + type: keyword + - name: reverse_mpls_label_stack_section4 + type: keyword + - name: reverse_mpls_label_stack_section5 + type: keyword + - name: reverse_mpls_label_stack_section6 + type: keyword + - name: reverse_mpls_label_stack_section7 + type: keyword + - name: reverse_mpls_label_stack_section8 + type: keyword + - name: reverse_mpls_label_stack_section9 + type: keyword + - name: reverse_mpls_payload_length + type: long + - name: reverse_mpls_payload_packet_section + type: keyword + - name: reverse_mpls_top_label_exp + type: short + - name: reverse_mpls_top_label_ipv4_address + type: ip + - name: reverse_mpls_top_label_ipv6_address + type: ip + - name: reverse_mpls_top_label_prefix_length + type: short + - name: reverse_mpls_top_label_stack_section + type: keyword + - name: reverse_mpls_top_label_ttl + type: short + - name: reverse_mpls_top_label_type + type: short + - name: reverse_mpls_vpn_route_distinguisher + type: keyword + - name: reverse_multicast_replication_factor + type: long + - name: reverse_nat_event + type: short + - name: reverse_nat_originating_address_realm + type: short + - name: reverse_nat_pool_id + type: long + - name: reverse_nat_pool_name + type: keyword + - name: reverse_nat_type + type: short + - name: reverse_new_connection_delta_count + type: long + - name: reverse_next_header_ipv6 + type: short + - name: reverse_non_empty_packet_count + type: long + - name: reverse_not_sent_layer2_octet_total_count + type: long + - name: reverse_observation_domain_name + type: keyword + - name: reverse_observation_point_id + type: long + - name: reverse_observation_point_type + type: short + - name: reverse_observation_time_microseconds + type: long + - name: reverse_observation_time_milliseconds + type: long + - name: reverse_observation_time_nanoseconds + type: long + - name: reverse_observation_time_seconds + type: long + - name: reverse_octet_delta_count + type: long + - name: reverse_octet_delta_sum_of_squares + type: long + - name: reverse_octet_total_count + type: long + - name: reverse_octet_total_sum_of_squares + type: long + - name: reverse_opaque_octets + type: keyword + - name: reverse_original_exporter_ipv4_address + type: ip + - name: reverse_original_exporter_ipv6_address + type: ip + - name: reverse_original_flows_completed + type: long + - name: reverse_original_flows_initiated + type: long + - name: reverse_original_flows_present + type: long + - name: reverse_original_observation_domain_id + type: long + - name: reverse_os_finger_print + type: keyword + - name: reverse_os_name + type: keyword + - name: reverse_os_version + type: keyword + - name: reverse_p2p_technology + type: keyword + - name: reverse_packet_delta_count + type: long + - name: reverse_packet_total_count + type: long + - name: reverse_payload + type: keyword + - name: reverse_payload_entropy + type: short + - name: reverse_payload_length_ipv6 + type: integer + - name: reverse_port_id + type: long + - name: reverse_port_range_end + type: integer + - name: reverse_port_range_num_ports + type: integer + - name: reverse_port_range_start + type: integer + - name: reverse_port_range_step_size + type: integer + - name: reverse_post_destination_mac_address + type: keyword + - name: reverse_post_dot1q_customer_vlan_id + type: integer + - name: reverse_post_dot1q_vlan_id + type: integer + - name: reverse_post_ip_class_of_service + type: short + - name: reverse_post_ip_diff_serv_code_point + type: short + - name: reverse_post_ip_precedence + type: short + - name: reverse_post_layer2_octet_delta_count + type: long + - name: reverse_post_layer2_octet_total_count + type: long + - name: reverse_post_mcast_layer2_octet_delta_count + type: long + - name: reverse_post_mcast_layer2_octet_total_count + type: long + - name: reverse_post_mcast_octet_delta_count + type: long + - name: reverse_post_mcast_octet_total_count + type: long + - name: reverse_post_mcast_packet_delta_count + type: long + - name: reverse_post_mcast_packet_total_count + type: long + - name: reverse_post_mpls_top_label_exp + type: short + - name: reverse_post_napt_destination_transport_port + type: integer + - name: reverse_post_napt_source_transport_port + type: integer + - name: reverse_post_nat_destination_ipv4_address + type: ip + - name: reverse_post_nat_destination_ipv6_address + type: ip + - name: reverse_post_nat_source_ipv4_address + type: ip + - name: reverse_post_nat_source_ipv6_address + type: ip + - name: reverse_post_octet_delta_count + type: long + - name: reverse_post_octet_total_count + type: long + - name: reverse_post_packet_delta_count + type: long + - name: reverse_post_packet_total_count + type: long + - name: reverse_post_source_mac_address + type: keyword + - name: reverse_post_vlan_id + type: integer + - name: reverse_private_enterprise_number + type: long + - name: reverse_protocol_identifier + type: short + - name: reverse_pseudo_wire_control_word + type: long + - name: reverse_pseudo_wire_destination_ipv4_address + type: ip + - name: reverse_pseudo_wire_id + type: long + - name: reverse_pseudo_wire_type + type: integer + - name: reverse_relative_error + type: double + - name: reverse_responder_octets + type: long + - name: reverse_responder_packets + type: long + - name: reverse_rfc3550_jitter_microseconds + type: long + - name: reverse_rfc3550_jitter_milliseconds + type: long + - name: reverse_rfc3550_jitter_nanoseconds + type: long + - name: reverse_rtp_payload_type + type: short + - name: reverse_rtp_sequence_number + type: integer + - name: reverse_sampler_id + type: short + - name: reverse_sampler_mode + type: short + - name: reverse_sampler_name + type: keyword + - name: reverse_sampler_random_interval + type: long + - name: reverse_sampling_algorithm + type: short + - name: reverse_sampling_flow_interval + type: long + - name: reverse_sampling_flow_spacing + type: long + - name: reverse_sampling_interval + type: long + - name: reverse_sampling_packet_interval + type: long + - name: reverse_sampling_packet_space + type: long + - name: reverse_sampling_population + type: long + - name: reverse_sampling_probability + type: double + - name: reverse_sampling_size + type: long + - name: reverse_sampling_time_interval + type: long + - name: reverse_sampling_time_space + type: long + - name: reverse_second_packet_banner + type: keyword + - name: reverse_section_exported_octets + type: integer + - name: reverse_section_offset + type: integer + - name: reverse_selection_sequence_id + type: long + - name: reverse_selector_algorithm + type: integer + - name: reverse_selector_id + type: long + - name: reverse_selector_id_total_flows_observed + type: long + - name: reverse_selector_id_total_flows_selected + type: long + - name: reverse_selector_id_total_pkts_observed + type: long + - name: reverse_selector_id_total_pkts_selected + type: long + - name: reverse_selector_name + type: keyword + - name: reverse_session_scope + type: short + - name: reverse_small_packet_count + type: long + - name: reverse_source_ipv4_address + type: ip + - name: reverse_source_ipv4_prefix + type: ip + - name: reverse_source_ipv4_prefix_length + type: short + - name: reverse_source_ipv6_address + type: ip + - name: reverse_source_ipv6_prefix + type: ip + - name: reverse_source_ipv6_prefix_length + type: short + - name: reverse_source_mac_address + type: keyword + - name: reverse_source_transport_port + type: integer + - name: reverse_src_traffic_index + type: long + - name: reverse_sta_ipv4_address + type: ip + - name: reverse_sta_mac_address + type: keyword + - name: reverse_standard_deviation_interarrival_time + type: long + - name: reverse_standard_deviation_payload_length + type: integer + - name: reverse_system_init_time_milliseconds + type: long + - name: reverse_tcp_ack_total_count + type: long + - name: reverse_tcp_acknowledgement_number + type: long + - name: reverse_tcp_control_bits + type: integer + - name: reverse_tcp_destination_port + type: integer + - name: reverse_tcp_fin_total_count + type: long + - name: reverse_tcp_header_length + type: short + - name: reverse_tcp_options + type: long + - name: reverse_tcp_psh_total_count + type: long + - name: reverse_tcp_rst_total_count + type: long + - name: reverse_tcp_sequence_number + type: long + - name: reverse_tcp_source_port + type: integer + - name: reverse_tcp_syn_total_count + type: long + - name: reverse_tcp_urg_total_count + type: long + - name: reverse_tcp_urgent_pointer + type: integer + - name: reverse_tcp_window_scale + type: integer + - name: reverse_tcp_window_size + type: integer + - name: reverse_total_length_ipv4 + type: integer + - name: reverse_transport_octet_delta_count + type: long + - name: reverse_transport_packet_delta_count + type: long + - name: reverse_tunnel_technology + type: keyword + - name: reverse_udp_destination_port + type: integer + - name: reverse_udp_message_length + type: integer + - name: reverse_udp_source_port + type: integer + - name: reverse_union_tcp_flags + type: short + - name: reverse_upper_ci_limit + type: double + - name: reverse_user_name + type: keyword + - name: reverse_value_distribution_method + type: short + - name: reverse_virtual_station_interface_id + type: keyword + - name: reverse_virtual_station_interface_name + type: keyword + - name: reverse_virtual_station_name + type: keyword + - name: reverse_virtual_station_uuid + type: keyword + - name: reverse_vlan_id + type: integer + - name: reverse_vr_fname + type: keyword + - name: reverse_wlan_channel_id + type: short + - name: reverse_wlan_ssid + type: keyword + - name: reverse_wtp_mac_address + type: keyword + - name: rfc3550_jitter_microseconds + type: long + - name: rfc3550_jitter_milliseconds + type: long + - name: rfc3550_jitter_nanoseconds + type: long + - name: rtp_payload_type + type: short + - name: rtp_sequence_number + type: integer + - name: sampler_id + type: short + - name: sampler_mode + type: short + - name: sampler_name + type: keyword + - name: sampler_random_interval + type: long + - name: sampling_algorithm + type: short + - name: sampling_flow_interval + type: long + - name: sampling_flow_spacing + type: long + - name: sampling_interval + type: long + - name: sampling_packet_interval + type: long + - name: sampling_packet_space + type: long + - name: sampling_population + type: long + - name: sampling_probability + type: double + - name: sampling_size + type: long + - name: sampling_time_interval + type: long + - name: sampling_time_space + type: long + - name: second_packet_banner + type: keyword + - name: section_exported_octets + type: integer + - name: section_offset + type: integer + - name: selection_sequence_id + type: long + - name: selector_algorithm + type: integer + - name: selector_id + type: long + - name: selector_id_total_flows_observed + type: long + - name: selector_id_total_flows_selected + type: long + - name: selector_id_total_pkts_observed + type: long + - name: selector_id_total_pkts_selected + type: long + - name: selector_name + type: keyword + - name: service_name + type: keyword + - name: session_scope + type: short + - name: silk_app_label + type: integer + - name: small_packet_count + type: long + - name: source_ipv4_address + type: ip + - name: source_ipv4_prefix + type: ip + - name: source_ipv4_prefix_length + type: short + - name: source_ipv6_address + type: ip + - name: source_ipv6_prefix + type: ip + - name: source_ipv6_prefix_length + type: short + - name: source_mac_address + type: keyword + - name: source_transport_port + type: integer + - name: source_transport_ports_limit + type: integer + - name: src_traffic_index + type: long + - name: ssl_cert_serial_number + type: keyword + - name: ssl_cert_signature + type: keyword + - name: ssl_cert_validity_not_after + type: keyword + - name: ssl_cert_validity_not_before + type: keyword + - name: ssl_cert_version + type: short + - name: ssl_certificate_hash + type: keyword + - name: ssl_cipher + type: keyword + - name: ssl_client_version + type: short + - name: ssl_compression_method + type: short + - name: ssl_object_type + type: keyword + - name: ssl_object_value + type: keyword + - name: ssl_public_key_algorithm + type: keyword + - name: ssl_public_key_length + type: keyword + - name: ssl_server_cipher + type: long + - name: ssl_server_name + type: keyword + - name: sta_ipv4_address + type: ip + - name: sta_mac_address + type: keyword + - name: standard_deviation_interarrival_time + type: long + - name: standard_deviation_payload_length + type: short + - name: system_init_time_milliseconds + type: date + - name: tcp_ack_total_count + type: long + - name: tcp_acknowledgement_number + type: long + - name: tcp_control_bits + type: integer + - name: tcp_destination_port + type: integer + - name: tcp_fin_total_count + type: long + - name: tcp_header_length + type: short + - name: tcp_options + type: long + - name: tcp_psh_total_count + type: long + - name: tcp_rst_total_count + type: long + - name: tcp_sequence_number + type: long + - name: tcp_source_port + type: integer + - name: tcp_syn_total_count + type: long + - name: tcp_urg_total_count + type: long + - name: tcp_urgent_pointer + type: integer + - name: tcp_window_scale + type: integer + - name: tcp_window_size + type: integer + - name: template_id + type: integer + - name: tftp_filename + type: keyword + - name: tftp_mode + type: keyword + - name: timestamp + type: long + - name: timestamp_absolute_monitoring-interval + type: long + - name: total_length_ipv4 + type: integer + - name: traffic_type + type: short + - name: transport_octet_delta_count + type: long + - name: transport_packet_delta_count + type: long + - name: tunnel_technology + type: keyword + - name: udp_destination_port + type: integer + - name: udp_message_length + type: integer + - name: udp_source_port + type: integer + - name: union_tcp_flags + type: short + - name: upper_ci_limit + type: double + - name: user_name + type: keyword + - name: username + type: keyword + - name: value_distribution_method + type: short + - name: viptela_vpn_id + type: long + - name: virtual_station_interface_id + type: short + - name: virtual_station_interface_name + type: keyword + - name: virtual_station_name + type: keyword + - name: virtual_station_uuid + type: short + - name: vlan_id + type: integer + - name: vmware_egress_interface_attr + type: integer + - name: vmware_ingress_interface_attr + type: integer + - name: vmware_tenant_dest_ipv4 + type: ip + - name: vmware_tenant_dest_ipv6 + type: ip + - name: vmware_tenant_dest_port + type: integer + - name: vmware_tenant_protocol + type: short + - name: vmware_tenant_source_ipv4 + type: ip + - name: vmware_tenant_source_ipv6 + type: ip + - name: vmware_tenant_source_port + type: integer + - name: vmware_vxlan_export_role + type: short + - name: vpn_identifier + type: short + - name: vr_fname + type: keyword + - name: waasoptimization_segment + type: short + - name: wlan_channel_id + type: short + - name: wlan_ssid + type: keyword + - name: wtp_mac_address + type: keyword + - name: xlate_destination_address_ip_v4 + type: ip + - name: xlate_destination_port + type: integer + - name: xlate_source_address_ip_v4 + type: ip + - name: xlate_source_port + type: integer diff --git a/packages/endace/data_stream/log/manifest.yml b/packages/endace/data_stream/log/manifest.yml new file mode 100644 index 00000000000..5d7858a7536 --- /dev/null +++ b/packages/endace/data_stream/log/manifest.yml @@ -0,0 +1,95 @@ +title: NetFlow logs +type: logs +streams: + - input: netflow + template_path: netflow.yml.hbs + title: Collect NetFlow logs + enabled: false + description: Collect NetFlow logs using the netflow input + vars: + - name: host + type: text + title: UDP host to listen on + multi: false + required: true + show_user: true + default: localhost + - name: port + type: integer + title: UDP port to listen on + multi: false + required: true + show_user: true + default: 2055 + - name: expiration_timeout + type: text + title: Time duration before an idle session or unused template is expired. Valid time units are h, m, s. + multi: false + required: true + show_user: false + default: 30m + - name: internal_networks + type: text + title: Internal Networks + description: List of CIDR ranges describing the IP addresses that is considered internal. This is used in determining the values of `source.locality`, `destination.locality`, and `flow.locality`. The values can be either a CIDR value or one of the named ranges supported by the <> condition. The default value is `[private]` which classifies RFC 1918 (IPv4) and RFC 4193 (IPv6) addresses as internal. + multi: true + required: false + show_user: true + - name: queue_size + type: integer + title: Maximum number of packets that can be queued for processing + multi: false + required: true + show_user: false + default: 8192 + - name: read_buffer + type: text + title: Read Buffer Size + description: | + Sets the size of the OS read buffer on the UDP socket in the format KiB/MiB, an example would be: 10KiB. If it is not set, the existing operating system's default value is used. + required: false + show_user: false + - name: custom_definitions + type: text + title: Custom definitions + multi: true + required: false + show_user: false + default: "" + - name: detect_sequence_reset + type: bool + title: Whether to detect sequence reset + multi: false + required: true + show_user: false + default: true + - name: max_message_size + type: text + title: Maximum size of the message received over UDP + multi: false + required: true + show_user: false + default: 10KiB + - name: tags + type: text + title: Tags + multi: true + required: false + show_user: false + default: + - netflow + - forwarded + - name: timeout + type: text + title: Read timeout for socket operations. Valid time units are ns, us, ms, s, m, h. + multi: false + required: false + show_user: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/endace/data_stream/log/sample_event.json b/packages/endace/data_stream/log/sample_event.json new file mode 100644 index 00000000000..6b21d466690 --- /dev/null +++ b/packages/endace/data_stream/log/sample_event.json @@ -0,0 +1,123 @@ +{ + "@timestamp": "2018-07-03T10:47:00.000Z", + "agent": { + "ephemeral_id": "305f6431-67ab-4e0f-8805-2b9d97ae3923", + "id": "246fcb7f-fa5e-4375-95d0-e7962f456b94", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "client": { + "bytes": 719, + "packets": 5 + }, + "data_stream": { + "dataset": "endace.log", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "bytes": 0, + "packets": 0 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "246fcb7f-fa5e-4375-95d0-e7962f456b94", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "netflow_flow", + "agent_id_status": "verified", + "category": [ + "network", + "session" + ], + "created": "2023-07-19T13:23:37.227Z", + "dataset": "endace.log", + "ingested": "2023-07-19T13:23:38Z", + "kind": "event", + "type": [ + "connection" + ] + }, + "flow": { + "id": "Vhs9T5k296w", + "locality": "internal" + }, + "input": { + "type": "netflow" + }, + "netflow": { + "application_id": [ + 3, + 0, + 0, + 80 + ], + "art_client_network_time_sum": 0, + "art_count_late_responses": 0, + "art_count_responses": 0, + "art_count_retransmissions": 0, + "art_count_transactions": 0, + "art_network_time_sum": 0, + "art_response_time_sum": 0, + "art_server_network_time_sum": 0, + "art_server_response_time_maximum": 0, + "art_server_response_time_sum": 0, + "art_total_response_time_sum": 0, + "art_total_transaction_time_sum": 0, + "biflow_direction": 1, + "connection_sum_duration_seconds": 0, + "egress_interface": 13, + "exporter": { + "address": "172.28.0.4:42750", + "source_id": 512, + "timestamp": "2018-07-03T10:47:00.000Z", + "uptime_millis": 0, + "version": 10 + }, + "flow_end_sys_up_time": 564184158, + "flow_start_sys_up_time": 564184140, + "ingress_interface": 10, + "ingress_vrfid": 0, + "initiator_octets": 719, + "initiator_packets": 5, + "ip_diff_serv_code_point": 0, + "ip_ttl": 49, + "new_connection_delta_count": 1, + "protocol_identifier": 6, + "responder_octets": 0, + "responder_packets": 0, + "type": "netflow_flow", + "vlan_id": 0, + "waasoptimization_segment": 16 + }, + "network": { + "bytes": 719, + "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", + "direction": "unknown", + "iana_number": "6", + "packets": 5, + "transport": "tcp" + }, + "observer": { + "ip": [ + "172.28.0.4" + ] + }, + "server": { + "bytes": 0, + "packets": 0 + }, + "source": { + "bytes": 719, + "packets": 5 + }, + "tags": [ + "netflow", + "forwarded" + ] +} diff --git a/packages/endace/docs/README.md b/packages/endace/docs/README.md new file mode 100644 index 00000000000..1fb0ae4968b --- /dev/null +++ b/packages/endace/docs/README.md @@ -0,0 +1,400 @@ +# Network Packet Capture Integration + +This integration sniffs network packets on a host and dissects +known protocols. + +Monitoring your network traffic is critical to gaining observability and +securing your environment — ensuring high levels of performance and security. +The Network Packet Capture integration captures the network traffic between +your application servers, decodes common application layer protocols and +records the interesting fields for each transaction. + +## Supported Protocols + +Currently, Network Packet Capture supports the following protocols: + +- ICMP (v4 and v6) +- DHCP (v4) +- DNS +- HTTP +- AMQP 0.9.1 +- Cassandra +- Mysql +- PostgreSQL +- Redis +- Thrift-RPC +- MongoDB +- Memcache +- NFS +- TLS +- SIP/SDP (beta) + +### Common protocol options + +The following options are available for all protocols: + +#### `map_to_ecs` + +Remap any non-ECS Packetbeat fields in root to their correct ECS fields. +This will rename fields that are moved so the fields will not be present +at the root of the document and so any rules that depend on the fields +will need to be updated. + +The legacy behaviour of this option is to not remap to ECS. This behaviour +is still the default, but is deprecated and users are encouraged to set +this option to true. + +ECS remapping may have an impact on workflows that depend on the identity +of non-ECS fields, and users should assess their use of these fields before +making the change. Users who need to retain data collected with the legacy +mappings may need to re-index their older documents. Instructions for doing +this are available [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). +The pipeline used to perform ECS remapping for each data stream can be found +in `Stack Management`›`Ingest Pipelines` and and searching for +"logs-network_traffic compatibility". + +The deprecation and retirement timeline for legacy behavior is available +[here](https://github.com/elastic/integrations/issues/8185). + +#### `enabled` + +The enabled setting is a boolean setting to enable or disable protocols +without having to comment out configuration sections. If set to false, +the protocol is disabled. + +The default value is true. + +#### `ports` + +Exception: For ICMP the option `enabled` has to be used instead. + +The ports where Network Packet Capture will look to capture traffic for specific +protocols. Network Packet Capture installs a +[BPF](https://en.wikipedia.org/wiki/Berkeley_Packet_Filter) filter based +on the ports specified in this section. If a packet doesn’t match the +filter, very little CPU is required to discard the packet. Network Packet Capture +also uses the ports specified here to determine which parser to use for +each packet. + +#### `monitor_processes` + +If this option is enabled then network traffic events will be enriched +with information about the process associated with the events. + +The default value is false. + +#### `send_request` + +If this option is enabled, the raw message of the request (`request` +field) is sent to Elasticsearch. The default is false. This option is +useful when you want to index the whole request. Note that for HTTP, the +body is not included by default, only the HTTP headers. + +#### `send_response` + +If this option is enabled, the raw message of the response (`response` +field) is sent to Elasticsearch. The default is false. This option is +useful when you want to index the whole response. Note that for HTTP, +the body is not included by default, only the HTTP headers. + +#### `transaction_timeout` + +The per protocol transaction timeout. Expired transactions will no +longer be correlated to incoming responses, but sent to Elasticsearch +immediately. + +#### `tags` + +A list of tags that will be sent with the transaction event. This +setting is optional. + +#### `processors` + +A list of processors to apply to the data generated by the protocol. + +#### `keep_null` + +If this option is set to true, fields with `null` values will be +published in the output document. By default, `keep_null` is set to +`false`. + + +## Network Flows + +Overall flow information about the network connections on a +host. + +You can configure Network Packet Capture to collect and report statistics +on network flows. A *flow* is a group of packets sent over the same time +period that share common properties, such as the same source and destination +address and protocol. You can use this feature to analyze network +traffic over specific protocols on your network. + +For each flow, Network Packet Capture reports the number of packets and the +total number of bytes sent from the source to the destination. Each flow event +also contains information about the source and destination hosts, such +as their IP address. For bi-directional flows, Network Packet Capture reports +statistics for the reverse flow. + +Network Packet Capture collects and reports statistics up to and including the +transport layer. + +**Configuration options** + +You can specify the following options for capturing flows. + +#### `enabled` + +Enables flows support if set to true. Set to false to disable network +flows support without having to delete or comment out the flows section. +The default value is true. + +#### `timeout` + +Timeout configures the lifetime of a flow. If no packets have been +received for a flow within the timeout time window, the flow is killed +and reported. The default value is 30s. + +#### `period` + +Configure the reporting interval. All flows are reported at the very +same point in time. Periodical reporting can be disabled by setting the +value to -1. If disabled, flows are still reported once being timed out. +The default value is 10s. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| client.bytes | Bytes sent from the client to the server. | long | +| client.geo.city_name | City name. | keyword | +| client.geo.continent_name | Name of the continent. | keyword | +| client.geo.country_iso_code | Country ISO code. | keyword | +| client.geo.country_name | Country name. | keyword | +| client.geo.location | Longitude and latitude. | geo_point | +| client.geo.region_iso_code | Region ISO code. | keyword | +| client.geo.region_name | Region name. | keyword | +| client.ip | IP address of the client (IPv4 or IPv6). | ip | +| client.port | Port of the client. | long | +| client.process.args | The command-line of the process that initiated the transaction. | keyword | +| client.process.executable | Absolute path to the client process executable. | keyword | +| client.process.name | The name of the process that initiated the transaction. | keyword | +| client.process.start | The time the client process started. | date | +| client.process.working_directory | The working directory of the client process. | keyword | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.bytes | Bytes sent from the destination to the source. | long | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| destination.packets | Packets sent from the destination to the source. | long | +| destination.port | Port of the destination. | long | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | +| flow.id | Internal flow ID based on connection meta data and address. | keyword | +| flow.vlan | VLAN identifier from the 802.1q frame. In case of a multi-tagged frame this field will be an array with the outer tag's VLAN identifier listed first. | long | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| method | The command/verb/method of the transaction. For HTTP, this is the method name (GET, POST, PUT, and so on), for SQL this is the verb (SELECT, UPDATE, DELETE, and so on). | keyword | +| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | +| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | +| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | +| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | +| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | +| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | +| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | +| network_traffic.flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | +| network_traffic.flow.id | Internal flow ID based on connection meta data and address. | keyword | +| network_traffic.flow.vlan | VLAN identifier from the 802.1q frame. In case of a multi-tagged frame this field will be an array with the outer tag's VLAN identifier listed first. | long | +| network_traffic.status | The high level status of the transaction. The way to compute this value depends on the protocol, but the result has a meaning independent of the protocol. | keyword | +| observer.hostname | Hostname of the observer. | keyword | +| observer.ip | IP addresses of the observer. | ip | +| observer.mac | MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | +| params | The request parameters. For HTTP, these are the POST or GET parameters. For Thrift-RPC, these are the parameters from the request. | text | +| path | The path the transaction refers to. For HTTP, this is the URL. For SQL databases, this is the table name. For key-value stores, this is the key. | keyword | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.start | The time the process started. | date | +| process.working_directory | The working directory of the process. | keyword | +| process.working_directory.text | Multi-field of `process.working_directory`. | match_only_text | +| query | The query in a human readable format. For HTTP, it will typically be something like `GET /users/_search?name=test`. For MySQL, it is something like `SELECT id from users where name=test`. | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| request | For text protocols, this is the request as seen on the wire (application layer only). For binary protocols this is our representation of the request. | text | +| resource | The logical resource that this transaction refers to. For HTTP, this is the URL path up to the last slash (/). For example, if the URL is `/users/1`, the resource is `/users`. For databases, the resource is typically the table name. The field is not filled for all transaction types. | keyword | +| response | For text protocols, this is the response as seen on the wire (application layer only). For binary protocols this is our representation of the request. | text | +| server.bytes | Bytes sent from the server to the client. | long | +| server.geo.city_name | City name. | keyword | +| server.geo.continent_name | Name of the continent. | keyword | +| server.geo.country_iso_code | Country ISO code. | keyword | +| server.geo.country_name | Country name. | keyword | +| server.geo.location | Longitude and latitude. | geo_point | +| server.geo.region_iso_code | Region ISO code. | keyword | +| server.geo.region_name | Region name. | keyword | +| server.ip | IP address of the server (IPv4 or IPv6). | ip | +| server.port | Port of the server. | long | +| server.process.args | The command-line of the process that served the transaction. | keyword | +| server.process.executable | Absolute path to the server process executable. | keyword | +| server.process.name | The name of the process that served the transaction. | keyword | +| server.process.start | The time the server process started. | date | +| server.process.working_directory | The working directory of the server process. | keyword | +| source.bytes | Bytes sent from the source to the destination. | long | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| source.packets | Packets sent from the source to the destination. | long | +| source.port | Port of the source. | long | +| status | The high level status of the transaction. The way to compute this value depends on the protocol, but the result has a meaning independent of the protocol. | keyword | +| tags | List of keywords used to tag each event. | keyword | +| type | The type of the transaction (for example, HTTP, MySQL, Redis, or RUM) or "flow" in case of flows. | keyword | + + +An example event for `flow` looks as following: + +```json +{ + "@timestamp": "2023-10-16T22:40:20.005Z", + "agent": { + "ephemeral_id": "005dde79-7459-4b47-ae00-972086b4f5db", + "id": "f923dfe0-3acb-4f62-9ab4-1fabb8e8e112", + "name": "docker-fleet-agent", + "type": "packetbeat", + "version": "8.6.2" + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "bytes": 64, + "ip": "::1", + "packets": 1, + "port": 8000 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "f923dfe0-3acb-4f62-9ab4-1fabb8e8e112", + "snapshot": false, + "version": "8.6.2" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 73561, + "end": "2023-10-16T22:39:45.677Z", + "ingested": "2023-10-16T22:40:21Z", + "kind": "event", + "start": "2023-10-16T22:39:45.677Z", + "type": [ + "connection", + "end" + ] + }, + "flow": { + "final": true, + "id": "QAT///////8A////IP8AAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAUAfeMg" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "f91b175388d443fca5c155815dfc2279", + "ip": [ + "172.19.0.7" + ], + "mac": [ + "02-42-AC-13-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.15.49-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.5 LTS (Focal Fossa)" + } + }, + "network": { + "bytes": 152, + "community_id": "1:5y9AkdbV9U8xqD9dhlj6obkubHg=", + "packets": 2, + "transport": "tcp", + "type": "ipv6" + }, + "source": { + "bytes": 88, + "ip": "::1", + "packets": 1, + "port": 51320 + }, + "type": "flow" +} + +``` + +## Licensing for Windows Systems + +The Network Packet Capture Integration incorporates a bundled Npcap installation on Windows hosts. The installation is provided under an [OEM license](https://npcap.com/oem/redist.html) from Insecure.Com LLC ("The Nmap Project"). \ No newline at end of file diff --git a/packages/endace/elasticsearch/ingest_pipeline/endace.yml b/packages/endace/elasticsearch/ingest_pipeline/endace.yml new file mode 100644 index 00000000000..4aeffb2b45b --- /dev/null +++ b/packages/endace/elasticsearch/ingest_pipeline/endace.yml @@ -0,0 +1,52 @@ +--- +description: Endace Pivot Field. +processors: + - set: + description: "Set IP Conversation if both destination.ip and source.ip are present" + field: _conf.ip_conv + value: "ip_conv={{ source.ip }}%26{{ destination.ip }}" + if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + tag: endace conversation set + + + - set: + description: "Set IP Conversation if either destination.ip and source.ip are present" + field: _conf.ipconv + value: "ip={{ source.ip }}{{ destination.ip }}" + if: ctx._conf.ipconv != null && ctx.destination?.ip != null && ctx.destination?.ip != '' || ctx.source?.ip != null && ctx.source?.ip != '' + tag: endace ip set + + + - date: + description: "Convert Start time to Epoch" + field: event.start + formats: ["ISO8601"] + target_field: _conf.event.start + output_format: epoch_millis + if: ctx.event?.start != null && ctx.event?.start != '' + + + - date: + description: "Convert End time to Epoch" + field: event.end + formats: ["ISO8601"] + target_field: _conf.event.end + output_format: epoch_millis + if: ctx.event?.end != null && ctx.event?.end != '' + + - set: + description: "Calculate timedelta" + field: _conf.timedelta + value: _conf.endace_lookback * 60 * 1000 + + - set: + description: "Calculate Endtime + additional lookback" + field: _conf.event.end + value: _conf.event.end - _conf.timedelta + + - set: + field: event.reference + value: "{{ _conf.endace_url}}/vision2/pivotintovision/?title=endace_pivot&datasources={{_conf.endace_datasources }}&start={{ _conf.event.start }}&end={{ _conf.event.end }}&tools={{ _conf.endace_tools }}&{{ _conf.ip_conv }}" + ignore_empty_value: true + tag: endace reference url + if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' \ No newline at end of file diff --git a/packages/endace/img/endace-logo.svg b/packages/endace/img/endace-logo.svg new file mode 100644 index 00000000000..ba061f239a1 --- /dev/null +++ b/packages/endace/img/endace-logo.svg @@ -0,0 +1,12 @@ + + + + + + + + \ No newline at end of file diff --git a/packages/endace/img/endace-screenshot-1.png b/packages/endace/img/endace-screenshot-1.png new file mode 100644 index 0000000000000000000000000000000000000000..3958c77942d9614cd56d555bdba5cc94404564c0 GIT binary patch literal 10982 zcmeHtX*|?x|L`>iGsMi;vLptjh3rHzGnOchoqry9kmb^lo12~ z2p>6Y_A3CqL;#R>Xnwe|a(@?Gz=I=Z#wUVO=ROYHRyx?J*5#)#^5gzT$-WvD6jt*b z{#gYTnVQmY#o^auy`Bc%LlE&l&;KL~aOU*Z5L4rn20De;rTSxSFiEO!zYw2fqNQtE zyh~k9`~VgJoy?b%Sz7f}Fd{>03?j)Io1%%J+Hw@}9FIn1 zY=ioGq7A8Oyb3^P=Q<#(hodwi@VwOaNO@4J$O4KYk-(2jIGtCH#D5(JE{jnB>&O)1 z%uY07bmthVaS(3kreCr~^E8G*q#2PQpyIcUm-++pVJIvDI|%5I%0g!7g`*m;P_`mV z@M9>FwF#E`{sTY4AqMVX;EsWB1Q6e~4%%#{5M5D2cyI{n86X-27AN%3B!y-y)j3iQ zxCA4BFNaOfF_~BJcxjF`Z^W_ z*IZndrh0r>2l_{~1siw!UI#jmUO(j8s0!(AS)b(_HL{OK#57ZQ{jR6T1NwOlL`>U0 z95n*6YJjZTNNAptyDa3WJY*#eO)$*bPXwEyAt2#VgDoE`l7)15WG+JWn)L=m&cK$E zy|)w=FHNl0eHSZYAD5!4N6I&P$>wD|a*58f|M7CzP2U_66d+P7^mUqaMKCtR^rmaV zYiMKY6Syd$FWY1wjXBbc)1R!L2&zIPL&feJ@HY7mU=O*by9!fVKky(PK+EL?OohAe zmAg(L-VFxv0>;#{Xd=~1Hh|o45@TqB3+k|OqkfB&CrMy*OGfgdWfjnd%&q8SgXz#G zyQmRDvw=gh7b-jS8&#H1Wb7D2B@Bf2JZ^HqtTjlB1<^JI?~Qw^lkAeU`dbk{bcuh2 zGuOrWcfabu;9nwVD%z0zbB9z9SKqe%!kZq(_d}{`c zu1fmX-_N#^ESs@-txS~cc-Qdl(n#hkopb=M?6sDdWmcNVw}`ux+au3I`Ok%<@V4q_ zd_Nm9rn{z>aGiyWF=NA(#CW&VF{5kxI7m9iqzA4f#GkDlGpZs{OQ3x($ULdw42kVF^ZM}UW*M5m+sK)qZDZA}+*=S<)T1%;m`g{B7k+uNjZSx3@Z!%MfoqYp0W`d*C;?DD&Q_NT-0& zY=9B)ui5aYC7Biv;dN{Hc!Zc2DWHzC>w@<}N=Ojxn&#~TC*lbRsg@3G2CCy1VT?38 z3CZd3NpM;h;+JZMt2?WVyrvfB@-F$Oz9Pv@dNnXA8hsLE7O|u&&DabHYby#y#4qiN zr`nG*zQVx*8QY*XPF)3`bw6d0LuHu&#awxKI)JS$m9b?%k(#gb&|oD>M~(gG!QxbE3HGauR;sCYZ{t$wSXJJC^uU2MBnpX1u)thDfBW2*s+!ejlU7~@a^V-bq9eU(rH&VLRxLBFuqkt{v`mx9{7 zhwrp^$R-Bu7t^qUFw9Dd*=K6%D?Inmjo@~2Q~5A=tK?>ie4~v_ZFPv4KuwVA%&{={ zo|oVvq*APd)ja=VMyt3$ZKyt5uJyjpK19UIz!uh#9-Iw>f5?d^j~$qpNMI_>YzqAT zc@i~>je7IgKSHLqy`n}y^lm*r2c{739@*E~cU+>cMjhz=8nme2xW5_e@Gu9z^_F%? zp5@w|19DbRD)^jttW$N*^M87}HQ3=)<8)r%((J5NW2Fy-y`zlh?^qb5Z8*`sC-<)C zuZL>G9JZx&p*2&Q-ys^e0~3l<{RJ{A8EDNw@CRM^Bh+#u-tCVHenb2^b@jqGcA;pn zgZElN$yQEBZMo0PEUJ5;m~7mPecCZec&IE%wV1`SzuX~f!j<+M!o!@c)GLwrz%Td7 zFqS`k>p_S&-%8D%-Nv3uB8$M4R%Jr#bY}FWD*8Kb-eJeO+XeOUw9l@uBlyt7jIG2g2mHeNv1?Tm@e?dl*J$zvdv3IXqi>luSd!! zq;y<0wBGIMc(BoNx-}?Rb+$ka~K!##hZ1A_#&~t_}B7!0m(owzfQk@iF z=4K;fMdv$&CgSB&So-y6kxs{tpKIFGc`&>MrXG@--iW`>ePHHUEMtM?e+$`SQ@%>o zTO;veYYhEh&BM@Y2K^UWyA1!jS;4oM(;1h!E8=maJTBe3k~ot5$TO6u@RsGnEwY>J#s&KS#N^oyaXwOBGgD-_7n|z0& zqZsN?4p#cb*2?yq9BanLG?@=Xd)EVl0m-#8;_}%I6Ikvf()kCXb1(o#!{zLT2y&#n z#=~2s*bZ4RJH8cN!aIhdDRIu(AW?wXPaNu*F~&ojS04RoIl`c*^kHQ#GXf8z4PUY@ zIQJ?|@E$yY20B}PI7wT;bI&lJR(%s3L}>L0y0w6$*3VYFmm;FgIEcUjak{22dqr5g zE9HP#gwc1|asDPWkxWP#*KFAWTE1x~y2nZILTXYM{+vHw3&?6~tZOak>!MIMy>@1t zFnCS2p>+0>$WXC2IV&le2&%(u2TUYrSo|#X8~)JT3UGJRvp3yk@d#-3=c~$jnLJck zyOCo1AL|KG(CkjSz+pifN%F}5`Z1s4d-w=MEPP&CwCIS)__J@B)kjc=sRp9-lkGWi z;Ml<4Yb$%x#Vq03k-NWt@Ljqvu={nx^W}ZwwtLF!ROh|E)e=N8;Pb(g2y#z;7*U}p zJ3v0)o|P@w{qR5oJNxtL#fy&QBhA>hJ!|}_8!HHE=-$~C2?A2p2AsPbz%?u#Q81L15U zI}SE$1F&#tN?Oqn*_8z0l51{w;{jD^aUVCrKlN_$C<+Ilv#SdHCP2)nyp!^Rp9fT% zjPU#p1zI(~@Kpv4GWbHbbp63XGP(lqz9#{&@5?FbWTbq_ZMl>>2t8#y!UHQ#YQ^&p zi@G>KvRU1lAw7mF$bBJJwoT8B+`rf8h64l zHgqS4ghVt7eILM*q*k|%>WraEat*p5JCUhV)Z;KOSJwH8>OlHC;4X|BtS`3Z8IZo> zUsWI)2K!=Po6R2pbVKNmTo1zCoBR|zpm@VU_n4~_$OJ~*iRf--~U7V=bz>wZQP&GRFexml7Nc%r%4jq z=dgg<2^XG!{t0!P3l+GA1Q|+@|KG|`8S9G^vQ?1afq&|Q$NXIQr`S_XBOCg3F1Z#+ z4i^u2K?V$<|3$+E(vabz$Uqt-XC54&@K@MoRj&x9M$N>WWWu7d&Sv*Pf5 zCl_!R>epb=U~ueb^Yvl#9DVE_12!r!@B!)v*%RlDrw~7nhIznRHa6O>6T)(%DCivp z?IJK)aeF|rP8D(0KXGC^Bx(gsPTGg5G*ny!WbT>r@LS7Pk9H=&K7c$_`Lmt z0S-4$;cEmAf>Ev<FQg;!SA&RP6gEAez#1)jw-E_spdh&LA$hid@gy4qNV}jc zqbdq*4m?;O1#1P8xNq2NMcyy12T;@|Xj(HxaDzD$f;Qv%|hkdmS(_4BvDqP%DYhBDXz0f1A!XcXE2WN=$>+nNpA*7B=yxL5~w zPy*n}9RZS;b`@yEar-LxkZd54tedPJH2B#ACWOP&K<(jv;=f(7%nu$hZUg{l6afNo zeIE>bVD+S2jXWd3&FV_(e`c*dd+2ca1xTZgsQlBySR9;#RU>vydX=6C&9&& zgO)jVgA3*g!A>Y~!MKgIga8EN#KUGej~5TXg&`O%GV~BoLMZDyF)9G6Fc&onayPfY z5Kfvoec&@>#!5Q{;ch^!$wb(ZP1gM# z31pcWs4xLu#9?C?>X`bAr3Yr@sXE-42zGqG3Tkaa1*I(DVLkxsa?&d!Fj-zyhIi%MBB;h#v2YD0cuGSqKKM$^I!po2zOp9p~qC=4y-@{wVzj^R*40u z`yuUwXndp%gwp4ZVGIOJ7>cuioAW@z2tA@yV+YX<1$4L$862swf;R$^Ge%KRG6?ieAQRn|WpZ|9l{$BG|~lmU%cpiolCD4l9Ba5!i5p*$Sh%7(wA0d!-kUMvaf`e@dtU@39fu?@V+&v=lOM$2b6lN4589DL<;>&ag-r{*#q`G2)bQG&ghhG|RIMw~}cPJ#C# zyQc8Xj8+k1X?Jnl%$%V2rQ0VNj(riApR625CYo@X4&RSmRua5QImvj6`<%L$-QdF@ z@!w|*Ni28P7nFanOC+vIyh0PD-2Q0ZxNDMT)u-#V{p;~dn^kl3p4vbBPq=vRd+Ipn z;9XOwA2uBJLX6VY6Z^;7u0IUxB^b|;tiXJzmLsyfprpmA+=E^|9H0%s;LNrwqIo05 zM2_w?(<`&?Td^{t=S_Yr@!lTGn58hBeJAJl&l5W~k~YA-fD!TeD{=IY{NkSb#I@YM zR`L>kq-T2RiKP2#s_w(|m1`X`xv+;R+-=}Gr@13 zLaiDt@r7Dy`5~RHz^-=VjvqIxERfgP<$Myu9KHXDGfrYPS zZ@Z-q9O5*&#J+>N7`j*Ku}7l(ccgfER}L~A?-E{xC}D(?ELY7?||KfuCc#K^pN`xD$gBNB&C|jz)tHbDFec`5hhdL#6ET`Eg4sQ1I2#L9ina8iht9vFX%i7W+f_I z%tFm>BR&8EJvR-~a=xRN9i)tahQ&>C&QpZ?lcC#gVpZjMCgg>DKu? zBlnSD=PcTl9l=b83aUV){28sX?)DRHU*@L<^8?77y(X^`LWSfFv~ncgOSIA`sHzUa z+dzAUXU^#UL3VA=OW!lXCJqTKcOOT=-Z&3+t3b&yl9OZn#Uok8dsfSf^cB5sRW0An z*SFL5#h;XImGfAlcQY;KYvEDq?od0L{8D$x`3j@gK%%An#p&XKYa=3#j5MUpDecyP zN$ZHInUJB$Vz#PoIN!>97luR~{$u6Jo3;GIbQ7Y|``=o0CF*?5^a6f6>wIcGtX_>7n1DC2aN-s z&{r*6WGa0o)gvwh-kZC+=P<{ZH`Z;NrWFnP;GtDsPb?(o*D%7~*j-t;cGLxF90mU8(|F-pPCPs*uv zz$1+EsWfNvhC}(@l9m>Y&agw3NO9dC3kpPYI#`04JD z+?g{Sgq-5(SHbRrV<_ibDl_4HnwF7@0Ta55C)rv4l)tmq_GJ6i^a7fMGk)E{;<>fM zLR4*5pIE1D^pO7$a;nhj*0bfShhdfNvwO5ODLtf&SCz3fAxUQ0`9WyR3~fmvnEx_1=ho^?^x2LTCR|AOohLC=|KPlGr7M7;4}O)lXAyuX(MNq zse~J|2-O=a%@X%xyO`cvG7DwM6uer)s2+j&MDG;zYH-^2AtDj>Q=s*PQRB%C=SJc% z`@7=DG+o!O1X$^VqMN^;i~1!i(r|d}Q>1*H=#!^~XC`=j>n19`z2E~GVq+FQ7?D8z zAk*LaM&_r}v38Ri{11MPfnp9h@ZEwFeXl&-Eqw$mFq>fLh;x%UpdRy0L6RgU{Zpsh z_Z^N7{hIRqi7IShX0xRglc!L=0By=?LSux0Us?k4X=kA+%vQY;&w|W?AM{nfKqbV7 ziXB5`XhH+r$k?_2mWynC_%?b_&&@g!GI#PsgZHvjV;E|{INA`eJg>~XHw9DlCPARQ zstx($5e-Sqf;DB%)6R91eZya};EfSDXTuf(;oPCkphz(8#wl;`gXsxpKR##z!0(3h z^eRj3uS5IJwI8fVZP7CmHU5bX_nafdh%22KP>_azei_u5d;pYb6 zs(uEdQ2^5GZ>`FuJuu?1FbIuXtn8v$VNnpbb;Zxu74@@~1f>FmPd5n`cOs1Bv^~2L zp^6;KSKF-?O?AOz{5n~@LkHX$$OYW12{6l~(hmEEHaZL&?1ocI(heDVP2|DF(>@)Z zm~Wb%@Z@Dzo{L8F$%5q@mC@`p10))PfmU=tctNi^*%8V^9%2y03)crMH0u4*zN6qw zOCuS!qs1#LyhdN%xUe^kZJXm)#r^OpLYMLf$1(?*2*5GtGzleN01mIbu2G^`mxmZB z4`*qT-0Nm)V4hC)Ndk(bB4VmqA)^MJ&=`RN=H>5OJt#lz9kcuNxwXT~uS}Pj(J^Jc z>fdb3$9Tq2+IvR9vAaeD6nilhwrUMtkagk{JJw>WGT*o_9nzAH*8XJ40UJsv5`H43G*!6 z#-m%CA&nu^W@?i&2RF2B1c(f=4Sc2p-2JWh`~K;`1&7L&cgwZ49)uq^h7Vp$SsB#Z z&^`$3-E)1PDyErHu~~KP-D%NI1;tD)+0=B+;+ld3uB)E#*9`@G+RbY%6^=h2t5DUQ z$=yAF=^isibz0^o;mUIHsutb9J#4$W*DcPT8RzX2u7uCxFejc=^NQ8$-Ot``@9q_I zAlf!vB})~>v@fGonflMsU02FA8(U{l+(|^+IdkFT-d;5qOP5JA-qyBj zrM5Gg$LDK(7N%PqlUh$ZF|c z_kmN9H3!;dds4ZXeE%n*KMcpKdE6JDx_NcVc+7<{B;!MVldOAx=ALe1-Id|W>W#n_ z|DCWvO**vqv!LGM!-_8l;G$U|PfujvH(aI=e# zVMc81lAu%2qD$=%yVlC@=$pDJule=qFr*2NQX+Fmn(CRi{oLNr2bOt-Oc%t!Gk5NAhV#x`=uDuIi-`pFri-eSY{YOM-1jx92w*n!uT3nr$P(At|&3JHDFekC^&} z)1;zz8jq}qbtx#UjN8@cIF3tXMO+d0him_ZcB~n@eC&0&Q19O0lA=M4+iOy}GBhQ4 z4@Fi#B-=(R^lA^8s^I7(NnA|XvPdZSjIZgA|8 z=ZAW2Id>_hOs|X7FC1g5SdLVSbmzkGy2md?+EL3-q~oq`pY#`+7aD>`G~+S7S#%{m zq5W`E)J$(~Sns{db}sgeZs#hWj!X6(?{pvU*NufW@zfE8i>BRC%XS2fr+YREo);Ar zW#4bf+rMGAeX>k=O%@9?y0HS$Vl1lOF5lYgos>#}iuaxz3C8eV+Ju3Zm^$1)q7Y`& z9kpQh)EZh*;{E+g_e|eZyl)O|uZrrJAPh|2KLV=>Rt0I#q@bReZQ-!!^E<=D-7Fx0}NNIKE}7aKt~_BBofDX$NigE zpIr}a7_kaX;DVdEpYV! literal 0 HcmV?d00001 diff --git a/packages/endace/manifest.yml b/packages/endace/manifest.yml new file mode 100644 index 00000000000..929632bf8ee --- /dev/null +++ b/packages/endace/manifest.yml @@ -0,0 +1,100 @@ +format_version: 3.0.0 +name: endace +title: "Endace" +version: 0.0.4 +source: + license: "Elastic-2.0" +description: "This Endace integration configures Network Packet Capture for flow generation and adds a pivot field to your Endace platform." +type: integration +categories: + - aws + - cloud + - custom + - network +conditions: + kibana: + version: ^8.6.2 + elastic: + subscription: "basic" +screenshots: + - src: /img/endace-screenshot-1.png + title: Endace + size: 600x600 + type: image/png +icons: + - src: /img/endace-logo.svg + title: Endace logo + size: 128x128 + type: image/svg+xml +vars: + - name: endace_url + type: text + title: Endace UI URL + multi: false + required: true + show_user: true + description: "Base URL for Endace UI. Example: https://myvprobe.com" + - name: endace_datasources + type: text + title: Endace Datasources + description: Datasource within Endace + multi: false + required: true + show_user: false + default: "tag:rotation-file" + - name: endace_tools + type: text + title: Endace Tools + description: Tools within Endace + multi: false + required: true + show_user: false + default: "trafficOverTime_by_app,conversations_by_ipaddress" + - name: endace_lookback + type: text + title: Endace Lookback Time + description: Lookback time in minutes. Example 10 + multi: false + required: true + show_user: false + default: "10" + +policy_templates: + - name: endace + title: Endace Flow logs + description: Capture network traffic via Endace Flow or Network Packet Capture + inputs: + - type: packet + title: Capture network traffic + description: Collecting network traffic. Use this if using Endace vProbe + vars: + - name: interface + type: text + title: Interface + required: false + show_user: true + - name: never_install + type: bool + title: Never Install Npcap on Windows + description: |- + On Windows, the Network Packet Capture integration requires an Npcap DLL installation. + This is provided by the integration for users of the Elastic Licenced version. In some + cases users may wish to use their own installed version. In order to allow this, this + option can be used. Setting it to `true` will disable installation of the bundled Npcap + library. + + Note that if there is no Npcap installed the integration will not function, and versions + of the Npcap library other than the bundled version may not provide functionality required + by the integration. + required: false + show_user: false + default: false + - type: netflow + title: Collect Endace Flow logs + description: Collecting Endace Flow logs using the netflow input +agent: + privileges: + root: true +owner: + github: elastic/integrations + type: partner diff --git a/packages/endace/validation.yml b/packages/endace/validation.yml new file mode 100644 index 00000000000..9dcaa3b03ff --- /dev/null +++ b/packages/endace/validation.yml @@ -0,0 +1,5 @@ +errors: + exclude_checks: + - SVR00002 # Mandatory filters in dashboards. + - SVR00004 # References in dashboards. + - SVR00005 # Kibana version for saved tags. From c01b125993e35f1986d0b7c2a2c6ff52c854b332 Mon Sep 17 00:00:00 2001 From: James Garside Date: Thu, 20 Jun 2024 13:59:41 +0100 Subject: [PATCH 02/23] Netflow tests complete --- .github/CODEOWNERS | 1 + .../_dev/deploy/docker/docker-compose.yml | 2 +- .../system/test-http-get-2k-file-config.yml | 1 + .../test/system/test-icmp-2-pings-config.yml | 1 + .../test/system/test-icmp4-ping-config.yml | 1 + .../test/system/test-icmp6-ping-config.yml | 1 + .../elasticsearch/ingest_pipeline/endace.yml | 4 +- .../endace/data_stream/log/_dev/add_field.py | 48 +++++ .../pipeline/test-netflow-log-events.json | 204 ++++++++++++++++++ ...test-netflow-log-events.json-expected.json | 17 +- .../_dev/test/system/test-netflow-config.yml | 2 + .../log/agent/stream/netflow.yml.hbs | 7 +- .../elasticsearch/ingest_pipeline/default.yml | 6 + .../ingest_pipeline/endace-netflow.yml | 69 ++++++ 14 files changed, 354 insertions(+), 10 deletions(-) rename packages/endace/{ => data_stream/flow}/elasticsearch/ingest_pipeline/endace.yml (95%) create mode 100644 packages/endace/data_stream/log/_dev/add_field.py create mode 100644 packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 504e8f7d7c2..b6c6135f607 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -146,6 +146,7 @@ /packages/elastic_package_registry @elastic/ecosystem /packages/elasticsearch @elastic/stack-monitoring /packages/enterprisesearch @elastic/stack-monitoring +/packages/endace @elastic/sec-deployment-and-devices /packages/entityanalytics_entra_id @elastic/security-service-integrations /packages/entityanalytics_okta @elastic/security-service-integrations /packages/eset_protect @elastic/security-service-integrations diff --git a/packages/endace/_dev/deploy/docker/docker-compose.yml b/packages/endace/_dev/deploy/docker/docker-compose.yml index 645c7f1a81e..adbdde59baf 100644 --- a/packages/endace/_dev/deploy/docker/docker-compose.yml +++ b/packages/endace/_dev/deploy/docker/docker-compose.yml @@ -1,6 +1,6 @@ version: "2.3" services: - network_traffic: + endace: image: alpine volumes: - ./pcaps:/sample_pcaps:ro diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml index 7d40f8b2d97..2cbfac50130 100644 --- a/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml +++ b/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml @@ -4,3 +4,4 @@ input: packet data_stream: vars: period: '-1s' + endace_url: 'http://test.elastic.co' \ No newline at end of file diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml index d185b5ac134..d288467b690 100644 --- a/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml +++ b/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml @@ -5,3 +5,4 @@ data_stream: vars: timeout: '5s' period: '-1s' + endace_url: 'http://test.elastic.co' \ No newline at end of file diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml index af1d6962cbc..ac9dd427000 100644 --- a/packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml +++ b/packages/endace/data_stream/flow/_dev/test/system/test-icmp4-ping-config.yml @@ -4,3 +4,4 @@ input: packet data_stream: vars: period: '1s' + endace_url: 'http://test.elastic.co' diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml index 4b6304198e4..be4ef69d695 100644 --- a/packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml +++ b/packages/endace/data_stream/flow/_dev/test/system/test-icmp6-ping-config.yml @@ -4,3 +4,4 @@ input: packet data_stream: vars: period: '1s' + endace_url: 'http://test.elastic.co' diff --git a/packages/endace/elasticsearch/ingest_pipeline/endace.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml similarity index 95% rename from packages/endace/elasticsearch/ingest_pipeline/endace.yml rename to packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml index 4aeffb2b45b..eb6cca3dffb 100644 --- a/packages/endace/elasticsearch/ingest_pipeline/endace.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml @@ -49,4 +49,6 @@ processors: value: "{{ _conf.endace_url}}/vision2/pivotintovision/?title=endace_pivot&datasources={{_conf.endace_datasources }}&start={{ _conf.event.start }}&end={{ _conf.event.end }}&tools={{ _conf.endace_tools }}&{{ _conf.ip_conv }}" ignore_empty_value: true tag: endace reference url - if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' \ No newline at end of file + if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + - remove: + field: "_conf" \ No newline at end of file diff --git a/packages/endace/data_stream/log/_dev/add_field.py b/packages/endace/data_stream/log/_dev/add_field.py new file mode 100644 index 00000000000..03f94518a03 --- /dev/null +++ b/packages/endace/data_stream/log/_dev/add_field.py @@ -0,0 +1,48 @@ +import json, os, collections, copy + + + +events_path = os.getcwd() + "/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json" +expected_events_path = os.getcwd() + "/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json" + +with open(events_path, 'r') as f: + events = json.load(f, object_pairs_hook=collections.OrderedDict) + +with open(expected_events_path, 'r') as ef: + expected_events = json.load(ef, object_pairs_hook=collections.OrderedDict) + + +# expected_events = copy.deepcopy(events) + +def process_events(): + for event in events['events']: + if '_conf' not in event: + event['_conf'] = {} + event['_conf']['endace_url'] = 'https://test.test.local' + event['_conf']['endace_datasources'] = 'tag:rotation-file' + event['_conf']['endace_tools'] = 'trafficOverTime_by_app,conversations_by_ipaddress' + event['_conf']['endace_lookback'] = 10 + + +def process_expected_events(): + for event in expected_events['expected']: + if '_conf' in event: + del event['_conf'] + # expected_events['expected'] = expected_events.pop('events') + + + +process_events() + +process_expected_events() + + +# Write Events +with open(events_path, 'w') as f: + json.dump(events, f, indent=4) + + +# Write Expected Events +with open(expected_events_path, 'w') as ef: + json.dump(expected_events, ef, indent=4) + diff --git a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json index 2507a856291..99ab16f813a 100644 --- a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json +++ b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json @@ -102,6 +102,12 @@ "destination": { "bytes": 0, "packets": 0 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -206,6 +212,12 @@ "packets": 6, "direction": "unknown", "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -310,6 +322,12 @@ }, "ecs": { "version": "1.8.0" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -414,6 +432,12 @@ "packets": 79, "direction": "unknown", "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -518,6 +542,12 @@ "name": "mbp.local", "type": "filebeat", "version": "8.0.0" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -622,6 +652,12 @@ "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=", "transport": "tcp", "iana_number": 6 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -726,6 +762,12 @@ "packets": 39, "direction": "unknown", "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -830,6 +872,12 @@ }, "observer": { "ip": "127.0.0.1" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -934,6 +982,12 @@ }, "observer": { "ip": "127.0.0.1" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1038,6 +1092,12 @@ "name": "mbp.local", "type": "filebeat", "version": "8.0.0" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1142,6 +1202,12 @@ "bytes": 4965, "packets": 13, "direction": "unknown" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1246,6 +1312,12 @@ "source": { "bytes": 138, "packets": 4 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1350,6 +1422,12 @@ }, "input": { "type": "netflow" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1454,6 +1532,12 @@ "type": [ "connection" ] + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1558,6 +1642,12 @@ "flow": { "id": "Vhs9T5k296w", "locality": "internal" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1662,6 +1752,12 @@ "destination": { "bytes": 0, "packets": 0 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1766,6 +1862,12 @@ "flow": { "locality": "internal", "id": "Vhs9T5k296w" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1870,6 +1972,12 @@ }, "ecs": { "version": "1.8.0" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -1974,6 +2082,12 @@ "destination": { "bytes": 0, "packets": 0 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2078,6 +2192,12 @@ "client": { "bytes": 1487, "packets": 21 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2182,6 +2302,12 @@ "packets": 17, "direction": "unknown", "community_id": "1:idwO/QHAjbcGlF1bfQE9dPuu7T0=" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2286,6 +2412,12 @@ "type": "filebeat", "version": "8.0.0", "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2390,6 +2522,12 @@ "ephemeral_id": "0a75cedf-6ef5-4932-8d1b-43b0d1b4739c", "id": "508165af-d28d-4de1-bbb3-e81aafd32d75", "name": "mbp.local" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2494,6 +2632,12 @@ }, "host": { "name": "mbp.local" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2598,6 +2742,12 @@ "source": { "bytes": 1005, "packets": 4 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2702,6 +2852,12 @@ "client": { "bytes": 138, "packets": 4 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2806,6 +2962,12 @@ }, "input": { "type": "netflow" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -2910,6 +3072,12 @@ }, "observer": { "ip": "127.0.0.1" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -3014,6 +3182,12 @@ }, "host": { "name": "mbp.local" + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -3083,6 +3257,12 @@ "locality": "internal", "packets": 5, "port": 53 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -3152,6 +3332,12 @@ "locality": "external", "packets": 10, "port": 443 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -3221,6 +3407,12 @@ "locality": "internal", "packets": 11, "port": 49180 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -3295,6 +3487,12 @@ "ip": "0.0.0.0", "locality": "internal", "port": 136 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } }, { @@ -3367,6 +3565,12 @@ "ip": "0.0.0.0", "locality": "internal", "port": 136 + }, + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 } } ] diff --git a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json index 8b3f75a1aec..c4d15424718 100644 --- a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json +++ b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json @@ -3179,7 +3179,8 @@ "kind": "event", "type": [ "connection" - ] + ], + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079368960&end=1587078768963&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.127.32.11%2610.36.236.100" }, "flow": { "id": "6mUV1nPVG80", @@ -3254,7 +3255,8 @@ "kind": "event", "type": [ "connection" - ] + ], + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079367995&end=1587078768404&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=89.160.20.112%2610.36.236.100" }, "flow": { "id": "HVg4SttTufc", @@ -3312,7 +3314,7 @@ }, "bytes": 7158, "geo": { - "city_name": "Linköping", + "city_name": "Link\u00f6ping", "continent_name": "Europe", "country_iso_code": "SE", "country_name": "Sweden", @@ -3321,7 +3323,7 @@ "lon": 15.6167 }, "region_iso_code": "SE-E", - "region_name": "Östergötland County" + "region_name": "\u00d6sterg\u00f6tland County" }, "ip": "89.160.20.112", "locality": "external", @@ -3339,7 +3341,7 @@ } }, "geo": { - "city_name": "Linköping", + "city_name": "Link\u00f6ping", "continent_name": "Europe", "country_iso_code": "SE", "country_name": "Sweden", @@ -3348,7 +3350,7 @@ "lon": 15.6167 }, "region_iso_code": "SE-E", - "region_name": "Östergötland County" + "region_name": "\u00d6sterg\u00f6tland County" }, "ip": "89.160.20.112", "locality": "external", @@ -3365,7 +3367,8 @@ "kind": "event", "type": [ "connection" - ] + ], + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079367920&end=1587078768404&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.36.236.100%2689.160.20.112" }, "flow": { "id": "HVg4SttTufc", diff --git a/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml b/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml index d55e2268d3c..80cb30b3000 100644 --- a/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml +++ b/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml @@ -5,5 +5,7 @@ data_stream: vars: host: 0.0.0.0 port: 2055 + endace_url: 'http://test.elastic.co' + numeric_keyword_fields: - network.iana_number diff --git a/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs index c2d192f3c75..cf0bb64390f 100644 --- a/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs +++ b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs @@ -31,7 +31,12 @@ tags: {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} -{{#if processors}} processors: +- add_fields: + target: "_conf" + fields: + endace_url: {{ endace_url }} + test: "test" +{{#if processors}} {{processors}} {{/if}} diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 2dd1531816f..f01170ba54e 100644 --- a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -106,6 +106,12 @@ processors: field: - _tmp_ ignore_missing: true + - pipeline: + name: '{{ IngestPipeline "endace-netflow" }}' + tag: pipeline_processor + if: ctx.source?.ip != null && ctx.destination?.ip != null && ctx.source?.ip != '0.0.0.0' && ctx.destination?.ip != '0.0.0.0' + - remove: + field: "_conf" on_failure: - set: field: event.kind diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml new file mode 100644 index 00000000000..2f0b7aa07b2 --- /dev/null +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml @@ -0,0 +1,69 @@ +--- +description: Endace Pivot Field. +processors: + - set: + description: "Set IP Conversation if both destination.ip and source.ip are present" + field: _conf.ip_conv + value: "ip_conv={{ source.ip }}%26{{ destination.ip }}" + if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + tag: endace conversation set + + - set: + description: "Set IP Conversation if either destination.ip and source.ip are present" + field: _conf.ipconv + value: "ip={{ source.ip }}{{ destination.ip }}" + if: ctx._conf.ipconv != null && ctx.destination?.ip != null && ctx.destination?.ip != '' || ctx.source?.ip != null && ctx.source?.ip != '' + tag: endace ip set + + + - date: + description: "Convert Start time to Epoch" + field: netflow.flow_start_milliseconds + formats: ["ISO8601"] + target_field: _conf.event.start + output_format: epoch_millis + if: ctx.netflow?.flow_start_milliseconds != null && ctx.netflow?.flow_start_milliseconds != '' + + + - convert: + field: _conf.event.start + type: long + description: "Convert Start time to Long" + if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' + + + - date: + description: "Convert End time to Epoch" + field: netflow.flow_end_milliseconds + formats: ["ISO8601"] + target_field: _conf.event.end + output_format: epoch_millis + if: ctx.netflow?.flow_end_milliseconds != null && ctx.netflow?.flow_end_milliseconds != '' + + + - convert: + field: _conf.event.end + type: long + description: "Convert End time to Long" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' + + - script: + source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" + tag: "Calculate Timedelta" + description: "Calculate Timedelta" + if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' + + + - script: + source: "ctx._conf.event.end = ctx._conf.event.end - ctx._conf.timedelta" + tag: "Calculate Endtime + additional lookback" + description: "Calculate Endtime + additional lookback" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + + + - set: + field: event.reference + value: "{{ _conf.endace_url}}/vision2/pivotintovision/?title=endace_pivot&datasources={{_conf.endace_datasources }}&start={{ _conf.event.start }}&end={{ _conf.event.end }}&tools={{ _conf.endace_tools }}&{{ _conf.ip_conv }}" + ignore_empty_value: true + tag: endace reference url + if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' From d72723da777875b4411811069f22f62e30ad9c5b Mon Sep 17 00:00:00 2001 From: James Garside Date: Fri, 21 Jun 2024 21:20:10 +0100 Subject: [PATCH 03/23] Added tests --- .../endace/data_stream/flow/_dev/add_field.py | 70 + .../_dev/test/pipeline/test-flow-events.json | 3082 +++++++++++++++++ .../test-flow-events.json-expected.json | 2982 ++++++++++++++++ .../elasticsearch/ingest_pipeline/default.yml | 1 + .../elasticsearch/ingest_pipeline/endace.yml | 36 +- 5 files changed, 6161 insertions(+), 10 deletions(-) create mode 100644 packages/endace/data_stream/flow/_dev/add_field.py create mode 100644 packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json create mode 100644 packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json diff --git a/packages/endace/data_stream/flow/_dev/add_field.py b/packages/endace/data_stream/flow/_dev/add_field.py new file mode 100644 index 00000000000..d26b956cb73 --- /dev/null +++ b/packages/endace/data_stream/flow/_dev/add_field.py @@ -0,0 +1,70 @@ +import json, os, collections +from datetime import datetime +import time + +events_path = os.getcwd() + "/data_stream/flow/_dev/test/pipeline/test-flow-events.json" +expected_events_path = os.getcwd() + "/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json" + +with open(events_path, 'r') as f: + events = json.load(f, object_pairs_hook=collections.OrderedDict) + +with open(expected_events_path, 'r') as ef: + expected_events = json.load(ef, object_pairs_hook=collections.OrderedDict) + + +def remove_metadata(): + new_events = {"events":[]} + for event in events['events']: + if '_source' in event: + new_events['events'].append(event['_source']) + + return new_events + +def process_events(): + for event in events['events']: + if '_conf' not in event: + event['_conf'] = {} + event['_conf']['endace_url'] = 'https://test.test.local' + event['_conf']['endace_datasources'] = 'tag:rotation-file' + event['_conf']['endace_tools'] = 'trafficOverTime_by_app,conversations_by_ipaddress' + event['_conf']['endace_lookback'] = 10 + + + # Convert event.start to epoch + if 'event' in event and 'start' in event['event']: + start_str = event['event']['start'] + # Assuming the date format is ISO 8601, e.g., "2023-01-01T00:00:00Z" + start_dt = datetime.strptime(start_str, "%Y-%m-%dT%H:%M:%SZ") + event['_conf']['event']['start'] = int(time.mktime(start_dt.timetuple())) + + # Convert event.end to epoch + if 'event' in event and 'end' in event['event']: + end_str = event['event']['end'] + # Assuming the date format is ISO 8601, e.g., "2023-01-01T00:00:00Z" + end_dt = datetime.strptime(end_str, "%Y-%m-%dT%H:%M:%SZ") + event['_conf']['event']['end'] = int(time.mktime(end_dt.timetuple())) + + +def process_expected_events(): + for event in expected_events['expected']: + if '_conf' in event: + del event['_conf'] + event['ecs']['version'] = "8.11.0" + # expected_events['expected'] = expected_events.pop('events') + + + +process_events() + +process_expected_events() + +# events = remove_metadata() +# Write Events +with open(events_path, 'w') as f: + json.dump(events, f, indent=4) + + +# Write Expected Events +with open(expected_events_path, 'w') as ef: + json.dump(expected_events, ef, indent=4) + diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json new file mode 100644 index 00000000000..a4b57b512f5 --- /dev/null +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json @@ -0,0 +1,3082 @@ +{ + "events": [ + { + "server": { + "port": 80, + "bytes": 374, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /.env", + "destination": { + "port": 80, + "bytes": 374, + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 46324, + "bytes": 230, + "ip": "57.129.23.166" + }, + "type": "http", + "url": { + "path": "/.env", + "extension": "env", + "scheme": "http", + "domain": "34.147.158.4", + "full": "http://34.147.158.4/.env" + }, + "network": { + "community_id": "1:SUrUlAjDJgBojipINaXvE82MrcU=", + "protocol": "http", + "bytes": 604, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:18.358Z", + "related": { + "ip": [ + "57.129.23.166", + "10.100.0.29", + "34.147.158.4" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "containerized": false, + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 46324, + "bytes": 230, + "ip": "57.129.23.166" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 230 + }, + "response": { + "headers": { + "content-length": 177, + "content-type": "text/html" + }, + "status_phrase": "not found", + "status_code": 404, + "mime_type": "text/html", + "bytes": 374, + "body": { + "bytes": 177 + } + }, + "version": "1.1" + }, + "event": { + "duration": 506000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:19Z", + "kind": "event", + "start": "2024-06-21T11:18:18.358Z", + "end": "2024-06-21T11:18:18.359Z", + "type": [ + "connection", + "protocol" + ], + "category": [ + "network" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 716, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "POST", + "query": "POST /", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 716, + "ip": "10.100.0.29" + }, + "source": { + "port": 46390, + "bytes": 316, + "ip": "57.129.23.166" + }, + "type": "http", + "url": { + "path": "/", + "scheme": "http", + "query": "0x%5B%5D=androxgh0st", + "domain": "34.147.158.4", + "full": "http://34.147.158.4/?0x%5B%5D=androxgh0st" + }, + "network": { + "community_id": "1:2X7Vc6YqRE4tl8APECPM4vuvaMA=", + "protocol": "http", + "bytes": 1032, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:18.416Z", + "related": { + "ip": [ + "57.129.23.166", + "10.100.0.29", + "34.147.158.4" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "headers": { + "content-length": 20, + "content-type": "application/x-www-form-urlencoded" + }, + "method": "POST", + "bytes": 316, + "body": { + "bytes": 20 + } + }, + "response": { + "headers": { + "content-length": 559, + "content-type": "text/html" + }, + "status_code": 405, + "status_phrase": "not allowed", + "mime_type": "text/html", + "bytes": 716, + "body": { + "bytes": 559 + } + }, + "version": "1.1" + }, + "client": { + "port": 46390, + "bytes": 316, + "ip": "57.129.23.166" + }, + "event": { + "duration": 238000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:19Z", + "kind": "event", + "start": "2024-06-21T11:18:18.416Z", + "end": "2024-06-21T11:18:18.417Z", + "type": [ + "connection", + "protocol" + ], + "category": [ + "network" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "type": "http", + "error": { + "message": "Unmatched response" + }, + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:18.465Z", + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:19Z", + "kind": "event", + "end": "2024-06-21T11:18:18.465Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "protocol": "http", + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:15.709Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:17Z", + "kind": "event", + "end": "2024-06-21T11:18:15.709Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1//", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "error": { + "message": "Unmatched request" + }, + "type": "http", + "url": { + "path": "/computeMetadata/v1//", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 228, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:18.451Z", + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 228 + }, + "version": "1.1" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:32Z", + "kind": "event", + "start": "2024-06-21T11:17:18.451Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1/", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "error": { + "message": "Unmatched request" + }, + "type": "http", + "url": { + "path": "/computeMetadata/v1/", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "bytes": 227, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:15.695Z", + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 227 + }, + "version": "1.1" + }, + "client": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:32Z", + "kind": "event", + "start": "2024-06-21T11:17:15.695Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "protocol": "http", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:18.450Z", + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:19Z", + "kind": "event", + "end": "2024-06-21T11:17:18.450Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "protocol": "http", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:15.695Z", + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:16Z", + "kind": "event", + "end": "2024-06-21T11:17:15.695Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1//", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "error": { + "message": "Unmatched request" + }, + "type": "http", + "url": { + "path": "/computeMetadata/v1//", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 228, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:18.436Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 228 + }, + "version": "1.1" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:33Z", + "kind": "event", + "start": "2024-06-21T11:16:18.436Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1/", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "type": "http", + "error": { + "message": "Unmatched request" + }, + "url": { + "path": "/computeMetadata/v1/", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "bytes": 227, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:15.680Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 227 + }, + "version": "1.1" + }, + "client": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:33Z", + "kind": "event", + "start": "2024-06-21T11:16:15.680Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "destination": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:18.434Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "containerized": false, + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:19Z", + "kind": "event", + "end": "2024-06-21T11:16:18.434Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "destination": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "protocol": "http", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:15.679Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:16Z", + "kind": "event", + "end": "2024-06-21T11:16:15.679Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "status": "Error", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 38106, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/bg.jpg", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 38106, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "source": { + "port": 1541, + "bytes": 385, + "ip": "35.244.92.47" + }, + "type": "http", + "url": { + "path": "/images/bg.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/bg.jpg" + }, + "network": { + "protocol": "http", + "community_id": "1:Awz6GFqwC6DyvBuaB+al4It7yAY=", + "bytes": 38491, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:12.734Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/assets/css/main.css" + ], + "ip": [ + "35.244.92.47", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 1541, + "bytes": 385, + "ip": "35.244.92.47" + }, + "http": { + "request": { + "referrer": "http://www.test.co/assets/css/main.css", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 385 + }, + "response": { + "headers": { + "content-length": 37864, + "content-type": "image/jpeg" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "image/jpeg", + "bytes": 38106, + "body": { + "bytes": 37864 + } + }, + "version": "1.1" + }, + "event": { + "duration": 113000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:14Z", + "kind": "event", + "start": "2024-06-21T11:16:12.734Z", + "end": "2024-06-21T11:16:12.734Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 72153, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /assets/fonts/fontawesome-webfont.woff2", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 72153, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "source": { + "port": 1539, + "bytes": 402, + "ip": "35.244.92.47" + }, + "type": "http", + "url": { + "path": "/assets/fonts/fontawesome-webfont.woff2", + "extension": "woff2", + "scheme": "http", + "query": "v=4.6.3", + "domain": "www.test.co", + "full": "http://www.test.co/assets/fonts/fontawesome-webfont.woff2?v=4.6.3" + }, + "network": { + "community_id": "1:gPM3VQvPa/AoaH6Pynie+9K8/a4=", + "protocol": "http", + "bytes": 72555, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:12.783Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/assets/css/font-awesome.min.css" + ], + "ip": [ + "35.244.92.47", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 1539, + "bytes": 402, + "ip": "35.244.92.47" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "referrer": "http://www.test.co/assets/css/font-awesome.min.css", + "method": "GET", + "bytes": 402 + }, + "response": { + "headers": { + "content-length": 71896, + "content-type": "application/octet-stream" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/octet-stream", + "bytes": 72153, + "body": { + "bytes": 71896 + } + }, + "version": "1.1" + }, + "event": { + "duration": 61000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:14Z", + "kind": "event", + "start": "2024-06-21T11:16:12.783Z", + "end": "2024-06-21T11:16:12.783Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 4137, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 4137, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "source": { + "port": 19456, + "bytes": 419, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/" + }, + "network": { + "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", + "protocol": "http", + "bytes": 4556, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.631Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 19456, + "bytes": 419, + "ip": "34.86.203.82" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 419 + }, + "response": { + "headers": { + "content-length": 3875, + "content-type": "text/html" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "text/html", + "bytes": 4137, + "body": { + "bytes": 3875 + } + }, + "version": "1.1" + }, + "event": { + "duration": 477000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.631Z", + "end": "2024-06-21T11:16:10.632Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 10306, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/pic01.jpg", + "destination": { + "port": 80, + "bytes": 10306, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19458, + "bytes": 369, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/images/pic01.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/pic01.jpg" + }, + "network": { + "protocol": "http", + "community_id": "1:19gScwFqXOlar3be22Vn5xuAauQ=", + "bytes": 10675, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.792Z", + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 369 + }, + "response": { + "headers": { + "content-length": 10064, + "content-type": "image/jpeg" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "image/jpeg", + "bytes": 10306, + "body": { + "bytes": 10064 + } + }, + "version": "1.1" + }, + "client": { + "port": 19458, + "bytes": 369, + "ip": "34.86.203.82" + }, + "event": { + "duration": 251000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.792Z", + "end": "2024-06-21T11:16:10.792Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 32868, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /assets/css/main.css", + "destination": { + "port": 80, + "bytes": 32868, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19456, + "bytes": 326, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/assets/css/main.css", + "extension": "css", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/assets/css/main.css" + }, + "network": { + "protocol": "http", + "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", + "bytes": 33194, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.716Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 326 + }, + "response": { + "headers": { + "content-length": 32628, + "content-type": "text/css" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "text/css", + "bytes": 32868, + "body": { + "bytes": 32628 + } + }, + "version": "1.1" + }, + "client": { + "port": 19456, + "bytes": 326, + "ip": "34.86.203.82" + }, + "event": { + "duration": 84000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.716Z", + "end": "2024-06-21T11:16:10.716Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 9145, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/pic02.jpg", + "destination": { + "port": 80, + "bytes": 9145, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19457, + "bytes": 369, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/images/pic02.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/pic02.jpg" + }, + "network": { + "protocol": "http", + "community_id": "1:ioQAxWbr9FPVUa+VsG4oHAJkdqg=", + "bytes": 9514, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.795Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 19457, + "bytes": 369, + "ip": "34.86.203.82" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 369 + }, + "response": { + "headers": { + "content-length": 8904, + "content-type": "image/jpeg" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "image/jpeg", + "bytes": 9145, + "body": { + "bytes": 8904 + } + }, + "version": "1.1" + }, + "event": { + "duration": 41000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.795Z", + "end": "2024-06-21T11:16:10.795Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 9938, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/pic03.jpg", + "destination": { + "port": 80, + "bytes": 9938, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19461, + "bytes": 369, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/images/pic03.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/pic03.jpg" + }, + "network": { + "community_id": "1:ggT7zC+LwNLXYYw3utRBpsMN+9w=", + "protocol": "http", + "bytes": 10307, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.796Z", + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 369 + }, + "response": { + "headers": { + "content-length": 9697, + "content-type": "image/jpeg" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "image/jpeg", + "bytes": 9938, + "body": { + "bytes": 9697 + } + }, + "version": "1.1" + }, + "client": { + "port": 19461, + "bytes": 369, + "ip": "34.86.203.82" + }, + "event": { + "duration": 202000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.796Z", + "end": "2024-06-21T11:16:10.796Z", + "type": [ + "connection", + "protocol" + ], + "category": [ + "network" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "server": { + "port": 80, + "bytes": 9338, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /assets/js/skel.min.js", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 9338, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "source": { + "port": 19460, + "bytes": 313, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/assets/js/skel.min.js", + "extension": "js", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/assets/js/skel.min.js" + }, + "network": { + "protocol": "http", + "community_id": "1:I2z0vpcqgfS252mqkW5mlrncpqY=", + "bytes": 9651, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.797Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 313 + }, + "response": { + "headers": { + "content-length": 9085, + "content-type": "application/javascript" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/javascript", + "bytes": 9338, + "body": { + "bytes": 9085 + } + }, + "version": "1.1" + }, + "client": { + "port": 19460, + "bytes": 313, + "ip": "34.86.203.82" + }, + "event": { + "duration": 233000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.797Z", + "end": "2024-06-21T11:16:10.797Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK", + "_conf": { + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + } + ] +} \ No newline at end of file diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json new file mode 100644 index 00000000000..41ecb814ea2 --- /dev/null +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json @@ -0,0 +1,2982 @@ +{ + "expected": [ + { + "server": { + "port": 80, + "bytes": 374, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /.env", + "destination": { + "port": 80, + "bytes": 374, + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 46324, + "bytes": 230, + "ip": "57.129.23.166" + }, + "type": "http", + "url": { + "path": "/.env", + "extension": "env", + "scheme": "http", + "domain": "34.147.158.4", + "full": "http://34.147.158.4/.env" + }, + "network": { + "community_id": "1:SUrUlAjDJgBojipINaXvE82MrcU=", + "protocol": "http", + "bytes": 604, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:18.358Z", + "related": { + "ip": [ + "57.129.23.166", + "10.100.0.29", + "34.147.158.4" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "containerized": false, + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 46324, + "bytes": 230, + "ip": "57.129.23.166" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 230 + }, + "response": { + "headers": { + "content-length": 177, + "content-type": "text/html" + }, + "status_phrase": "not found", + "status_code": 404, + "mime_type": "text/html", + "bytes": 374, + "body": { + "bytes": 177 + } + }, + "version": "1.1" + }, + "event": { + "duration": 506000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:19Z", + "kind": "event", + "start": "2024-06-21T11:18:18.358Z", + "end": "2024-06-21T11:18:18.359Z", + "type": [ + "connection", + "protocol" + ], + "category": [ + "network" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" + }, + "status": "Error" + }, + { + "server": { + "port": 80, + "bytes": 716, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "POST", + "query": "POST /", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 716, + "ip": "10.100.0.29" + }, + "source": { + "port": 46390, + "bytes": 316, + "ip": "57.129.23.166" + }, + "type": "http", + "url": { + "path": "/", + "scheme": "http", + "query": "0x%5B%5D=androxgh0st", + "domain": "34.147.158.4", + "full": "http://34.147.158.4/?0x%5B%5D=androxgh0st" + }, + "network": { + "community_id": "1:2X7Vc6YqRE4tl8APECPM4vuvaMA=", + "protocol": "http", + "bytes": 1032, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:18.416Z", + "related": { + "ip": [ + "57.129.23.166", + "10.100.0.29", + "34.147.158.4" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "headers": { + "content-length": 20, + "content-type": "application/x-www-form-urlencoded" + }, + "method": "POST", + "bytes": 316, + "body": { + "bytes": 20 + } + }, + "response": { + "headers": { + "content-length": 559, + "content-type": "text/html" + }, + "status_code": 405, + "status_phrase": "not allowed", + "mime_type": "text/html", + "bytes": 716, + "body": { + "bytes": 559 + } + }, + "version": "1.1" + }, + "client": { + "port": 46390, + "bytes": 316, + "ip": "57.129.23.166" + }, + "event": { + "duration": 238000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:19Z", + "kind": "event", + "start": "2024-06-21T11:18:18.416Z", + "end": "2024-06-21T11:18:18.417Z", + "type": [ + "connection", + "protocol" + ], + "category": [ + "network" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" + }, + "status": "Error" + }, + { + "server": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "type": "http", + "error": { + "message": "Unmatched response" + }, + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:18.465Z", + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:19Z", + "kind": "event", + "end": "2024-06-21T11:18:18.465Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "status": "Error" + }, + { + "server": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "protocol": "http", + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:18:15.709Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:18:17Z", + "kind": "event", + "end": "2024-06-21T11:18:15.709Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "status": "Error" + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1//", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "error": { + "message": "Unmatched request" + }, + "type": "http", + "url": { + "path": "/computeMetadata/v1//", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 228, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:18.451Z", + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 228 + }, + "version": "1.1" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:32Z", + "kind": "event", + "start": "2024-06-21T11:17:18.451Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error" + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1/", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "error": { + "message": "Unmatched request" + }, + "type": "http", + "url": { + "path": "/computeMetadata/v1/", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "bytes": 227, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:15.695Z", + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 227 + }, + "version": "1.1" + }, + "client": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:32Z", + "kind": "event", + "start": "2024-06-21T11:17:15.695Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error" + }, + { + "server": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "protocol": "http", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:18.450Z", + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:19Z", + "kind": "event", + "end": "2024-06-21T11:17:18.450Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "status": "Error" + }, + { + "server": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "protocol": "http", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:17:15.695Z", + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:17:16Z", + "kind": "event", + "end": "2024-06-21T11:17:15.695Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "status": "Error" + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1//", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "error": { + "message": "Unmatched request" + }, + "type": "http", + "url": { + "path": "/computeMetadata/v1//", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 228, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:18.436Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 35176, + "bytes": 228, + "ip": "10.100.0.29" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 228 + }, + "version": "1.1" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:33Z", + "kind": "event", + "start": "2024-06-21T11:16:18.436Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error" + }, + { + "server": { + "port": 80, + "ip": "169.254.169.254" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /computeMetadata/v1/", + "destination": { + "port": 80, + "ip": "169.254.169.254" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "type": "http", + "error": { + "message": "Unmatched request" + }, + "url": { + "path": "/computeMetadata/v1/", + "scheme": "http", + "domain": "169.254.169.254", + "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", + "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + }, + "network": { + "protocol": "http", + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "bytes": 227, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:15.680Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "10.100.0.29", + "169.254.169.254" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 227 + }, + "version": "1.1" + }, + "client": { + "port": 35164, + "bytes": 227, + "ip": "10.100.0.29" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:33Z", + "kind": "event", + "start": "2024-06-21T11:16:15.680Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Go-http-client/1.1" + }, + "status": "Error" + }, + { + "server": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "destination": { + "port": 35176, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "protocol": "http", + "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:18.434Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "containerized": false, + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:19Z", + "kind": "event", + "end": "2024-06-21T11:16:18.434Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "status": "Error" + }, + { + "server": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "destination": { + "port": 35164, + "bytes": 25084, + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 80, + "ip": "169.254.169.254" + }, + "error": { + "message": "Unmatched response" + }, + "type": "http", + "network": { + "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", + "protocol": "http", + "bytes": 25084, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:15.679Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "ip": [ + "169.254.169.254", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 80, + "ip": "169.254.169.254" + }, + "http": { + "response": { + "headers": { + "content-length": 24794, + "content-type": "application/json" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/json", + "bytes": 25084, + "body": { + "bytes": 24794 + } + } + }, + "event": { + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:16Z", + "kind": "event", + "end": "2024-06-21T11:16:15.679Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "status": "Error" + }, + { + "server": { + "port": 80, + "bytes": 38106, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/bg.jpg", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 38106, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "source": { + "port": 1541, + "bytes": 385, + "ip": "35.244.92.47" + }, + "type": "http", + "url": { + "path": "/images/bg.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/bg.jpg" + }, + "network": { + "protocol": "http", + "community_id": "1:Awz6GFqwC6DyvBuaB+al4It7yAY=", + "bytes": 38491, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:12.734Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/assets/css/main.css" + ], + "ip": [ + "35.244.92.47", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 1541, + "bytes": 385, + "ip": "35.244.92.47" + }, + "http": { + "request": { + "referrer": "http://www.test.co/assets/css/main.css", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 385 + }, + "response": { + "headers": { + "content-length": 37864, + "content-type": "image/jpeg" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "image/jpeg", + "bytes": 38106, + "body": { + "bytes": 37864 + } + }, + "version": "1.1" + }, + "event": { + "duration": 113000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:14Z", + "kind": "event", + "start": "2024-06-21T11:16:12.734Z", + "end": "2024-06-21T11:16:12.734Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + }, + { + "server": { + "port": 80, + "bytes": 72153, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /assets/fonts/fontawesome-webfont.woff2", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 72153, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "source": { + "port": 1539, + "bytes": 402, + "ip": "35.244.92.47" + }, + "type": "http", + "url": { + "path": "/assets/fonts/fontawesome-webfont.woff2", + "extension": "woff2", + "scheme": "http", + "query": "v=4.6.3", + "domain": "www.test.co", + "full": "http://www.test.co/assets/fonts/fontawesome-webfont.woff2?v=4.6.3" + }, + "network": { + "community_id": "1:gPM3VQvPa/AoaH6Pynie+9K8/a4=", + "protocol": "http", + "bytes": 72555, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:12.783Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/assets/css/font-awesome.min.css" + ], + "ip": [ + "35.244.92.47", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 1539, + "bytes": 402, + "ip": "35.244.92.47" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "referrer": "http://www.test.co/assets/css/font-awesome.min.css", + "method": "GET", + "bytes": 402 + }, + "response": { + "headers": { + "content-length": 71896, + "content-type": "application/octet-stream" + }, + "status_code": 200, + "status_phrase": "ok", + "mime_type": "application/octet-stream", + "bytes": 72153, + "body": { + "bytes": 71896 + } + }, + "version": "1.1" + }, + "event": { + "duration": 61000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:14Z", + "kind": "event", + "start": "2024-06-21T11:16:12.783Z", + "end": "2024-06-21T11:16:12.783Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + }, + { + "server": { + "port": 80, + "bytes": 4137, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 4137, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "source": { + "port": 19456, + "bytes": 419, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/" + }, + "network": { + "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", + "protocol": "http", + "bytes": 4556, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.631Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 19456, + "bytes": 419, + "ip": "34.86.203.82" + }, + "http": { + "request": { + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 419 + }, + "response": { + "headers": { + "content-length": 3875, + "content-type": "text/html" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "text/html", + "bytes": 4137, + "body": { + "bytes": 3875 + } + }, + "version": "1.1" + }, + "event": { + "duration": 477000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.631Z", + "end": "2024-06-21T11:16:10.632Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + }, + { + "server": { + "port": 80, + "bytes": 10306, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/pic01.jpg", + "destination": { + "port": 80, + "bytes": 10306, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19458, + "bytes": 369, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/images/pic01.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/pic01.jpg" + }, + "network": { + "protocol": "http", + "community_id": "1:19gScwFqXOlar3be22Vn5xuAauQ=", + "bytes": 10675, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.792Z", + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 369 + }, + "response": { + "headers": { + "content-length": 10064, + "content-type": "image/jpeg" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "image/jpeg", + "bytes": 10306, + "body": { + "bytes": 10064 + } + }, + "version": "1.1" + }, + "client": { + "port": 19458, + "bytes": 369, + "ip": "34.86.203.82" + }, + "event": { + "duration": 251000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.792Z", + "end": "2024-06-21T11:16:10.792Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + }, + { + "server": { + "port": 80, + "bytes": 32868, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /assets/css/main.css", + "destination": { + "port": 80, + "bytes": 32868, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19456, + "bytes": 326, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/assets/css/main.css", + "extension": "css", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/assets/css/main.css" + }, + "network": { + "protocol": "http", + "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", + "bytes": 33194, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.716Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 326 + }, + "response": { + "headers": { + "content-length": 32628, + "content-type": "text/css" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "text/css", + "bytes": 32868, + "body": { + "bytes": 32628 + } + }, + "version": "1.1" + }, + "client": { + "port": 19456, + "bytes": 326, + "ip": "34.86.203.82" + }, + "event": { + "duration": 84000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.716Z", + "end": "2024-06-21T11:16:10.716Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + }, + { + "server": { + "port": 80, + "bytes": 9145, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/pic02.jpg", + "destination": { + "port": 80, + "bytes": 9145, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19457, + "bytes": 369, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/images/pic02.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/pic02.jpg" + }, + "network": { + "protocol": "http", + "community_id": "1:ioQAxWbr9FPVUa+VsG4oHAJkdqg=", + "bytes": 9514, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.795Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "client": { + "port": 19457, + "bytes": 369, + "ip": "34.86.203.82" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 369 + }, + "response": { + "headers": { + "content-length": 8904, + "content-type": "image/jpeg" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "image/jpeg", + "bytes": 9145, + "body": { + "bytes": 8904 + } + }, + "version": "1.1" + }, + "event": { + "duration": 41000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.795Z", + "end": "2024-06-21T11:16:10.795Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + }, + { + "server": { + "port": 80, + "bytes": 9938, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /images/pic03.jpg", + "destination": { + "port": 80, + "bytes": 9938, + "domain": "www.test.co", + "ip": "10.100.0.29" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 19461, + "bytes": 369, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/images/pic03.jpg", + "extension": "jpg", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/images/pic03.jpg" + }, + "network": { + "community_id": "1:ggT7zC+LwNLXYYw3utRBpsMN+9w=", + "protocol": "http", + "bytes": 10307, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.796Z", + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 369 + }, + "response": { + "headers": { + "content-length": 9697, + "content-type": "image/jpeg" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "image/jpeg", + "bytes": 9938, + "body": { + "bytes": 9697 + } + }, + "version": "1.1" + }, + "client": { + "port": 19461, + "bytes": 369, + "ip": "34.86.203.82" + }, + "event": { + "duration": 202000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.796Z", + "end": "2024-06-21T11:16:10.796Z", + "type": [ + "connection", + "protocol" + ], + "category": [ + "network" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + }, + { + "server": { + "port": 80, + "bytes": 9338, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "method": "GET", + "query": "GET /assets/js/skel.min.js", + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "port": 80, + "bytes": 9338, + "ip": "10.100.0.29", + "domain": "www.test.co" + }, + "source": { + "port": 19460, + "bytes": 313, + "ip": "34.86.203.82" + }, + "type": "http", + "url": { + "path": "/assets/js/skel.min.js", + "extension": "js", + "scheme": "http", + "domain": "www.test.co", + "full": "http://www.test.co/assets/js/skel.min.js" + }, + "network": { + "protocol": "http", + "community_id": "1:I2z0vpcqgfS252mqkW5mlrncpqY=", + "bytes": 9651, + "transport": "tcp", + "type": "ipv4", + "direction": "ingress" + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "jamesgarside-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-06-21T11:16:10.797Z", + "ecs": { + "version": "8.11.0" + }, + "related": { + "hosts": [ + "www.test.co", + "http://www.test.co/" + ], + "ip": [ + "34.86.203.82", + "10.100.0.29" + ] + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "network_traffic.http" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "http": { + "request": { + "referrer": "http://www.test.co/", + "headers": { + "content-length": 0 + }, + "method": "GET", + "bytes": 313 + }, + "response": { + "headers": { + "content-length": 9085, + "content-type": "application/javascript" + }, + "status_phrase": "ok", + "status_code": 200, + "mime_type": "application/javascript", + "bytes": 9338, + "body": { + "bytes": 9085 + } + }, + "version": "1.1" + }, + "client": { + "port": 19460, + "bytes": 313, + "ip": "34.86.203.82" + }, + "event": { + "duration": 233000, + "agent_id_status": "verified", + "ingested": "2024-06-21T11:16:11Z", + "kind": "event", + "start": "2024-06-21T11:16:10.797Z", + "end": "2024-06-21T11:16:10.797Z", + "category": [ + "network" + ], + "type": [ + "connection", + "protocol" + ], + "dataset": "network_traffic.http", + "reference": "" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + }, + "status": "OK" + } + ] +} \ No newline at end of file diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml index 212ffb757ce..164fa67df2e 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml @@ -86,6 +86,7 @@ processors: - pipeline: name: '{{ IngestPipeline "endace" }}' tag: pipeline_processor + if: ctx.source?.ip != null && ctx.destination?.ip != null && ctx.source?.ip != '0.0.0.0' && ctx.destination?.ip != '0.0.0.0' - remove: field: _conf diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml index eb6cca3dffb..5b2d4d1a287 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml @@ -25,6 +25,12 @@ processors: output_format: epoch_millis if: ctx.event?.start != null && ctx.event?.start != '' + - convert: + field: _conf.event.start + type: long + description: "Convert Start time to Long" + if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' + - date: description: "Convert End time to Epoch" @@ -34,15 +40,27 @@ processors: output_format: epoch_millis if: ctx.event?.end != null && ctx.event?.end != '' - - set: - description: "Calculate timedelta" - field: _conf.timedelta - value: _conf.endace_lookback * 60 * 1000 - - set: - description: "Calculate Endtime + additional lookback" - field: _conf.event.end - value: _conf.event.end - _conf.timedelta + - convert: + field: _conf.event.end + type: long + description: "Convert End time to Long" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' + + + - script: + source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" + tag: "Calculate Timedelta" + description: "Calculate Timedelta" + if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' + + + - script: + source: "ctx._conf.event.end = ctx._conf.event.end - ctx._conf.timedelta" + tag: "Calculate Endtime + additional lookback" + description: "Calculate Endtime + additional lookback" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + - set: field: event.reference @@ -50,5 +68,3 @@ processors: ignore_empty_value: true tag: endace reference url if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' - - remove: - field: "_conf" \ No newline at end of file From 14ece87aee2d12854e1a6fa23b2dac220b49e2e8 Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 1 Jul 2024 12:08:26 +0100 Subject: [PATCH 04/23] Fixed tests for flow --- .../endace/data_stream/flow/_dev/add_field.py | 5 +- .../_dev/test/pipeline/test-flow-events.json | 2654 +++-------------- .../test-flow-events.json-expected.json | 2598 +++------------- 3 files changed, 834 insertions(+), 4423 deletions(-) diff --git a/packages/endace/data_stream/flow/_dev/add_field.py b/packages/endace/data_stream/flow/_dev/add_field.py index d26b956cb73..d6564a5cd47 100644 --- a/packages/endace/data_stream/flow/_dev/add_field.py +++ b/packages/endace/data_stream/flow/_dev/add_field.py @@ -24,6 +24,7 @@ def process_events(): for event in events['events']: if '_conf' not in event: event['_conf'] = {} + event['_conf']['event'] = {} event['_conf']['endace_url'] = 'https://test.test.local' event['_conf']['endace_datasources'] = 'tag:rotation-file' event['_conf']['endace_tools'] = 'trafficOverTime_by_app,conversations_by_ipaddress' @@ -34,14 +35,14 @@ def process_events(): if 'event' in event and 'start' in event['event']: start_str = event['event']['start'] # Assuming the date format is ISO 8601, e.g., "2023-01-01T00:00:00Z" - start_dt = datetime.strptime(start_str, "%Y-%m-%dT%H:%M:%SZ") + start_dt = datetime.strptime(start_str, "%Y-%m-%dT%H:%M:%S.%fZ") event['_conf']['event']['start'] = int(time.mktime(start_dt.timetuple())) # Convert event.end to epoch if 'event' in event and 'end' in event['event']: end_str = event['event']['end'] # Assuming the date format is ISO 8601, e.g., "2023-01-01T00:00:00Z" - end_dt = datetime.strptime(end_str, "%Y-%m-%dT%H:%M:%SZ") + end_dt = datetime.strptime(end_str, "%Y-%m-%dT%H:%M:%S.%fZ") event['_conf']['event']['end'] = int(time.mktime(end_dt.timetuple())) diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json index a4b57b512f5..6ff73b1c9f2 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json @@ -1,1488 +1,18 @@ { "events": [ { - "server": { - "port": 80, - "bytes": 374, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /.env", - "destination": { - "port": 80, - "bytes": 374, - "ip": "10.100.0.29" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 46324, - "bytes": 230, - "ip": "57.129.23.166" - }, - "type": "http", - "url": { - "path": "/.env", - "extension": "env", - "scheme": "http", - "domain": "34.147.158.4", - "full": "http://34.147.158.4/.env" - }, - "network": { - "community_id": "1:SUrUlAjDJgBojipINaXvE82MrcU=", - "protocol": "http", - "bytes": 604, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:18:18.358Z", - "related": { - "ip": [ - "57.129.23.166", - "10.100.0.29", - "34.147.158.4" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "containerized": false, - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 46324, - "bytes": 230, - "ip": "57.129.23.166" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 230 - }, - "response": { - "headers": { - "content-length": 177, - "content-type": "text/html" - }, - "status_phrase": "not found", - "status_code": 404, - "mime_type": "text/html", - "bytes": 374, - "body": { - "bytes": 177 - } - }, - "version": "1.1" - }, - "event": { - "duration": 506000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:19Z", - "kind": "event", - "start": "2024-06-21T11:18:18.358Z", - "end": "2024-06-21T11:18:18.359Z", - "type": [ - "connection", - "protocol" - ], - "category": [ - "network" - ], - "dataset": "network_traffic.http" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 80, - "bytes": 716, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "method": "POST", - "query": "POST /", - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 80, - "bytes": 716, - "ip": "10.100.0.29" - }, - "source": { - "port": 46390, - "bytes": 316, - "ip": "57.129.23.166" - }, - "type": "http", - "url": { - "path": "/", - "scheme": "http", - "query": "0x%5B%5D=androxgh0st", - "domain": "34.147.158.4", - "full": "http://34.147.158.4/?0x%5B%5D=androxgh0st" - }, - "network": { - "community_id": "1:2X7Vc6YqRE4tl8APECPM4vuvaMA=", - "protocol": "http", - "bytes": 1032, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:18:18.416Z", - "related": { - "ip": [ - "57.129.23.166", - "10.100.0.29", - "34.147.158.4" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "request": { - "headers": { - "content-length": 20, - "content-type": "application/x-www-form-urlencoded" - }, - "method": "POST", - "bytes": 316, - "body": { - "bytes": 20 - } - }, - "response": { - "headers": { - "content-length": 559, - "content-type": "text/html" - }, - "status_code": 405, - "status_phrase": "not allowed", - "mime_type": "text/html", - "bytes": 716, - "body": { - "bytes": 559 - } - }, - "version": "1.1" - }, - "client": { - "port": 46390, - "bytes": 316, - "ip": "57.129.23.166" - }, - "event": { - "duration": 238000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:19Z", - "kind": "event", - "start": "2024-06-21T11:18:18.416Z", - "end": "2024-06-21T11:18:18.417Z", - "type": [ - "connection", - "protocol" - ], - "category": [ - "network" - ], - "dataset": "network_traffic.http" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "type": "http", - "error": { - "message": "Unmatched response" - }, - "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 25084, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:18:18.465Z", - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:19Z", - "kind": "event", - "end": "2024-06-21T11:18:18.465Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" - }, - "type": "http", - "network": { - "protocol": "http", - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "bytes": 25084, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:18:15.709Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:17Z", - "kind": "event", - "end": "2024-06-21T11:18:15.709Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /computeMetadata/v1//", - "destination": { - "port": 80, - "ip": "169.254.169.254" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "error": { - "message": "Unmatched request" - }, - "type": "http", - "url": { - "path": "/computeMetadata/v1//", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" - }, - "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 228, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:17:18.451Z", - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 228 - }, - "version": "1.1" - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:32Z", - "kind": "event", - "start": "2024-06-21T11:17:18.451Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "user_agent": { - "original": "Go-http-client/1.1" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /computeMetadata/v1/", - "destination": { - "port": 80, - "ip": "169.254.169.254" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, - "error": { - "message": "Unmatched request" - }, - "type": "http", - "url": { - "path": "/computeMetadata/v1/", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" - }, - "network": { - "protocol": "http", - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "bytes": 227, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, - "service": { - "name": "GCE" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:17:15.695Z", - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 227 - }, - "version": "1.1" - }, - "client": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:32Z", - "kind": "event", - "start": "2024-06-21T11:17:15.695Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "user_agent": { - "original": "Go-http-client/1.1" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" - }, - "type": "http", - "network": { - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "protocol": "http", - "bytes": 25084, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:17:18.450Z", - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:19Z", - "kind": "event", - "end": "2024-06-21T11:17:18.450Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" - }, - "type": "http", - "network": { - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "protocol": "http", - "bytes": 25084, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, - "service": { - "name": "GCE" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:17:15.695Z", - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:16Z", - "kind": "event", - "end": "2024-06-21T11:17:15.695Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /computeMetadata/v1//", - "destination": { - "port": 80, - "ip": "169.254.169.254" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "error": { - "message": "Unmatched request" - }, - "type": "http", - "url": { - "path": "/computeMetadata/v1//", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" - }, - "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 228, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:18.436Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 228 - }, - "version": "1.1" - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:33Z", - "kind": "event", - "start": "2024-06-21T11:16:18.436Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "user_agent": { - "original": "Go-http-client/1.1" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /computeMetadata/v1/", - "destination": { - "port": 80, - "ip": "169.254.169.254" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, - "type": "http", - "error": { - "message": "Unmatched request" - }, - "url": { - "path": "/computeMetadata/v1/", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" - }, - "network": { - "protocol": "http", - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "bytes": 227, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, - "service": { - "name": "GCE" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:15.680Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 227 - }, - "version": "1.1" - }, - "client": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:33Z", - "kind": "event", - "start": "2024-06-21T11:16:15.680Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http" - }, - "user_agent": { - "original": "Go-http-client/1.1" - }, - "status": "Error", - "_conf": { - "endace_url": "https://test.test.local", - "endace_datasources": "tag:rotation-file", - "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", - "endace_lookback": 10 - } - }, - { - "server": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", "version": "8.9.1" }, "destination": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" + "port": 48866, + "bytes": 1317, + "ip": "127.0.0.1", + "packets": 12 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -1490,20 +20,18 @@ "snapshot": false }, "source": { - "port": 80, - "ip": "169.254.169.254" + "port": 6789, + "bytes": 1108, + "ip": "127.0.0.1", + "packets": 14 }, - "error": { - "message": "Unmatched response" - }, - "type": "http", + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 25084, + "community_id": "1:RCi572y4gqQ+7LFlqkPsn1Xfa+0=", + "bytes": 2425, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 26 }, "cloud": { "availability_zone": "europe-west2-c", @@ -1512,12 +40,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, "service": { "name": "GCE" }, + "machine": { + "type": "t2d-standard-1" + }, "project": { "id": "elastic-sa" }, @@ -1526,20 +54,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:18.434Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -1552,11 +74,11 @@ "version": "11 (bullseye)", "platform": "debian" }, + "containerized": false, "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], - "containerized": false, "name": "webserver", "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ @@ -1564,41 +86,31 @@ ], "architecture": "x86_64" }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, "event": { + "duration": 64831956254, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:19Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "end": "2024-06-21T11:16:18.434Z", + "start": "2024-07-01T10:48:39.852Z", + "action": "network_flow", + "end": "2024-07-01T10:49:44.684Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYUa4r4" }, - "status": "Error", "_conf": { + "event": { + "start": 1719827319, + "end": 1719827384 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -1606,43 +118,55 @@ } }, { - "server": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "destination": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, - "source": { - "port": 80, - "ip": "169.254.169.254" + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 680, + "ip": "81.2.69.144", + "packets": 10 }, - "error": { - "message": "Unmatched response" + "source": { + "port": 56370, + "bytes": 5211, + "ip": "10.100.0.29", + "packets": 10 }, - "type": "http", + "type": "flow", "network": { - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "protocol": "http", - "bytes": 25084, + "community_id": "1:TwdqE0w1aE72YUTaajguLj4qUns=", + "bytes": 5891, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 20 }, "cloud": { "availability_zone": "europe-west2-c", @@ -1651,12 +175,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "service": { - "name": "GCE" - }, "machine": { "type": "t2d-standard-1" }, + "service": { + "name": "GCE" + }, "project": { "id": "elastic-sa" }, @@ -1665,20 +189,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:15.679Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -1686,8 +204,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "type": "linux", "family": "debian", + "type": "linux", "version": "11 (bullseye)", "platform": "debian" }, @@ -1703,41 +221,31 @@ ], "architecture": "x86_64" }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, "event": { + "duration": 60223908451, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:16Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "end": "2024-06-21T11:16:15.679Z", + "start": "2024-07-01T10:48:39.852Z", + "action": "network_flow", + "end": "2024-07-01T10:49:40.076Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" }, - "status": "Error", "_conf": { + "event": { + "start": 1719827319, + "end": 1719827380 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -1745,52 +253,55 @@ } }, { - "server": { - "port": 80, - "bytes": 38106, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /images/bg.jpg", "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, "destination": { - "port": 80, - "bytes": 38106, - "domain": "www.test.co", - "ip": "10.100.0.29" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 9672, + "ip": "81.2.69.144", + "packets": 45 }, "source": { - "port": 1541, - "bytes": 385, - "ip": "35.244.92.47" - }, - "type": "http", - "url": { - "path": "/images/bg.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/bg.jpg" + "port": 60098, + "bytes": 547639, + "ip": "10.100.0.29", + "packets": 66 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:Awz6GFqwC6DyvBuaB+al4It7yAY=", - "bytes": 38491, + "community_id": "1:vX6oXjJfSEwPiJ0pwvMzUK719S8=", + "bytes": 557311, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 111 }, "cloud": { "availability_zone": "europe-west2-c", @@ -1813,24 +324,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:12.734Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/assets/css/main.css" - ], - "ip": [ - "35.244.92.47", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -1855,56 +356,31 @@ ], "architecture": "x86_64" }, - "client": { - "port": 1541, - "bytes": 385, - "ip": "35.244.92.47" - }, - "http": { - "request": { - "referrer": "http://www.test.co/assets/css/main.css", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 385 - }, - "response": { - "headers": { - "content-length": 37864, - "content-type": "image/jpeg" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "image/jpeg", - "bytes": 38106, - "body": { - "bytes": 37864 - } - }, - "version": "1.1" - }, "event": { - "duration": 113000, + "duration": 60736169344, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:14Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:12.734Z", - "end": "2024-06-21T11:16:12.734Z", + "start": "2024-07-01T10:48:40.363Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDMLquwE" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827320, + "end": 1719827381 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -1912,12 +388,6 @@ } }, { - "server": { - "port": 80, - "bytes": 72153, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -1925,40 +395,48 @@ "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /assets/fonts/fontawesome-webfont.woff2", "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, "destination": { - "port": 80, - "bytes": 72153, - "ip": "10.100.0.29", - "domain": "www.test.co" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 1954, + "ip": "81.2.69.144", + "packets": 6 }, "source": { - "port": 1539, - "bytes": 402, - "ip": "35.244.92.47" - }, - "type": "http", - "url": { - "path": "/assets/fonts/fontawesome-webfont.woff2", - "extension": "woff2", - "scheme": "http", - "query": "v=4.6.3", - "domain": "www.test.co", - "full": "http://www.test.co/assets/fonts/fontawesome-webfont.woff2?v=4.6.3" + "port": 55960, + "bytes": 7775, + "ip": "10.100.0.29", + "packets": 7 }, + "type": "flow", "network": { - "community_id": "1:gPM3VQvPa/AoaH6Pynie+9K8/a4=", - "protocol": "http", - "bytes": 72555, + "community_id": "1:rkJGR0qjRmD5vrCpbbdAiOnhiQM=", + "bytes": 9729, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 13 }, "cloud": { "availability_zone": "europe-west2-c", @@ -1967,12 +445,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "service": { - "name": "GCE" - }, "machine": { "type": "t2d-standard-1" }, + "service": { + "name": "GCE" + }, "project": { "id": "elastic-sa" }, @@ -1981,24 +459,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:12.783Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/assets/css/font-awesome.min.css" - ], - "ip": [ - "35.244.92.47", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -2006,8 +474,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "type": "linux", "family": "debian", + "type": "linux", "version": "11 (bullseye)", "platform": "debian" }, @@ -2023,56 +491,31 @@ ], "architecture": "x86_64" }, - "client": { - "port": 1539, - "bytes": 402, - "ip": "35.244.92.47" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "referrer": "http://www.test.co/assets/css/font-awesome.min.css", - "method": "GET", - "bytes": 402 - }, - "response": { - "headers": { - "content-length": 71896, - "content-type": "application/octet-stream" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/octet-stream", - "bytes": 72153, - "body": { - "bytes": 71896 - } - }, - "version": "1.1" - }, "event": { - "duration": 61000, + "duration": 60735918914, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:14Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:12.783Z", - "end": "2024-06-21T11:16:12.783Z", + "start": "2024-07-01T10:48:40.364Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDJjauwE" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827320, + "end": 1719827381 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -2080,51 +523,37 @@ } }, { - "server": { - "port": 80, - "bytes": 4137, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /", + "destination": { + "port": 6789, + "bytes": 1176, + "ip": "127.0.0.1", + "packets": 15 + }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, - "destination": { - "port": 80, - "bytes": 4137, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "source": { - "port": 19456, - "bytes": 419, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/" + "port": 48904, + "bytes": 1479, + "ip": "127.0.0.1", + "packets": 12 }, + "type": "flow", "network": { - "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", - "protocol": "http", - "bytes": 4556, + "community_id": "1:8z8pjOEt4+6YMtJjX7lUfpXgVgw=", + "bytes": 2655, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 27 }, "cloud": { "availability_zone": "europe-west2-c", @@ -2147,23 +576,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:10.631Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "hosts": [ - "www.test.co" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -2171,8 +591,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "type": "linux", "family": "debian", + "type": "linux", "version": "11 (bullseye)", "platform": "debian" }, @@ -2188,55 +608,31 @@ ], "architecture": "x86_64" }, - "client": { - "port": 19456, - "bytes": 419, - "ip": "34.86.203.82" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 419 - }, - "response": { - "headers": { - "content-length": 3875, - "content-type": "text/html" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "text/html", - "bytes": 4137, - "body": { - "bytes": 3875 - } - }, - "version": "1.1" - }, "event": { - "duration": 477000, + "duration": 65343896149, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:10.631Z", - "end": "2024-06-21T11:16:10.632Z", + "start": "2024-07-01T10:48:40.364Z", + "action": "network_flow", + "end": "2024-07-01T10:49:45.708Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAQi/hRo" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827320, + "end": 1719827385 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -2244,12 +640,6 @@ } }, { - "server": { - "port": 80, - "bytes": 10306, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -2257,13 +647,29 @@ "type": "packetbeat", "version": "8.9.1" }, - "method": "GET", - "query": "GET /images/pic01.jpg", "destination": { - "port": 80, - "bytes": 10306, - "domain": "www.test.co", - "ip": "10.100.0.29" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 7821, + "ip": "81.2.69.144", + "packets": 30 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -2271,25 +677,18 @@ "snapshot": false }, "source": { - "port": 19458, - "bytes": 369, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/images/pic01.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/pic01.jpg" + "port": 45176, + "bytes": 332993, + "ip": "10.100.0.29", + "packets": 49 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:19gScwFqXOlar3be22Vn5xuAauQ=", - "bytes": 10675, + "community_id": "1:rDoUGTpaonfSKgfFy8xvyps5opI=", + "bytes": 340814, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 79 }, "cloud": { "availability_zone": "europe-west2-c", @@ -2298,12 +697,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, "service": { "name": "GCE" }, + "machine": { + "type": "t2d-standard-1" + }, "project": { "id": "elastic-sa" }, @@ -2312,24 +711,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:10.792Z", - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -2337,8 +726,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "type": "linux", "family": "debian", + "type": "linux", "version": "11 (bullseye)", "platform": "debian" }, @@ -2354,56 +743,31 @@ ], "architecture": "x86_64" }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 369 - }, - "response": { - "headers": { - "content-length": 10064, - "content-type": "image/jpeg" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "image/jpeg", - "bytes": 10306, - "body": { - "bytes": 10064 - } - }, - "version": "1.1" - }, - "client": { - "port": 19458, - "bytes": 369, - "ip": "34.86.203.82" - }, "event": { - "duration": 251000, + "duration": 59712159075, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:10.792Z", - "end": "2024-06-21T11:16:10.792Z", + "start": "2024-07-01T10:48:41.388Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDHiwuwE" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827321, + "end": 1719827381 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -2411,12 +775,6 @@ } }, { - "server": { - "port": 80, - "bytes": 32868, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -2424,39 +782,48 @@ "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /assets/css/main.css", - "destination": { - "port": 80, - "bytes": 32868, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 5471, + "ip": "81.2.69.144", + "packets": 20 + }, "source": { - "port": 19456, - "bytes": 326, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/assets/css/main.css", - "extension": "css", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/assets/css/main.css" + "port": 56928, + "bytes": 23897, + "ip": "10.100.0.29", + "packets": 21 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", - "bytes": 33194, + "community_id": "1:JimQNreW+sYThnNGTVx+lyRdLbo=", + "bytes": 29368, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 41 }, "cloud": { "availability_zone": "europe-west2-c", @@ -2479,24 +846,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:10.716Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -2509,11 +866,11 @@ "version": "11 (bullseye)", "platform": "debian" }, - "containerized": false, "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], + "containerized": false, "name": "webserver", "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ @@ -2521,56 +878,31 @@ ], "architecture": "x86_64" }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 326 - }, - "response": { - "headers": { - "content-length": 32628, - "content-type": "text/css" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "text/css", - "bytes": 32868, - "body": { - "bytes": 32628 - } - }, - "version": "1.1" - }, - "client": { - "port": 19456, - "bytes": 326, - "ip": "34.86.203.82" - }, "event": { - "duration": 84000, + "duration": 66879956683, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:10.716Z", - "end": "2024-06-21T11:16:10.716Z", + "start": "2024-07-01T10:48:41.388Z", + "action": "network_flow", + "end": "2024-07-01T10:49:48.268Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDGDeuwE" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827321, + "end": 1719827388 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -2578,26 +910,36 @@ } }, { - "server": { - "port": 80, - "bytes": 9145, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", "version": "8.9.1" }, - "method": "GET", - "query": "GET /images/pic02.jpg", "destination": { - "port": 80, - "bytes": 9145, - "ip": "10.100.0.29", - "domain": "www.test.co" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 12588, + "ip": "81.2.69.144", + "packets": 45 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -2605,25 +947,18 @@ "snapshot": false }, "source": { - "port": 19457, - "bytes": 369, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/images/pic02.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/pic02.jpg" + "port": 49588, + "bytes": 182639, + "ip": "10.100.0.29", + "packets": 82 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:ioQAxWbr9FPVUa+VsG4oHAJkdqg=", - "bytes": 9514, + "community_id": "1:nQ4W/+0XInOvc8X+dZywhVnJMxg=", + "bytes": 195227, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 127 }, "cloud": { "availability_zone": "europe-west2-c", @@ -2632,12 +967,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, "service": { "name": "GCE" }, + "machine": { + "type": "t2d-standard-1" + }, "project": { "id": "elastic-sa" }, @@ -2646,24 +981,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:10.795Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -2671,16 +996,16 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "family": "debian", "type": "linux", + "family": "debian", "version": "11 (bullseye)", "platform": "debian" }, - "containerized": false, "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], + "containerized": false, "name": "webserver", "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ @@ -2688,56 +1013,31 @@ ], "architecture": "x86_64" }, - "client": { - "port": 19457, - "bytes": 369, - "ip": "34.86.203.82" - }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 369 - }, - "response": { - "headers": { - "content-length": 8904, - "content-type": "image/jpeg" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "image/jpeg", - "bytes": 9145, - "body": { - "bytes": 8904 - } - }, - "version": "1.1" - }, "event": { - "duration": 41000, + "duration": 67392032290, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:10.795Z", - "end": "2024-06-21T11:16:10.795Z", + "start": "2024-07-01T10:48:41.900Z", + "action": "network_flow", + "end": "2024-07-01T10:49:49.292Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDLTBuwE" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827321, + "end": 1719827389 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -2745,12 +1045,6 @@ } }, { - "server": { - "port": 80, - "bytes": 9938, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -2758,13 +1052,11 @@ "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /images/pic03.jpg", "destination": { - "port": 80, - "bytes": 9938, - "domain": "www.test.co", - "ip": "10.100.0.29" + "port": 6791, + "bytes": 6833, + "ip": "127.0.0.1", + "packets": 7 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -2772,25 +1064,18 @@ "snapshot": false }, "source": { - "port": 19461, - "bytes": 369, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/images/pic03.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/pic03.jpg" + "port": 39856, + "bytes": 2310, + "ip": "127.0.0.1", + "packets": 14 }, + "type": "flow", "network": { - "community_id": "1:ggT7zC+LwNLXYYw3utRBpsMN+9w=", - "protocol": "http", - "bytes": 10307, + "community_id": "1:VFRc3lML+k0fLfF36gdrSCu5udg=", + "bytes": 9143, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 21 }, "cloud": { "availability_zone": "europe-west2-c", @@ -2813,24 +1098,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:10.796Z", - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -2838,8 +1113,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "family": "debian", "type": "linux", + "family": "debian", "version": "11 (bullseye)", "platform": "debian" }, @@ -2855,56 +1130,31 @@ ], "architecture": "x86_64" }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 369 - }, - "response": { - "headers": { - "content-length": 9697, - "content-type": "image/jpeg" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "image/jpeg", - "bytes": 9938, - "body": { - "bytes": 9697 - } - }, - "version": "1.1" - }, - "client": { - "port": 19461, - "bytes": 369, - "ip": "34.86.203.82" - }, "event": { - "duration": 202000, + "duration": 59712056664, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:10.796Z", - "end": "2024-06-21T11:16:10.796Z", + "start": "2024-07-01T10:48:42.412Z", + "action": "network_flow", + "end": "2024-07-01T10:49:42.124Z", "type": [ - "connection", - "protocol" + "connection" ], "category": [ "network" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYcasJs" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827322, + "end": 1719827382 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", @@ -2912,12 +1162,6 @@ } }, { - "server": { - "port": 80, - "bytes": 9338, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -2925,39 +1169,30 @@ "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /assets/js/skel.min.js", + "destination": { + "port": 80, + "bytes": 25278, + "ip": "169.254.169.254", + "packets": 5 + }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, - "destination": { - "port": 80, - "bytes": 9338, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, "source": { - "port": 19460, - "bytes": 313, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/assets/js/skel.min.js", - "extension": "js", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/assets/js/skel.min.js" + "port": 47598, + "bytes": 452, + "ip": "10.100.0.29", + "packets": 4 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:I2z0vpcqgfS252mqkW5mlrncpqY=", - "bytes": 9651, + "community_id": "1:ZA5ezPNh0MumdIPxY03oJDcyLd8=", + "bytes": 25730, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 9 }, "cloud": { "availability_zone": "europe-west2-c", @@ -2980,24 +1215,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:10.797Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -3022,56 +1247,31 @@ ], "architecture": "x86_64" }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 313 - }, - "response": { - "headers": { - "content-length": 9085, - "content-type": "application/javascript" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/javascript", - "bytes": 9338, - "body": { - "bytes": 9085 - } - }, - "version": "1.1" - }, - "client": { - "port": 19460, - "bytes": 313, - "ip": "34.86.203.82" - }, "event": { - "duration": 233000, + "duration": 61759622403, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:10.797Z", - "end": "2024-06-21T11:16:10.797Z", + "start": "2024-07-01T10:48:42.924Z", + "action": "network_flow", + "end": "2024-07-01T10:49:44.684Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdqf6p/u65UAA" }, - "status": "OK", "_conf": { + "event": { + "start": 1719827322, + "end": 1719827384 + }, "endace_url": "https://test.test.local", "endace_datasources": "tag:rotation-file", "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json index 41ecb814ea2..3f6cd30e700 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json @@ -1,24 +1,18 @@ { "expected": [ { - "server": { - "port": 80, - "bytes": 374, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", "version": "8.9.1" }, - "method": "GET", - "query": "GET /.env", "destination": { - "port": 80, - "bytes": 374, - "ip": "10.100.0.29" + "port": 48866, + "bytes": 1317, + "ip": "127.0.0.1", + "packets": 12 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -26,25 +20,18 @@ "snapshot": false }, "source": { - "port": 46324, - "bytes": 230, - "ip": "57.129.23.166" - }, - "type": "http", - "url": { - "path": "/.env", - "extension": "env", - "scheme": "http", - "domain": "34.147.158.4", - "full": "http://34.147.158.4/.env" + "port": 6789, + "bytes": 1108, + "ip": "127.0.0.1", + "packets": 14 }, + "type": "flow", "network": { - "community_id": "1:SUrUlAjDJgBojipINaXvE82MrcU=", - "protocol": "http", - "bytes": 604, + "community_id": "1:RCi572y4gqQ+7LFlqkPsn1Xfa+0=", + "bytes": 2425, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 26 }, "cloud": { "availability_zone": "europe-west2-c", @@ -67,21 +54,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:18:18.358Z", - "related": { - "ip": [ - "57.129.23.166", - "10.100.0.29", - "34.147.158.4" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -94,11 +74,11 @@ "version": "11 (bullseye)", "platform": "debian" }, + "containerized": false, "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], - "containerized": false, "name": "webserver", "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ @@ -106,101 +86,78 @@ ], "architecture": "x86_64" }, - "client": { - "port": 46324, - "bytes": 230, - "ip": "57.129.23.166" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 230 - }, - "response": { - "headers": { - "content-length": 177, - "content-type": "text/html" - }, - "status_phrase": "not found", - "status_code": 404, - "mime_type": "text/html", - "bytes": 374, - "body": { - "bytes": 177 - } - }, - "version": "1.1" - }, "event": { - "duration": 506000, + "duration": 64831956254, "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:19Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:18:18.358Z", - "end": "2024-06-21T11:18:18.359Z", - "type": [ - "connection", - "protocol" - ], + "start": "2024-07-01T10:48:39.852Z", + "action": "network_flow", + "end": "2024-07-01T10:49:44.684Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830919852&end=1719830384684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", "category": [ "network" ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" + "type": [ + "connection" + ], + "dataset": "endace.flow" }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYUa4r4" + } }, { - "server": { - "port": 80, - "bytes": 716, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "POST", - "query": "POST /", "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, "destination": { - "port": 80, - "bytes": 716, - "ip": "10.100.0.29" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 680, + "ip": "81.2.69.144", + "packets": 10 }, "source": { - "port": 46390, - "bytes": 316, - "ip": "57.129.23.166" - }, - "type": "http", - "url": { - "path": "/", - "scheme": "http", - "query": "0x%5B%5D=androxgh0st", - "domain": "34.147.158.4", - "full": "http://34.147.158.4/?0x%5B%5D=androxgh0st" + "port": 56370, + "bytes": 5211, + "ip": "10.100.0.29", + "packets": 10 }, + "type": "flow", "network": { - "community_id": "1:2X7Vc6YqRE4tl8APECPM4vuvaMA=", - "protocol": "http", - "bytes": 1032, + "community_id": "1:TwdqE0w1aE72YUTaajguLj4qUns=", + "bytes": 5891, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 20 }, "cloud": { "availability_zone": "europe-west2-c", @@ -209,12 +166,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "service": { - "name": "GCE" - }, "machine": { "type": "t2d-standard-1" }, + "service": { + "name": "GCE" + }, "project": { "id": "elastic-sa" }, @@ -223,21 +180,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:18:18.416Z", - "related": { - "ip": [ - "57.129.23.166", - "10.100.0.29", - "34.147.158.4" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -245,8 +195,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "type": "linux", "family": "debian", + "type": "linux", "version": "11 (bullseye)", "platform": "debian" }, @@ -262,71 +212,34 @@ ], "architecture": "x86_64" }, - "http": { - "request": { - "headers": { - "content-length": 20, - "content-type": "application/x-www-form-urlencoded" - }, - "method": "POST", - "bytes": 316, - "body": { - "bytes": 20 - } - }, - "response": { - "headers": { - "content-length": 559, - "content-type": "text/html" - }, - "status_code": 405, - "status_phrase": "not allowed", - "mime_type": "text/html", - "bytes": 716, - "body": { - "bytes": 559 - } - }, - "version": "1.1" - }, - "client": { - "port": 46390, - "bytes": 316, - "ip": "57.129.23.166" - }, "event": { - "duration": 238000, + "duration": 60223908451, "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:19Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:18:18.416Z", - "end": "2024-06-21T11:18:18.417Z", - "type": [ - "connection", - "protocol" - ], + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830919852&end=1719830380076&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:39.852Z", + "action": "network_flow", + "end": "2024-07-01T10:49:40.076Z", "category": [ "network" ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" + "type": [ + "connection" + ], + "dataset": "endace.flow" }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" + } }, { - "server": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, "elastic_agent": { @@ -335,25 +248,42 @@ "snapshot": false }, "destination": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 9672, + "ip": "81.2.69.144", + "packets": 45 }, "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "type": "http", - "error": { - "message": "Unmatched response" + "port": 60098, + "bytes": 547639, + "ip": "10.100.0.29", + "packets": 66 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 25084, + "community_id": "1:vX6oXjJfSEwPiJ0pwvMzUK719S8=", + "bytes": 557311, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 111 }, "cloud": { "availability_zone": "europe-west2-c", @@ -376,20 +306,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:18:18.465Z", - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -397,8 +321,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "family": "debian", "type": "linux", + "family": "debian", "version": "11 (bullseye)", "platform": "debian" }, @@ -414,48 +338,29 @@ ], "architecture": "x86_64" }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, "event": { + "duration": 60736169344, "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:19Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "end": "2024-06-21T11:18:18.465Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830920363&end=1719830381100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:40.363Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http", - "reference": "" + "dataset": "endace.flow" }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDMLquwE" + } }, { - "server": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -469,25 +374,42 @@ "snapshot": false }, "destination": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 1954, + "ip": "81.2.69.144", + "packets": 6 }, "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" + "port": 55960, + "bytes": 7775, + "ip": "10.100.0.29", + "packets": 7 }, - "type": "http", + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "bytes": 25084, + "community_id": "1:rkJGR0qjRmD5vrCpbbdAiOnhiQM=", + "bytes": 9729, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 13 }, "cloud": { "availability_zone": "europe-west2-c", @@ -496,12 +418,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "service": { - "name": "GCE" - }, "machine": { "type": "t2d-standard-1" }, + "service": { + "name": "GCE" + }, "project": { "id": "elastic-sa" }, @@ -510,20 +432,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:18:15.709Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -531,8 +447,8 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "type": "linux", "family": "debian", + "type": "linux", "version": "11 (bullseye)", "platform": "debian" }, @@ -548,47 +464,29 @@ ], "architecture": "x86_64" }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, "event": { + "duration": 60735918914, "agent_id_status": "verified", - "ingested": "2024-06-21T11:18:17Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "end": "2024-06-21T11:18:15.709Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830920364&end=1719830381100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:40.364Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http", - "reference": "" + "dataset": "endace.flow" }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDJjauwE" + } }, { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -596,11 +494,11 @@ "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /computeMetadata/v1//", "destination": { - "port": 80, - "ip": "169.254.169.254" + "port": 6789, + "bytes": 1176, + "ip": "127.0.0.1", + "packets": 15 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -608,28 +506,18 @@ "snapshot": false }, "source": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "error": { - "message": "Unmatched request" - }, - "type": "http", - "url": { - "path": "/computeMetadata/v1//", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + "port": 48904, + "bytes": 1479, + "ip": "127.0.0.1", + "packets": 12 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 228, + "community_id": "1:8z8pjOEt4+6YMtJjX7lUfpXgVgw=", + "bytes": 2655, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 27 }, "cloud": { "availability_zone": "europe-west2-c", @@ -652,20 +540,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:17:18.451Z", - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -690,58 +572,59 @@ ], "architecture": "x86_64" }, - "client": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 228 - }, - "version": "1.1" - }, "event": { + "duration": 65343896149, "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:32Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:17:18.451Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830920364&end=1719830385708&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", + "start": "2024-07-01T10:48:40.364Z", + "action": "network_flow", + "end": "2024-07-01T10:49:45.708Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http", - "reference": "" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Go-http-client/1.1" - }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAQi/hRo" + } }, { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", "version": "8.9.1" }, - "method": "GET", - "query": "GET /computeMetadata/v1/", "destination": { - "port": 80, - "ip": "169.254.169.254" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 7821, + "ip": "81.2.69.144", + "packets": 30 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -749,28 +632,18 @@ "snapshot": false }, "source": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, - "error": { - "message": "Unmatched request" - }, - "type": "http", - "url": { - "path": "/computeMetadata/v1/", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + "port": 45176, + "bytes": 332993, + "ip": "10.100.0.29", + "packets": 49 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "bytes": 227, + "community_id": "1:rDoUGTpaonfSKgfFy8xvyps5opI=", + "bytes": 340814, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 79 }, "cloud": { "availability_zone": "europe-west2-c", @@ -779,12 +652,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, "service": { "name": "GCE" }, + "machine": { + "type": "t2d-standard-1" + }, "project": { "id": "elastic-sa" }, @@ -793,20 +666,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:17:15.695Z", - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -831,52 +698,34 @@ ], "architecture": "x86_64" }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 227 - }, - "version": "1.1" - }, - "client": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, "event": { + "duration": 59712159075, "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:32Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:17:15.695Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830921388&end=1719830381100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:41.388Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http", - "reference": "" + "dataset": "endace.flow" }, - "user_agent": { - "original": "Go-http-client/1.1" - }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDHiwuwE" + } }, { - "server": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, "elastic_agent": { @@ -885,25 +734,42 @@ "snapshot": false }, "destination": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 5471, + "ip": "81.2.69.144", + "packets": 20 }, "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" + "port": 56928, + "bytes": 23897, + "ip": "10.100.0.29", + "packets": 21 }, - "type": "http", + "type": "flow", "network": { - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "protocol": "http", - "bytes": 25084, + "community_id": "1:JimQNreW+sYThnNGTVx+lyRdLbo=", + "bytes": 29368, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 41 }, "cloud": { "availability_zone": "europe-west2-c", @@ -926,20 +792,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:17:18.450Z", - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -947,16 +807,16 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "type": "linux", "family": "debian", + "type": "linux", "version": "11 (bullseye)", "platform": "debian" }, - "containerized": false, "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], + "containerized": false, "name": "webserver", "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ @@ -964,48 +824,29 @@ ], "architecture": "x86_64" }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, "event": { + "duration": 66879956683, "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:19Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "end": "2024-06-21T11:17:18.450Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830921388&end=1719830388268&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:41.388Z", + "action": "network_flow", + "end": "2024-07-01T10:49:48.268Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http", - "reference": "" + "dataset": "endace.flow" }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDGDeuwE" + } }, { - "server": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -1013,31 +854,48 @@ "type": "packetbeat", "version": "8.9.1" }, + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 12588, + "ip": "81.2.69.144", + "packets": 45 + }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "version": "8.9.1", "snapshot": false }, - "destination": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" + "port": 49588, + "bytes": 182639, + "ip": "10.100.0.29", + "packets": 82 }, - "type": "http", + "type": "flow", "network": { - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "protocol": "http", - "bytes": 25084, + "community_id": "1:nQ4W/+0XInOvc8X+dZywhVnJMxg=", + "bytes": 195227, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 127 }, "cloud": { "availability_zone": "europe-west2-c", @@ -1046,12 +904,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, "service": { "name": "GCE" }, + "machine": { + "type": "t2d-standard-1" + }, "project": { "id": "elastic-sa" }, @@ -1060,20 +918,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:17:15.695Z", - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -1081,16 +933,16 @@ "kernel": "5.10.0-27-cloud-amd64", "codename": "bullseye", "name": "Debian GNU/Linux", - "family": "debian", "type": "linux", + "family": "debian", "version": "11 (bullseye)", "platform": "debian" }, - "containerized": false, "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], + "containerized": false, "name": "webserver", "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ @@ -1098,59 +950,41 @@ ], "architecture": "x86_64" }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, "event": { + "duration": 67392032290, "agent_id_status": "verified", - "ingested": "2024-06-21T11:17:16Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "end": "2024-06-21T11:17:15.695Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830921900&end=1719830389292&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:41.900Z", + "action": "network_flow", + "end": "2024-07-01T10:49:49.292Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http", - "reference": "" + "dataset": "endace.flow" }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDLTBuwE" + } }, { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /computeMetadata/v1//", "destination": { - "port": 80, - "ip": "169.254.169.254" + "port": 6791, + "bytes": 6833, + "ip": "127.0.0.1", + "packets": 7 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -1158,28 +992,18 @@ "snapshot": false }, "source": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "error": { - "message": "Unmatched request" - }, - "type": "http", - "url": { - "path": "/computeMetadata/v1//", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1//?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + "port": 39856, + "bytes": 2310, + "ip": "127.0.0.1", + "packets": 14 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 228, + "community_id": "1:VFRc3lML+k0fLfF36gdrSCu5udg=", + "bytes": 9143, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 21 }, "cloud": { "availability_zone": "europe-west2-c", @@ -1202,20 +1026,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:18.436Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -1240,46 +1058,29 @@ ], "architecture": "x86_64" }, - "client": { - "port": 35176, - "bytes": 228, - "ip": "10.100.0.29" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 228 - }, - "version": "1.1" - }, "event": { + "duration": 59712056664, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:33Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:18.436Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830922412&end=1719830382124&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", + "start": "2024-07-01T10:48:42.412Z", + "action": "network_flow", + "end": "2024-07-01T10:49:42.124Z", + "type": [ + "connection" + ], "category": [ "network" ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Go-http-client/1.1" + "dataset": "endace.flow" }, - "status": "Error" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYcasJs" + } }, { - "server": { - "port": 80, - "ip": "169.254.169.254" - }, "agent": { "name": "webserver", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -1287,11 +1088,11 @@ "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "method": "GET", - "query": "GET /computeMetadata/v1/", "destination": { "port": 80, - "ip": "169.254.169.254" + "bytes": 25278, + "ip": "169.254.169.254", + "packets": 5 }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", @@ -1299,28 +1100,18 @@ "snapshot": false }, "source": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, - "type": "http", - "error": { - "message": "Unmatched request" - }, - "url": { - "path": "/computeMetadata/v1/", - "scheme": "http", - "domain": "169.254.169.254", - "query": "alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true", - "full": "http://169.254.169.254/computeMetadata/v1/?alt=json&last_etag=6797782f559e8a44&recursive=true&timeout_sec=60&wait_for_change=true" + "port": 47598, + "bytes": 452, + "ip": "10.100.0.29", + "packets": 4 }, + "type": "flow", "network": { - "protocol": "http", - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "bytes": 227, + "community_id": "1:ZA5ezPNh0MumdIPxY03oJDcyLd8=", + "bytes": 25730, "transport": "tcp", "type": "ipv4", - "direction": "ingress" + "packets": 9 }, "cloud": { "availability_zone": "europe-west2-c", @@ -1329,12 +1120,12 @@ "id": "5975790316485631173" }, "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, "service": { "name": "GCE" }, + "machine": { + "type": "t2d-standard-1" + }, "project": { "id": "elastic-sa" }, @@ -1343,20 +1134,14 @@ "id": "elastic-sa" } }, - "@timestamp": "2024-06-21T11:16:15.680Z", + "@timestamp": "2024-07-01T10:49:50.000Z", "ecs": { "version": "8.11.0" }, - "related": { - "ip": [ - "10.100.0.29", - "169.254.169.254" - ] - }, "data_stream": { "namespace": "webserver", "type": "logs", - "dataset": "network_traffic.http" + "dataset": "endace.flow" }, "host": { "hostname": "webserver", @@ -1381,1602 +1166,27 @@ ], "architecture": "x86_64" }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 227 - }, - "version": "1.1" - }, - "client": { - "port": 35164, - "bytes": 227, - "ip": "10.100.0.29" - }, "event": { + "duration": 61759622403, "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:33Z", + "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "start": "2024-06-21T11:16:15.680Z", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830922924&end=1719830384684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%26169.254.169.254", + "start": "2024-07-01T10:48:42.924Z", + "action": "network_flow", + "end": "2024-07-01T10:49:44.684Z", "category": [ "network" ], "type": [ - "connection", - "protocol" + "connection" ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Go-http-client/1.1" - }, - "status": "Error" - }, - { - "server": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "destination": { - "port": 35176, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" - }, - "type": "http", - "network": { - "protocol": "http", - "community_id": "1:njSdxqEp4qgf9e7i1wsAk4CMMN0=", - "bytes": 25084, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, - "service": { - "name": "GCE" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:18.434Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "containerized": false, - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:19Z", - "kind": "event", - "end": "2024-06-21T11:16:18.434Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "status": "Error" - }, - { - "server": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "destination": { - "port": 35164, - "bytes": 25084, - "ip": "10.100.0.29" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 80, - "ip": "169.254.169.254" - }, - "error": { - "message": "Unmatched response" - }, - "type": "http", - "network": { - "community_id": "1:KM3GdIA1KtInDzMvpMBTvN6gFis=", - "protocol": "http", - "bytes": 25084, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:15.679Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "ip": [ - "169.254.169.254", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 80, - "ip": "169.254.169.254" - }, - "http": { - "response": { - "headers": { - "content-length": 24794, - "content-type": "application/json" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/json", - "bytes": 25084, - "body": { - "bytes": 24794 - } - } - }, - "event": { - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:16Z", - "kind": "event", - "end": "2024-06-21T11:16:15.679Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "status": "Error" - }, - { - "server": { - "port": 80, - "bytes": 38106, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /images/bg.jpg", - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 80, - "bytes": 38106, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, - "source": { - "port": 1541, - "bytes": 385, - "ip": "35.244.92.47" - }, - "type": "http", - "url": { - "path": "/images/bg.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/bg.jpg" - }, - "network": { - "protocol": "http", - "community_id": "1:Awz6GFqwC6DyvBuaB+al4It7yAY=", - "bytes": 38491, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:12.734Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/assets/css/main.css" - ], - "ip": [ - "35.244.92.47", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 1541, - "bytes": 385, - "ip": "35.244.92.47" - }, - "http": { - "request": { - "referrer": "http://www.test.co/assets/css/main.css", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 385 - }, - "response": { - "headers": { - "content-length": 37864, - "content-type": "image/jpeg" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "image/jpeg", - "bytes": 38106, - "body": { - "bytes": 37864 - } - }, - "version": "1.1" - }, - "event": { - "duration": 113000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:14Z", - "kind": "event", - "start": "2024-06-21T11:16:12.734Z", - "end": "2024-06-21T11:16:12.734Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" - }, - "status": "OK" - }, - { - "server": { - "port": 80, - "bytes": 72153, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /assets/fonts/fontawesome-webfont.woff2", - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 80, - "bytes": 72153, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "source": { - "port": 1539, - "bytes": 402, - "ip": "35.244.92.47" - }, - "type": "http", - "url": { - "path": "/assets/fonts/fontawesome-webfont.woff2", - "extension": "woff2", - "scheme": "http", - "query": "v=4.6.3", - "domain": "www.test.co", - "full": "http://www.test.co/assets/fonts/fontawesome-webfont.woff2?v=4.6.3" - }, - "network": { - "community_id": "1:gPM3VQvPa/AoaH6Pynie+9K8/a4=", - "protocol": "http", - "bytes": 72555, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:12.783Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/assets/css/font-awesome.min.css" - ], - "ip": [ - "35.244.92.47", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 1539, - "bytes": 402, - "ip": "35.244.92.47" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "referrer": "http://www.test.co/assets/css/font-awesome.min.css", - "method": "GET", - "bytes": 402 - }, - "response": { - "headers": { - "content-length": 71896, - "content-type": "application/octet-stream" - }, - "status_code": 200, - "status_phrase": "ok", - "mime_type": "application/octet-stream", - "bytes": 72153, - "body": { - "bytes": 71896 - } - }, - "version": "1.1" - }, - "event": { - "duration": 61000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:14Z", - "kind": "event", - "start": "2024-06-21T11:16:12.783Z", - "end": "2024-06-21T11:16:12.783Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" - }, - "status": "OK" - }, - { - "server": { - "port": 80, - "bytes": 4137, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /", - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 80, - "bytes": 4137, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "source": { - "port": 19456, - "bytes": 419, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/" - }, - "network": { - "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", - "protocol": "http", - "bytes": 4556, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:10.631Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "hosts": [ - "www.test.co" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 19456, - "bytes": 419, - "ip": "34.86.203.82" - }, - "http": { - "request": { - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 419 - }, - "response": { - "headers": { - "content-length": 3875, - "content-type": "text/html" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "text/html", - "bytes": 4137, - "body": { - "bytes": 3875 - } - }, - "version": "1.1" - }, - "event": { - "duration": 477000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", - "kind": "event", - "start": "2024-06-21T11:16:10.631Z", - "end": "2024-06-21T11:16:10.632Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" - }, - "status": "OK" - }, - { - "server": { - "port": 80, - "bytes": 10306, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "type": "packetbeat", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /images/pic01.jpg", - "destination": { - "port": 80, - "bytes": 10306, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 19458, - "bytes": 369, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/images/pic01.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/pic01.jpg" - }, - "network": { - "protocol": "http", - "community_id": "1:19gScwFqXOlar3be22Vn5xuAauQ=", - "bytes": 10675, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, - "service": { - "name": "GCE" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:10.792Z", - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 369 - }, - "response": { - "headers": { - "content-length": 10064, - "content-type": "image/jpeg" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "image/jpeg", - "bytes": 10306, - "body": { - "bytes": 10064 - } - }, - "version": "1.1" - }, - "client": { - "port": 19458, - "bytes": 369, - "ip": "34.86.203.82" - }, - "event": { - "duration": 251000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", - "kind": "event", - "start": "2024-06-21T11:16:10.792Z", - "end": "2024-06-21T11:16:10.792Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" - }, - "status": "OK" - }, - { - "server": { - "port": 80, - "bytes": 32868, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /assets/css/main.css", - "destination": { - "port": 80, - "bytes": 32868, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 19456, - "bytes": 326, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/assets/css/main.css", - "extension": "css", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/assets/css/main.css" - }, - "network": { - "protocol": "http", - "community_id": "1:yJ0rbgFBC3faJY1GlmrXdwvTHUg=", - "bytes": 33194, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:10.716Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 326 - }, - "response": { - "headers": { - "content-length": 32628, - "content-type": "text/css" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "text/css", - "bytes": 32868, - "body": { - "bytes": 32628 - } - }, - "version": "1.1" - }, - "client": { - "port": 19456, - "bytes": 326, - "ip": "34.86.203.82" - }, - "event": { - "duration": 84000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", - "kind": "event", - "start": "2024-06-21T11:16:10.716Z", - "end": "2024-06-21T11:16:10.716Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" - }, - "status": "OK" - }, - { - "server": { - "port": 80, - "bytes": 9145, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /images/pic02.jpg", - "destination": { - "port": 80, - "bytes": 9145, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 19457, - "bytes": 369, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/images/pic02.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/pic02.jpg" - }, - "network": { - "protocol": "http", - "community_id": "1:ioQAxWbr9FPVUa+VsG4oHAJkdqg=", - "bytes": 9514, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "machine": { - "type": "t2d-standard-1" - }, - "service": { - "name": "GCE" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:10.795Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "client": { - "port": 19457, - "bytes": 369, - "ip": "34.86.203.82" - }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 369 - }, - "response": { - "headers": { - "content-length": 8904, - "content-type": "image/jpeg" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "image/jpeg", - "bytes": 9145, - "body": { - "bytes": 8904 - } - }, - "version": "1.1" - }, - "event": { - "duration": 41000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", - "kind": "event", - "start": "2024-06-21T11:16:10.795Z", - "end": "2024-06-21T11:16:10.795Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" - }, - "status": "OK" - }, - { - "server": { - "port": 80, - "bytes": 9938, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /images/pic03.jpg", - "destination": { - "port": 80, - "bytes": 9938, - "domain": "www.test.co", - "ip": "10.100.0.29" - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 19461, - "bytes": 369, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/images/pic03.jpg", - "extension": "jpg", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/images/pic03.jpg" - }, - "network": { - "community_id": "1:ggT7zC+LwNLXYYw3utRBpsMN+9w=", - "protocol": "http", - "bytes": 10307, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:10.796Z", - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, - "ecs": { - "version": "8.11.0" - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 369 - }, - "response": { - "headers": { - "content-length": 9697, - "content-type": "image/jpeg" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "image/jpeg", - "bytes": 9938, - "body": { - "bytes": 9697 - } - }, - "version": "1.1" - }, - "client": { - "port": 19461, - "bytes": 369, - "ip": "34.86.203.82" - }, - "event": { - "duration": 202000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", - "kind": "event", - "start": "2024-06-21T11:16:10.796Z", - "end": "2024-06-21T11:16:10.796Z", - "type": [ - "connection", - "protocol" - ], - "category": [ - "network" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" - }, - "status": "OK" - }, - { - "server": { - "port": 80, - "bytes": 9338, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" - }, - "method": "GET", - "query": "GET /assets/js/skel.min.js", - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "port": 80, - "bytes": 9338, - "ip": "10.100.0.29", - "domain": "www.test.co" - }, - "source": { - "port": 19460, - "bytes": 313, - "ip": "34.86.203.82" - }, - "type": "http", - "url": { - "path": "/assets/js/skel.min.js", - "extension": "js", - "scheme": "http", - "domain": "www.test.co", - "full": "http://www.test.co/assets/js/skel.min.js" - }, - "network": { - "protocol": "http", - "community_id": "1:I2z0vpcqgfS252mqkW5mlrncpqY=", - "bytes": 9651, - "transport": "tcp", - "type": "ipv4", - "direction": "ingress" - }, - "cloud": { - "availability_zone": "europe-west2-c", - "instance": { - "name": "jamesgarside-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" - }, - "machine": { - "type": "t2d-standard-1" - }, - "project": { - "id": "elastic-sa" - }, - "region": "europe-west2", - "account": { - "id": "elastic-sa" - } - }, - "@timestamp": "2024-06-21T11:16:10.797Z", - "ecs": { - "version": "8.11.0" - }, - "related": { - "hosts": [ - "www.test.co", - "http://www.test.co/" - ], - "ip": [ - "34.86.203.82", - "10.100.0.29" - ] - }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "network_traffic.http" - }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" - }, - "http": { - "request": { - "referrer": "http://www.test.co/", - "headers": { - "content-length": 0 - }, - "method": "GET", - "bytes": 313 - }, - "response": { - "headers": { - "content-length": 9085, - "content-type": "application/javascript" - }, - "status_phrase": "ok", - "status_code": 200, - "mime_type": "application/javascript", - "bytes": 9338, - "body": { - "bytes": 9085 - } - }, - "version": "1.1" - }, - "client": { - "port": 19460, - "bytes": 313, - "ip": "34.86.203.82" - }, - "event": { - "duration": 233000, - "agent_id_status": "verified", - "ingested": "2024-06-21T11:16:11Z", - "kind": "event", - "start": "2024-06-21T11:16:10.797Z", - "end": "2024-06-21T11:16:10.797Z", - "category": [ - "network" - ], - "type": [ - "connection", - "protocol" - ], - "dataset": "network_traffic.http", - "reference": "" - }, - "user_agent": { - "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36 Elastic/Synthetics" + "dataset": "endace.flow" }, - "status": "OK" + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdqf6p/u65UAA" + } } ] } \ No newline at end of file From b4bb6a8da4a14c6a966a442643e54fcef9905ddb Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 1 Jul 2024 12:58:11 +0100 Subject: [PATCH 05/23] Modified owner in manifest --- packages/endace/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/endace/manifest.yml b/packages/endace/manifest.yml index 929632bf8ee..09d88daff8c 100644 --- a/packages/endace/manifest.yml +++ b/packages/endace/manifest.yml @@ -96,5 +96,5 @@ agent: privileges: root: true owner: - github: elastic/integrations + github: elastic/sec-deployment-and-devices type: partner From 76544dbd7d8732501b2da1ea751d1667b949a8b9 Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 1 Jul 2024 13:48:27 +0100 Subject: [PATCH 06/23] Removed test data scripts --- .../endace/data_stream/flow/_dev/add_field.py | 71 ------------------- .../system/test-http-get-2k-file-config.yml | 2 +- .../test/system/test-icmp-2-pings-config.yml | 2 +- .../endace/data_stream/log/_dev/add_field.py | 48 ------------- .../_dev/test/system/test-netflow-config.yml | 1 - packages/endace/manifest.yml | 1 - 6 files changed, 2 insertions(+), 123 deletions(-) delete mode 100644 packages/endace/data_stream/flow/_dev/add_field.py delete mode 100644 packages/endace/data_stream/log/_dev/add_field.py diff --git a/packages/endace/data_stream/flow/_dev/add_field.py b/packages/endace/data_stream/flow/_dev/add_field.py deleted file mode 100644 index d6564a5cd47..00000000000 --- a/packages/endace/data_stream/flow/_dev/add_field.py +++ /dev/null @@ -1,71 +0,0 @@ -import json, os, collections -from datetime import datetime -import time - -events_path = os.getcwd() + "/data_stream/flow/_dev/test/pipeline/test-flow-events.json" -expected_events_path = os.getcwd() + "/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json" - -with open(events_path, 'r') as f: - events = json.load(f, object_pairs_hook=collections.OrderedDict) - -with open(expected_events_path, 'r') as ef: - expected_events = json.load(ef, object_pairs_hook=collections.OrderedDict) - - -def remove_metadata(): - new_events = {"events":[]} - for event in events['events']: - if '_source' in event: - new_events['events'].append(event['_source']) - - return new_events - -def process_events(): - for event in events['events']: - if '_conf' not in event: - event['_conf'] = {} - event['_conf']['event'] = {} - event['_conf']['endace_url'] = 'https://test.test.local' - event['_conf']['endace_datasources'] = 'tag:rotation-file' - event['_conf']['endace_tools'] = 'trafficOverTime_by_app,conversations_by_ipaddress' - event['_conf']['endace_lookback'] = 10 - - - # Convert event.start to epoch - if 'event' in event and 'start' in event['event']: - start_str = event['event']['start'] - # Assuming the date format is ISO 8601, e.g., "2023-01-01T00:00:00Z" - start_dt = datetime.strptime(start_str, "%Y-%m-%dT%H:%M:%S.%fZ") - event['_conf']['event']['start'] = int(time.mktime(start_dt.timetuple())) - - # Convert event.end to epoch - if 'event' in event and 'end' in event['event']: - end_str = event['event']['end'] - # Assuming the date format is ISO 8601, e.g., "2023-01-01T00:00:00Z" - end_dt = datetime.strptime(end_str, "%Y-%m-%dT%H:%M:%S.%fZ") - event['_conf']['event']['end'] = int(time.mktime(end_dt.timetuple())) - - -def process_expected_events(): - for event in expected_events['expected']: - if '_conf' in event: - del event['_conf'] - event['ecs']['version'] = "8.11.0" - # expected_events['expected'] = expected_events.pop('events') - - - -process_events() - -process_expected_events() - -# events = remove_metadata() -# Write Events -with open(events_path, 'w') as f: - json.dump(events, f, indent=4) - - -# Write Expected Events -with open(expected_events_path, 'w') as ef: - json.dump(expected_events, ef, indent=4) - diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml index 2cbfac50130..8ef53febd04 100644 --- a/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml +++ b/packages/endace/data_stream/flow/_dev/test/system/test-http-get-2k-file-config.yml @@ -4,4 +4,4 @@ input: packet data_stream: vars: period: '-1s' - endace_url: 'http://test.elastic.co' \ No newline at end of file + endace_url: 'http://test.elastic.co' diff --git a/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml b/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml index d288467b690..8011263401d 100644 --- a/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml +++ b/packages/endace/data_stream/flow/_dev/test/system/test-icmp-2-pings-config.yml @@ -5,4 +5,4 @@ data_stream: vars: timeout: '5s' period: '-1s' - endace_url: 'http://test.elastic.co' \ No newline at end of file + endace_url: 'http://test.elastic.co' diff --git a/packages/endace/data_stream/log/_dev/add_field.py b/packages/endace/data_stream/log/_dev/add_field.py deleted file mode 100644 index 03f94518a03..00000000000 --- a/packages/endace/data_stream/log/_dev/add_field.py +++ /dev/null @@ -1,48 +0,0 @@ -import json, os, collections, copy - - - -events_path = os.getcwd() + "/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json" -expected_events_path = os.getcwd() + "/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json" - -with open(events_path, 'r') as f: - events = json.load(f, object_pairs_hook=collections.OrderedDict) - -with open(expected_events_path, 'r') as ef: - expected_events = json.load(ef, object_pairs_hook=collections.OrderedDict) - - -# expected_events = copy.deepcopy(events) - -def process_events(): - for event in events['events']: - if '_conf' not in event: - event['_conf'] = {} - event['_conf']['endace_url'] = 'https://test.test.local' - event['_conf']['endace_datasources'] = 'tag:rotation-file' - event['_conf']['endace_tools'] = 'trafficOverTime_by_app,conversations_by_ipaddress' - event['_conf']['endace_lookback'] = 10 - - -def process_expected_events(): - for event in expected_events['expected']: - if '_conf' in event: - del event['_conf'] - # expected_events['expected'] = expected_events.pop('events') - - - -process_events() - -process_expected_events() - - -# Write Events -with open(events_path, 'w') as f: - json.dump(events, f, indent=4) - - -# Write Expected Events -with open(expected_events_path, 'w') as ef: - json.dump(expected_events, ef, indent=4) - diff --git a/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml b/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml index 80cb30b3000..edd4b1d7b20 100644 --- a/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml +++ b/packages/endace/data_stream/log/_dev/test/system/test-netflow-config.yml @@ -6,6 +6,5 @@ data_stream: host: 0.0.0.0 port: 2055 endace_url: 'http://test.elastic.co' - numeric_keyword_fields: - network.iana_number diff --git a/packages/endace/manifest.yml b/packages/endace/manifest.yml index 09d88daff8c..d5cb0ab1372 100644 --- a/packages/endace/manifest.yml +++ b/packages/endace/manifest.yml @@ -58,7 +58,6 @@ vars: required: true show_user: false default: "10" - policy_templates: - name: endace title: Endace Flow logs From 2ccdfd8222d08f4647bd728162a64948605dbb14 Mon Sep 17 00:00:00 2001 From: James Garside Date: Tue, 2 Jul 2024 18:08:27 +0100 Subject: [PATCH 07/23] Extended test coverage --- .../_dev/test/pipeline/test-flow-events.json | 18 ++++++ .../test-flow-events.json-expected.json | 57 ++++++++++++------- 2 files changed, 56 insertions(+), 19 deletions(-) diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json index 6ff73b1c9f2..d7270a02237 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json @@ -221,6 +221,14 @@ ], "architecture": "x86_64" }, + "observer": { + "hostname": "webserver", + "mac": [ + "42-01-0A-64-00-1D" + ], + "ip": ["10.100.0.29", + "fe80::4001:aff:fe64:1d"] + }, "event": { "duration": 60223908451, "agent_id_status": "verified", @@ -242,6 +250,8 @@ "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" }, "_conf": { + "map_to_ecs": true, + "geoip_enrich": true, "event": { "start": 1719827319, "end": 1719827380 @@ -377,6 +387,7 @@ "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDMLquwE" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827320, "end": 1719827381 @@ -512,6 +523,7 @@ "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDJjauwE" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827320, "end": 1719827381 @@ -629,6 +641,7 @@ "id": "EAT/////AP//////CP8AAAF/AAABfwAAAQi/hRo" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827320, "end": 1719827385 @@ -764,6 +777,7 @@ "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDHiwuwE" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827321, "end": 1719827381 @@ -899,6 +913,7 @@ "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDGDeuwE" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827321, "end": 1719827388 @@ -1034,6 +1049,7 @@ "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDLTBuwE" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827321, "end": 1719827389 @@ -1151,6 +1167,7 @@ "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYcasJs" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827322, "end": 1719827382 @@ -1268,6 +1285,7 @@ "id": "EAT/////AP//////CP8AAAEKZAAdqf6p/u65UAA" }, "_conf": { + "geoip_enrich": true, "event": { "start": 1719827322, "end": 1719827384 diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json index 3f6cd30e700..3fbaaae002f 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json @@ -129,8 +129,8 @@ "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.093, - "lat": 51.5088 + "lon": -0.0931, + "lat": 51.5142 }, "region_name": "England" }, @@ -151,7 +151,6 @@ "ip": "10.100.0.29", "packets": 10 }, - "type": "flow", "network": { "community_id": "1:TwdqE0w1aE72YUTaajguLj4qUns=", "bytes": 5891, @@ -212,6 +211,25 @@ ], "architecture": "x86_64" }, + "observer": { + "hostname": "webserver", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ] + }, + "related": { + "hosts": [ + "webserver" + ], + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ] + }, "event": { "duration": 60223908451, "agent_id_status": "verified", @@ -226,13 +244,14 @@ ], "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, - "flow": { - "final": false, - "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" - } + "network_traffic": { + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" + } + } }, { "agent": { @@ -255,8 +274,8 @@ "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.093, - "lat": 51.5088 + "lon": -0.0931, + "lat": 51.5142 }, "region_name": "England" }, @@ -381,8 +400,8 @@ "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.093, - "lat": 51.5088 + "lon": -0.0931, + "lat": 51.5142 }, "region_name": "England" }, @@ -610,8 +629,8 @@ "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.093, - "lat": 51.5088 + "lon": -0.0931, + "lat": 51.5142 }, "region_name": "England" }, @@ -741,8 +760,8 @@ "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.093, - "lat": 51.5088 + "lon": -0.0931, + "lat": 51.5142 }, "region_name": "England" }, @@ -862,8 +881,8 @@ "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.093, - "lat": 51.5088 + "lon": -0.0931, + "lat": 51.5142 }, "region_name": "England" }, From 03697e045c6779c32bec40cb2f3dc5b63cf31f38 Mon Sep 17 00:00:00 2001 From: James Garside Date: Thu, 4 Jul 2024 11:22:01 +0100 Subject: [PATCH 08/23] Update changelog.yml --- packages/endace/changelog.yml | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/packages/endace/changelog.yml b/packages/endace/changelog.yml index fe168b1461e..0d753a1ea15 100644 --- a/packages/endace/changelog.yml +++ b/packages/endace/changelog.yml @@ -1,16 +1,6 @@ # newer versions go on top -- version: "0.0.4" - changes: - - description: Initial draft of the package - type: enhancement - link: https://github.com/elastic/integrations/pull/1 # FIXME Replace with the real PR link -- version: "0.0.3" - changes: - - description: Initial draft of the package - type: enhancement - link: https://github.com/elastic/integrations/pull/1 # FIXME Replace with the real PR link - version: "0.0.1" changes: - description: Initial draft of the package type: enhancement - link: https://github.com/elastic/integrations/pull/1 # FIXME Replace with the real PR link + link: https://github.com/elastic/integrations/pull/10308 From ec2ddea3d10f79f38a170147d9d15e49b1b83efe Mon Sep 17 00:00:00 2001 From: James Garside Date: Thu, 4 Jul 2024 11:22:26 +0100 Subject: [PATCH 09/23] Update changelog.yml --- packages/endace/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/endace/changelog.yml b/packages/endace/changelog.yml index 0d753a1ea15..fc8030cfebb 100644 --- a/packages/endace/changelog.yml +++ b/packages/endace/changelog.yml @@ -1,5 +1,5 @@ # newer versions go on top -- version: "0.0.1" +- version: "0.1.0" changes: - description: Initial draft of the package type: enhancement From e9452279e418d2e10ddd2d40797a33bdfd092fb1 Mon Sep 17 00:00:00 2001 From: James Garside Date: Thu, 4 Jul 2024 11:24:16 +0100 Subject: [PATCH 10/23] Update packages/endace/_dev/deploy/docker/docker-compose.yml Co-authored-by: Michael Wolf --- packages/endace/_dev/deploy/docker/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/endace/_dev/deploy/docker/docker-compose.yml b/packages/endace/_dev/deploy/docker/docker-compose.yml index adbdde59baf..2bd8a11a137 100644 --- a/packages/endace/_dev/deploy/docker/docker-compose.yml +++ b/packages/endace/_dev/deploy/docker/docker-compose.yml @@ -7,7 +7,7 @@ services: - ${SERVICE_LOGS_DIR}:/pcaps command: /bin/sh -c "cp /sample_pcaps/* /pcaps/" netflow-log-netflow: - image: akroh/stream:v0.0.1 + image: docker.elastic.co/observability/stream:v0.16.0 volumes: - ./sample_logs:/sample_logs:ro command: pcap --start-signal=SIGHUP --delay=5s --addr elastic-agent:2055 -p=udp /sample_logs/ipfix_cisco.pcap From 540056a5d16d104080c89c56377be11471b52eb3 Mon Sep 17 00:00:00 2001 From: James Garside Date: Fri, 5 Jul 2024 18:05:25 +0100 Subject: [PATCH 11/23] Fixed proposed changes --- .../_dev/test/pipeline/test-flow-events.json | 20 +++++++++---------- .../test-flow-events.json-expected.json | 20 +++++++++---------- .../flow/agent/stream/flow.yml.hbs | 3 +++ .../elasticsearch/ingest_pipeline/endace.yml | 9 +++++++++ .../log/agent/stream/netflow.yml.hbs | 4 +++- 5 files changed, 35 insertions(+), 21 deletions(-) diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json index d7270a02237..5ec8072018d 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json @@ -36,7 +36,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -171,7 +171,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -316,7 +316,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -452,7 +452,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -570,7 +570,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -706,7 +706,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -842,7 +842,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -978,7 +978,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -1096,7 +1096,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -1214,7 +1214,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json index 3fbaaae002f..dd8b84dfb5a 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json @@ -36,7 +36,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -161,7 +161,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -307,7 +307,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -433,7 +433,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -541,7 +541,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -667,7 +667,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -793,7 +793,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -919,7 +919,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -1027,7 +1027,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", @@ -1135,7 +1135,7 @@ "cloud": { "availability_zone": "europe-west2-c", "instance": { - "name": "jamesgarside-security-demo-websever", + "name": "test-security-demo-websever", "id": "5975790316485631173" }, "provider": "gcp", diff --git a/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs index 58d32879557..b9d7f96042c 100644 --- a/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs +++ b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs @@ -11,6 +11,9 @@ fields: geoip_enrich: {{geoip_enrich}} map_to_ecs: {{map_to_ecs}} endace_url: {{ endace_url }} + endace_datasources: {{ endace_datasources }} + endace_tools: {{ endace_tools }} + endace_lookback" {{ endace_lookback }} {{#if tags}} tags: {{#each tags as |tag|}} diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml index 5b2d4d1a287..0bdad9bf488 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml @@ -68,3 +68,12 @@ processors: ignore_empty_value: true tag: endace reference url if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + +on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs index cf0bb64390f..7bdd7a14314 100644 --- a/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs +++ b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs @@ -36,7 +36,9 @@ processors: target: "_conf" fields: endace_url: {{ endace_url }} - test: "test" + endace_datasources: {{ endace_datasources }} + endace_tools: {{ endace_tools }} + endace_lookback" {{ endace_lookback }} {{#if processors}} {{processors}} {{/if}} From d5afd1ed0f9e3b2f571a5c797d89bfad5e4d8cf6 Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 8 Jul 2024 19:20:23 +0100 Subject: [PATCH 12/23] Updated README --- packages/endace/_dev/build/docs/README.md | 40 ++++++------------- .../flow/agent/stream/flow.yml.hbs | 2 +- .../log/agent/stream/netflow.yml.hbs | 2 +- packages/endace/docs/README.md | 40 ++++++------------- packages/endace/manifest.yml | 2 +- 5 files changed, 29 insertions(+), 57 deletions(-) diff --git a/packages/endace/_dev/build/docs/README.md b/packages/endace/_dev/build/docs/README.md index 6bb259983a7..9a6460ee4b9 100644 --- a/packages/endace/_dev/build/docs/README.md +++ b/packages/endace/_dev/build/docs/README.md @@ -1,38 +1,24 @@ -# Network Packet Capture Integration +# Endace -This integration sniffs network packets on a host and dissects -known protocols. +Endace is a company known for its network recording, traffic capture, and analysis technology. Endace's solutions are often used for network security, performance monitoring, and troubleshooting. +This integration allows users to ingest Network flow data from either Endace Flow via syslog input or use Elastic Agent to generate and ship Network Flow data to an Elastic deployment. Both of these methods add the `event.reference` field to each event when ingested into Elasticsearch which is a URL used to pivot to Endace. -Monitoring your network traffic is critical to gaining observability and -securing your environment — ensuring high levels of performance and security. -The Network Packet Capture integration captures the network traffic between -your application servers, decodes common application layer protocols and -records the interesting fields for each transaction. -## Supported Protocols +## Integration Variables +#### `endace_url` +The base URL for Endace UI. Example: https://myvprobe.com -Currently, Network Packet Capture supports the following protocols: +#### `endace_datasources` +The datasource within Endace to pivot to. Example: tag:rotation-file -- ICMP (v4 and v6) -- DHCP (v4) -- DNS -- HTTP -- AMQP 0.9.1 -- Cassandra -- Mysql -- PostgreSQL -- Redis -- Thrift-RPC -- MongoDB -- Memcache -- NFS -- TLS -- SIP/SDP (beta) +#### `endace_tools` +The tools to use within the Endace Pivot. Example: trafficOverTime_by_app,conversations_by_ipaddress -### Common protocol options -The following options are available for all protocols: +#### `endace_lookback` +The lookback time in Minutes of how long to look back over ontop of the event start and finish time. +## Endace Flow #### `map_to_ecs` Remap any non-ECS Packetbeat fields in root to their correct ECS fields. diff --git a/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs index b9d7f96042c..c7c3a8ce262 100644 --- a/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs +++ b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs @@ -13,7 +13,7 @@ fields: endace_url: {{ endace_url }} endace_datasources: {{ endace_datasources }} endace_tools: {{ endace_tools }} - endace_lookback" {{ endace_lookback }} + endace_lookback": {{ endace_lookback }} {{#if tags}} tags: {{#each tags as |tag|}} diff --git a/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs index 7bdd7a14314..3bc89ceaa79 100644 --- a/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs +++ b/packages/endace/data_stream/log/agent/stream/netflow.yml.hbs @@ -38,7 +38,7 @@ processors: endace_url: {{ endace_url }} endace_datasources: {{ endace_datasources }} endace_tools: {{ endace_tools }} - endace_lookback" {{ endace_lookback }} + endace_lookback": {{ endace_lookback }} {{#if processors}} {{processors}} {{/if}} diff --git a/packages/endace/docs/README.md b/packages/endace/docs/README.md index 1fb0ae4968b..99fdadc924c 100644 --- a/packages/endace/docs/README.md +++ b/packages/endace/docs/README.md @@ -1,38 +1,24 @@ -# Network Packet Capture Integration +# Endace -This integration sniffs network packets on a host and dissects -known protocols. +Endace is a company known for its network recording, traffic capture, and analysis technology. Endace's solutions are often used for network security, performance monitoring, and troubleshooting. +This integration allows users to ingest Network flow data from either Endace Flow via syslog input or use Elastic Agent to generate and ship Network Flow data to an Elastic deployment. Both of these methods add the `event.reference` field to each event when ingested into Elasticsearch which is a URL used to pivot to Endace. -Monitoring your network traffic is critical to gaining observability and -securing your environment — ensuring high levels of performance and security. -The Network Packet Capture integration captures the network traffic between -your application servers, decodes common application layer protocols and -records the interesting fields for each transaction. -## Supported Protocols +## Integration Variables +#### `endace_url` +The base URL for Endace UI. Example: https://myvprobe.com -Currently, Network Packet Capture supports the following protocols: +#### `endace_datasources` +The datasource within Endace to pivot to. Example: tag:rotation-file -- ICMP (v4 and v6) -- DHCP (v4) -- DNS -- HTTP -- AMQP 0.9.1 -- Cassandra -- Mysql -- PostgreSQL -- Redis -- Thrift-RPC -- MongoDB -- Memcache -- NFS -- TLS -- SIP/SDP (beta) +#### `endace_tools` +The tools to use within the Endace Pivot. Example: trafficOverTime_by_app,conversations_by_ipaddress -### Common protocol options -The following options are available for all protocols: +#### `endace_lookback` +The lookback time in Minutes of how long to look back over ontop of the event start and finish time. +## Endace Flow #### `map_to_ecs` Remap any non-ECS Packetbeat fields in root to their correct ECS fields. diff --git a/packages/endace/manifest.yml b/packages/endace/manifest.yml index d5cb0ab1372..962f805a7cc 100644 --- a/packages/endace/manifest.yml +++ b/packages/endace/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.0.0 name: endace title: "Endace" -version: 0.0.4 +version: 0.1.0 source: license: "Elastic-2.0" description: "This Endace integration configures Network Packet Capture for flow generation and adds a pivot field to your Endace platform." From 7d07ffbbee091708143ff1d2cf0c2be21a05839a Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 15 Jul 2024 17:04:42 +0100 Subject: [PATCH 13/23] Update packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml Co-authored-by: Taylor Swanson <90622908+taylor-swanson@users.noreply.github.com> --- .../data_stream/flow/elasticsearch/ingest_pipeline/default.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml index 164fa67df2e..228026d07bd 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml @@ -33,7 +33,7 @@ processors: - append: field: related.hosts value: "{{{observer.hostname}}}" - if: ctx.observer?.hostname != null && ctx.observer?.hostname != '' + if: ctx.observer?.hostname != null && ctx.observer.hostname != '' allow_duplicates: false - foreach: if: ctx.observer?.ip != null && ctx.observer.ip instanceof List From d4ab3f891fca4d73048f1e0fb1e15f0b4627a154 Mon Sep 17 00:00:00 2001 From: Roberto Cesar <37998637+rcesar999@users.noreply.github.com> Date: Mon, 22 Jul 2024 05:14:43 -0500 Subject: [PATCH 14/23] Able to create P2V when just one IP is present - Fixed start&end time (#10489) * Able to create P2V when just one IP is present - Fixed start&end time * ngest_pipeline/endace-netflow.yml changed to handle single IP events * updating expected.json after command elastic-package test pipeline --generate --- .../_dev/test/pipeline/test-flow-events.json | 1226 +++++++- .../test-flow-events.json-expected.json | 2685 ++++++++++++----- .../elasticsearch/ingest_pipeline/endace.yml | 63 +- .../pipeline/test-netflow-log-events.json | 6 +- ...test-netflow-log-events.json-expected.json | 22 +- .../ingest_pipeline/endace-netflow.yml | 62 +- 6 files changed, 3213 insertions(+), 851 deletions(-) diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json index 5ec8072018d..a50f34cefb3 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json @@ -226,8 +226,10 @@ "mac": [ "42-01-0A-64-00-1D" ], - "ip": ["10.100.0.29", - "fe80::4001:aff:fe64:1d"] + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ] }, "event": { "duration": 60223908451, @@ -1295,6 +1297,1226 @@ "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", "endace_lookback": 10 } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 6789, + "bytes": 1108, + "ip": "127.0.0.1", + "packets": 14 + }, + "type": "flow", + "network": { + "community_id": "1:RCi572y4gqQ+7LFlqkPsn1Xfa+0=", + "bytes": 2425, + "transport": "tcp", + "type": "ipv4", + "packets": 26 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 64831956254, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:39.852Z", + "action": "network_flow", + "end": "2024-07-01T10:49:44.684Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYUa4r4" + }, + "_conf": { + "event": { + "start": 1719827319, + "end": 1719827384 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 680, + "ip": "81.2.69.144", + "packets": 10 + }, + "type": "flow", + "network": { + "community_id": "1:TwdqE0w1aE72YUTaajguLj4qUns=", + "bytes": 5891, + "transport": "tcp", + "type": "ipv4", + "packets": 20 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "observer": { + "hostname": "webserver", + "mac": [ + "42-01-0A-64-00-1D" + ], + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ] + }, + "event": { + "duration": 60223908451, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:39.852Z", + "action": "network_flow", + "end": "2024-07-01T10:49:40.076Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" + }, + "_conf": { + "map_to_ecs": true, + "geoip_enrich": true, + "event": { + "start": 1719827319, + "end": 1719827380 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 9672, + "ip": "81.2.69.144", + "packets": 45 + }, + "type": "flow", + "network": { + "community_id": "1:vX6oXjJfSEwPiJ0pwvMzUK719S8=", + "bytes": 557311, + "transport": "tcp", + "type": "ipv4", + "packets": 111 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 60736169344, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:40.363Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDMLquwE" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827320, + "end": 1719827381 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 1954, + "ip": "81.2.69.144", + "packets": 6 + }, + "type": "flow", + "network": { + "community_id": "1:rkJGR0qjRmD5vrCpbbdAiOnhiQM=", + "bytes": 9729, + "transport": "tcp", + "type": "ipv4", + "packets": 13 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "machine": { + "type": "t2d-standard-1" + }, + "service": { + "name": "GCE" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 60735918914, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:40.364Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDJjauwE" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827320, + "end": 1719827381 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 48904, + "bytes": 1479, + "ip": "127.0.0.1", + "packets": 12 + }, + "type": "flow", + "network": { + "community_id": "1:8z8pjOEt4+6YMtJjX7lUfpXgVgw=", + "bytes": 2655, + "transport": "tcp", + "type": "ipv4", + "packets": 27 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 65343896149, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:40.364Z", + "action": "network_flow", + "end": "2024-07-01T10:49:45.708Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAQi/hRo" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827320, + "end": 1719827385 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 7821, + "ip": "81.2.69.144", + "packets": 30 + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "type": "flow", + "network": { + "community_id": "1:rDoUGTpaonfSKgfFy8xvyps5opI=", + "bytes": 340814, + "transport": "tcp", + "type": "ipv4", + "packets": 79 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 59712159075, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:41.388Z", + "action": "network_flow", + "end": "2024-07-01T10:49:41.100Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDHiwuwE" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827321, + "end": 1719827381 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "destination": { + "geo": { + "region_iso_code": "GB-ENG", + "continent_name": "Europe", + "city_name": "London", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lon": -0.093, + "lat": 51.5088 + }, + "region_name": "England" + }, + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "port": 443, + "bytes": 5471, + "ip": "81.2.69.144", + "packets": 20 + }, + "type": "flow", + "network": { + "community_id": "1:JimQNreW+sYThnNGTVx+lyRdLbo=", + "bytes": 29368, + "transport": "tcp", + "type": "ipv4", + "packets": 41 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "containerized": false, + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 66879956683, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:41.388Z", + "action": "network_flow", + "end": "2024-07-01T10:49:48.268Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDGDeuwE" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827321, + "end": 1719827388 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "type": "packetbeat", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 49588, + "bytes": 182639, + "ip": "10.100.0.29", + "packets": 82 + }, + "type": "flow", + "network": { + "community_id": "1:nQ4W/+0XInOvc8X+dZywhVnJMxg=", + "bytes": 195227, + "transport": "tcp", + "type": "ipv4", + "packets": 127 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "containerized": false, + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 67392032290, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:41.900Z", + "action": "network_flow", + "end": "2024-07-01T10:49:49.292Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDLTBuwE" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827321, + "end": 1719827389 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "source": { + "port": 39856, + "bytes": 2310, + "ip": "127.0.0.1", + "packets": 14 + }, + "type": "flow", + "network": { + "community_id": "1:VFRc3lML+k0fLfF36gdrSCu5udg=", + "bytes": 9143, + "transport": "tcp", + "type": "ipv4", + "packets": 21 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "type": "linux", + "family": "debian", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 59712056664, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:42.412Z", + "action": "network_flow", + "end": "2024-07-01T10:49:42.124Z", + "type": [ + "connection" + ], + "category": [ + "network" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYcasJs" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827322, + "end": 1719827382 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } + }, + { + "agent": { + "name": "webserver", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "type": "packetbeat", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "version": "8.9.1" + }, + "destination": { + "port": 80, + "bytes": 25278, + "ip": "169.254.169.254", + "packets": 5 + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "version": "8.9.1", + "snapshot": false + }, + "type": "flow", + "network": { + "community_id": "1:ZA5ezPNh0MumdIPxY03oJDcyLd8=", + "bytes": 25730, + "transport": "tcp", + "type": "ipv4", + "packets": 9 + }, + "cloud": { + "availability_zone": "europe-west2-c", + "instance": { + "name": "test-security-demo-websever", + "id": "5975790316485631173" + }, + "provider": "gcp", + "service": { + "name": "GCE" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "region": "europe-west2", + "account": { + "id": "elastic-sa" + } + }, + "@timestamp": "2024-07-01T10:49:50.000Z", + "ecs": { + "version": "8.11.0" + }, + "data_stream": { + "namespace": "webserver", + "type": "logs", + "dataset": "endace.flow" + }, + "host": { + "hostname": "webserver", + "os": { + "kernel": "5.10.0-27-cloud-amd64", + "codename": "bullseye", + "name": "Debian GNU/Linux", + "family": "debian", + "type": "linux", + "version": "11 (bullseye)", + "platform": "debian" + }, + "containerized": false, + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "name": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "mac": [ + "42-01-0A-64-00-1D" + ], + "architecture": "x86_64" + }, + "event": { + "duration": 61759622403, + "agent_id_status": "verified", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:42.924Z", + "action": "network_flow", + "end": "2024-07-01T10:49:44.684Z", + "category": [ + "network" + ], + "type": [ + "connection" + ], + "dataset": "endace.flow" + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdqf6p/u65UAA" + }, + "_conf": { + "geoip_enrich": true, + "event": { + "start": 1719827322, + "end": 1719827384 + }, + "endace_url": "https://test.test.local", + "endace_datasources": "tag:rotation-file", + "endace_tools": "trafficOverTime_by_app,conversations_by_ipaddress", + "endace_lookback": 10 + } } ] } \ No newline at end of file diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json index dd8b84dfb5a..40744a87df2 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json @@ -1,47 +1,22 @@ { "expected": [ { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", "version": "8.9.1" }, - "destination": { - "port": 48866, - "bytes": 1317, - "ip": "127.0.0.1", - "packets": 12 - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 6789, - "bytes": 1108, - "ip": "127.0.0.1", - "packets": 14 - }, - "type": "flow", - "network": { - "community_id": "1:RCi572y4gqQ+7LFlqkPsn1Xfa+0=", - "bytes": 2425, - "transport": "tcp", - "type": "ipv4", - "packets": 26 - }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -49,167 +24,208 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", - "ecs": { - "version": "8.11.0" - }, "data_stream": { + "dataset": "endace.flow", "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "type": "logs" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" + "destination": { + "bytes": 1317, + "ip": "127.0.0.1", + "packets": 12, + "port": 48866 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 64831956254, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "start": "2024-07-01T10:48:39.852Z", "action": "network_flow", - "end": "2024-07-01T10:49:44.684Z", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830919852&end=1719830384684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", + "agent_id_status": "verified", "category": [ "network" ], + "dataset": "endace.flow", + "duration": 64831956254, + "end": "2024-07-01T10:49:44.684Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830619852&end=1719831284684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", + "start": "2024-07-01T10:48:39.852Z", "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYUa4r4" - } + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 2425, + "community_id": "1:RCi572y4gqQ+7LFlqkPsn1Xfa+0=", + "packets": 26, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 1108, + "ip": "127.0.0.1", + "packets": 14, + "port": 6789 + }, + "type": "flow" }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "geo": { - "region_iso_code": "GB-ENG", - "continent_name": "Europe", - "city_name": "London", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lon": -0.0931, - "lat": 51.5142 - }, - "region_name": "England" - }, - "as": { - "number": 396982, - "organization": { - "name": "GOOGLE-CLOUD-PLATFORM" - } - }, - "port": 443, - "bytes": 680, - "ip": "81.2.69.144", - "packets": 10 - }, - "source": { - "port": 56370, - "bytes": 5211, - "ip": "10.100.0.29", - "packets": 10 - }, - "network": { - "community_id": "1:TwdqE0w1aE72YUTaajguLj4qUns=", - "bytes": 5891, - "transport": "tcp", - "type": "ipv4", - "packets": 20 - }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, - "provider": "gcp", "machine": { "type": "t2d-standard-1" }, - "service": { - "name": "GCE" - }, "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 680, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 10, + "port": 443 + }, "ecs": { "version": "8.11.0" }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "duration": 60223908451, + "end": "2024-07-01T10:49:40.076Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830619852&end=1719831280076&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:39.852Z", + "type": [ + "connection" + ] }, "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, + "architecture": "x86_64", "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ "42-01-0A-64-00-1D" ], - "architecture": "x86_64" + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 5891, + "community_id": "1:TwdqE0w1aE72YUTaajguLj4qUns=", + "packets": 20, + "transport": "tcp", + "type": "ipv4" + }, + "network_traffic": { + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" + } }, "observer": { "hostname": "webserver", @@ -222,7 +238,7 @@ ] }, "related": { - "hosts": [ + "hosts": [ "webserver" ], "ip": [ @@ -230,89 +246,30 @@ "fe80::4001:aff:fe64:1d" ] }, - "event": { - "duration": 60223908451, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830919852&end=1719830380076&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", - "start": "2024-07-01T10:48:39.852Z", - "action": "network_flow", - "end": "2024-07-01T10:49:40.076Z", - "category": [ - "network" - ], - "type": [ - "connection" - ] - }, - "network_traffic": { - "flow": { - "final": false, - "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" - } - } - }, + "source": { + "bytes": 5211, + "ip": "10.100.0.29", + "packets": 10, + "port": 56370 + } + }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "destination": { - "geo": { - "region_iso_code": "GB-ENG", - "continent_name": "Europe", - "city_name": "London", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lon": -0.0931, - "lat": 51.5142 - }, - "region_name": "England" - }, - "as": { - "number": 396982, - "organization": { - "name": "GOOGLE-CLOUD-PLATFORM" - } - }, - "port": 443, - "bytes": 9672, - "ip": "81.2.69.144", - "packets": 45 - }, - "source": { - "port": 60098, - "bytes": 547639, - "ip": "10.100.0.29", - "packets": 66 - }, - "type": "flow", - "network": { - "community_id": "1:vX6oXjJfSEwPiJ0pwvMzUK719S8=", - "bytes": 557311, - "transport": "tcp", - "type": "ipv4", - "packets": 111 - }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -320,233 +277,251 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", - "ecs": { - "version": "8.11.0" - }, "data_stream": { + "dataset": "endace.flow", "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "type": "logs" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" + "bytes": 9672, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 45, + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 60736169344, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830920363&end=1719830381100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", - "start": "2024-07-01T10:48:40.363Z", "action": "network_flow", - "end": "2024-07-01T10:49:41.100Z", + "agent_id_status": "verified", "category": [ "network" ], + "dataset": "endace.flow", + "duration": 60736169344, + "end": "2024-07-01T10:49:41.100Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830620363&end=1719831281100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:40.363Z", "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDMLquwE" - } - }, - { - "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", - "version": "8.9.1" }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } }, - "destination": { - "geo": { - "region_iso_code": "GB-ENG", - "continent_name": "Europe", - "city_name": "London", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lon": -0.0931, - "lat": 51.5142 - }, - "region_name": "England" - }, - "as": { - "number": 396982, - "organization": { - "name": "GOOGLE-CLOUD-PLATFORM" - } - }, - "port": 443, - "bytes": 1954, - "ip": "81.2.69.144", - "packets": 6 + "network": { + "bytes": 557311, + "community_id": "1:vX6oXjJfSEwPiJ0pwvMzUK719S8=", + "packets": 111, + "transport": "tcp", + "type": "ipv4" }, "source": { - "port": 55960, - "bytes": 7775, + "bytes": 547639, "ip": "10.100.0.29", - "packets": 7 + "packets": 66, + "port": 60098 }, - "type": "flow", - "network": { - "community_id": "1:rkJGR0qjRmD5vrCpbbdAiOnhiQM=", - "bytes": 9729, - "transport": "tcp", - "type": "ipv4", - "packets": 13 + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, - "provider": "gcp", "machine": { "type": "t2d-standard-1" }, - "service": { - "name": "GCE" - }, "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", - "ecs": { - "version": "8.11.0" - }, "data_stream": { + "dataset": "endace.flow", "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "type": "logs" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" + "bytes": 1954, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 6, + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 60735918914, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830920364&end=1719830381100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", - "start": "2024-07-01T10:48:40.364Z", "action": "network_flow", - "end": "2024-07-01T10:49:41.100Z", + "agent_id_status": "verified", "category": [ "network" ], + "dataset": "endace.flow", + "duration": 60735918914, + "end": "2024-07-01T10:49:41.100Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830620364&end=1719831281100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:40.364Z", "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDJjauwE" - } + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 9729, + "community_id": "1:rkJGR0qjRmD5vrCpbbdAiOnhiQM=", + "packets": 13, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 7775, + "ip": "10.100.0.29", + "packets": 7, + "port": 55960 + }, + "type": "flow" }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "destination": { - "port": 6789, - "bytes": 1176, - "ip": "127.0.0.1", - "packets": 15 - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 48904, - "bytes": 1479, - "ip": "127.0.0.1", - "packets": 12 - }, - "type": "flow", - "network": { - "community_id": "1:8z8pjOEt4+6YMtJjX7lUfpXgVgw=", - "bytes": 2655, - "transport": "tcp", - "type": "ipv4", - "packets": 27 - }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -554,125 +529,233 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", - "ecs": { - "version": "8.11.0" - }, "data_stream": { + "dataset": "endace.flow", "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "type": "logs" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" + "destination": { + "bytes": 1176, + "ip": "127.0.0.1", + "packets": 15, + "port": 6789 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 65343896149, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830920364&end=1719830385708&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", - "start": "2024-07-01T10:48:40.364Z", "action": "network_flow", - "end": "2024-07-01T10:49:45.708Z", + "agent_id_status": "verified", "category": [ "network" ], + "dataset": "endace.flow", + "duration": 65343896149, + "end": "2024-07-01T10:49:45.708Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830620364&end=1719831285708&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", + "start": "2024-07-01T10:48:40.364Z", "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, "id": "EAT/////AP//////CP8AAAF/AAABfwAAAQi/hRo" - } + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 2655, + "community_id": "1:8z8pjOEt4+6YMtJjX7lUfpXgVgw=", + "packets": 27, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 1479, + "ip": "127.0.0.1", + "packets": 12, + "port": 48904 + }, + "type": "flow" }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", "version": "8.9.1" }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 7821, "geo": { - "region_iso_code": "GB-ENG", - "continent_name": "Europe", "city_name": "London", + "continent_name": "Europe", "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.0931, - "lat": 51.5142 + "lat": 51.5142, + "lon": -0.0931 }, + "region_iso_code": "GB-ENG", "region_name": "England" }, - "as": { - "number": 396982, - "organization": { - "name": "GOOGLE-CLOUD-PLATFORM" - } - }, - "port": 443, - "bytes": 7821, "ip": "81.2.69.144", - "packets": 30 + "packets": 30, + "port": 443 + }, + "ecs": { + "version": "8.11.0" }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false + "snapshot": false, + "version": "8.9.1" }, - "source": { - "port": 45176, - "bytes": 332993, - "ip": "10.100.0.29", - "packets": 49 + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 59712159075, + "end": "2024-07-01T10:49:41.100Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830621388&end=1719831281100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:41.388Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDHiwuwE" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } }, - "type": "flow", "network": { - "community_id": "1:rDoUGTpaonfSKgfFy8xvyps5opI=", "bytes": 340814, + "community_id": "1:rDoUGTpaonfSKgfFy8xvyps5opI=", + "packets": 79, "transport": "tcp", - "type": "ipv4", - "packets": 79 + "type": "ipv4" + }, + "source": { + "bytes": 332993, + "ip": "10.100.0.29", + "packets": 49, + "port": 45176 + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -680,125 +763,1045 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 5471, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 20, + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 66879956683, + "end": "2024-07-01T10:49:48.268Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830621388&end=1719831288268&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:41.388Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDGDeuwE" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 29368, + "community_id": "1:JimQNreW+sYThnNGTVx+lyRdLbo=", + "packets": 41, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 23897, + "ip": "10.100.0.29", + "packets": 21, + "port": 56928 + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" + }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 12588, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 45, + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 67392032290, + "end": "2024-07-01T10:49:49.292Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830621900&end=1719831289292&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", + "start": "2024-07-01T10:48:41.900Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDLTBuwE" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 195227, + "community_id": "1:nQ4W/+0XInOvc8X+dZywhVnJMxg=", + "packets": 127, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 182639, + "ip": "10.100.0.29", + "packets": 82, + "port": 49588 + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" + }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "bytes": 6833, + "ip": "127.0.0.1", + "packets": 7, + "port": 6791 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 59712056664, + "end": "2024-07-01T10:49:42.124Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830622412&end=1719831282124&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", + "start": "2024-07-01T10:48:42.412Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYcasJs" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 9143, + "community_id": "1:VFRc3lML+k0fLfF36gdrSCu5udg=", + "packets": 21, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 2310, + "ip": "127.0.0.1", + "packets": 14, + "port": 39856 + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" + }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "bytes": 25278, + "ip": "169.254.169.254", + "packets": 5, + "port": 80 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 61759622403, + "end": "2024-07-01T10:49:44.684Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830622924&end=1719831284684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%26169.254.169.254", + "start": "2024-07-01T10:48:42.924Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdqf6p/u65UAA" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 25730, + "community_id": "1:ZA5ezPNh0MumdIPxY03oJDcyLd8=", + "packets": 9, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 452, + "ip": "10.100.0.29", + "packets": 4, + "port": 47598 + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" + }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 64831956254, + "end": "2024-07-01T10:49:44.684Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:39.852Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYUa4r4" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 2425, + "community_id": "1:RCi572y4gqQ+7LFlqkPsn1Xfa+0=", + "packets": 26, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 1108, + "ip": "127.0.0.1", + "packets": 14, + "port": 6789 + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" + }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 680, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 10, + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "duration": 60223908451, + "end": "2024-07-01T10:49:40.076Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:39.852Z", + "type": [ + "connection" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 5891, + "community_id": "1:TwdqE0w1aE72YUTaajguLj4qUns=", + "packets": 20, + "transport": "tcp", + "type": "ipv4" + }, + "network_traffic": { + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDDLcuwE" + } + }, + "observer": { + "hostname": "webserver", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ] + }, + "related": { + "hosts": [ + "webserver" + ], + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ] + } + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" + }, + "cloud": { "account": { "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 9672, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 45, + "port": 443 + }, "ecs": { "version": "8.11.0" }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" + }, + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 60736169344, + "end": "2024-07-01T10:49:41.100Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:40.363Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDMLquwE" }, "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, + "architecture": "x86_64", "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", "ip": [ "10.100.0.29", "fe80::4001:aff:fe64:1d" ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", "mac": [ "42-01-0A-64-00-1D" ], - "architecture": "x86_64" + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 557311, + "community_id": "1:vX6oXjJfSEwPiJ0pwvMzUK719S8=", + "packets": 111, + "transport": "tcp", + "type": "ipv4" + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" + }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 1954, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 6, + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 59712159075, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830921388&end=1719830381100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", - "start": "2024-07-01T10:48:41.388Z", "action": "network_flow", - "end": "2024-07-01T10:49:41.100Z", + "agent_id_status": "verified", "category": [ "network" ], + "dataset": "endace.flow", + "duration": 60735918914, + "end": "2024-07-01T10:49:41.100Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:40.364Z", "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, - "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDHiwuwE" - } + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDJjauwE" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 9729, + "community_id": "1:rkJGR0qjRmD5vrCpbbdAiOnhiQM=", + "packets": 13, + "transport": "tcp", + "type": "ipv4" + }, + "type": "flow" }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, + "ecs": { + "version": "8.11.0" + }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false + "snapshot": false, + "version": "8.9.1" }, - "destination": { - "geo": { - "region_iso_code": "GB-ENG", - "continent_name": "Europe", - "city_name": "London", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lon": -0.0931, - "lat": 51.5142 - }, - "region_name": "England" - }, - "as": { - "number": 396982, - "organization": { - "name": "GOOGLE-CLOUD-PLATFORM" - } - }, - "port": 443, - "bytes": 5471, - "ip": "81.2.69.144", - "packets": 20 + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 65343896149, + "end": "2024-07-01T10:49:45.708Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:40.364Z", + "type": [ + "connection" + ] }, - "source": { - "port": 56928, - "bytes": 23897, - "ip": "10.100.0.29", - "packets": 21 + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAF/AAABfwAAAQi/hRo" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } }, - "type": "flow", "network": { - "community_id": "1:JimQNreW+sYThnNGTVx+lyRdLbo=", - "bytes": 29368, + "bytes": 2655, + "community_id": "1:8z8pjOEt4+6YMtJjX7lUfpXgVgw=", + "packets": 27, "transport": "tcp", - "type": "ipv4", - "packets": 41 + "type": "ipv4" + }, + "source": { + "bytes": 1479, + "ip": "127.0.0.1", + "packets": 12, + "port": 48904 + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -806,125 +1809,237 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", - "ecs": { - "version": "8.11.0" - }, "data_stream": { + "dataset": "endace.flow", "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "type": "logs" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" + "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } }, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "containerized": false, - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" + "bytes": 7821, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 30, + "port": 443 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 66879956683, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830921388&end=1719830388268&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", - "start": "2024-07-01T10:48:41.388Z", "action": "network_flow", - "end": "2024-07-01T10:49:48.268Z", + "agent_id_status": "verified", "category": [ "network" ], + "dataset": "endace.flow", + "duration": 59712159075, + "end": "2024-07-01T10:49:41.100Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:41.388Z", "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, - "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDGDeuwE" - } + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDHiwuwE" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 340814, + "community_id": "1:rDoUGTpaonfSKgfFy8xvyps5opI=", + "packets": 79, + "transport": "tcp", + "type": "ipv4" + }, + "type": "flow" }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", "version": "8.9.1" }, + "cloud": { + "account": { + "id": "elastic-sa" + }, + "availability_zone": "europe-west2-c", + "instance": { + "id": "5975790316485631173", + "name": "test-security-demo-websever" + }, + "machine": { + "type": "t2d-standard-1" + }, + "project": { + "id": "elastic-sa" + }, + "provider": "gcp", + "region": "europe-west2", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, "destination": { + "as": { + "number": 396982, + "organization": { + "name": "GOOGLE-CLOUD-PLATFORM" + } + }, + "bytes": 5471, "geo": { - "region_iso_code": "GB-ENG", - "continent_name": "Europe", "city_name": "London", + "continent_name": "Europe", "country_iso_code": "GB", "country_name": "United Kingdom", "location": { - "lon": -0.0931, - "lat": 51.5142 + "lat": 51.5142, + "lon": -0.0931 }, + "region_iso_code": "GB-ENG", "region_name": "England" }, - "as": { - "number": 396982, - "organization": { - "name": "GOOGLE-CLOUD-PLATFORM" - } - }, - "port": 443, - "bytes": 12588, "ip": "81.2.69.144", - "packets": 45 + "packets": 20, + "port": 443 + }, + "ecs": { + "version": "8.11.0" }, "elastic_agent": { "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false + "snapshot": false, + "version": "8.9.1" }, - "source": { - "port": 49588, - "bytes": 182639, - "ip": "10.100.0.29", - "packets": 82 + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 66879956683, + "end": "2024-07-01T10:49:48.268Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:41.388Z", + "type": [ + "connection" + ] + }, + "flow": { + "final": false, + "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDGDeuwE" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } }, - "type": "flow", "network": { - "community_id": "1:nQ4W/+0XInOvc8X+dZywhVnJMxg=", - "bytes": 195227, + "bytes": 29368, + "community_id": "1:JimQNreW+sYThnNGTVx+lyRdLbo=", + "packets": 41, "transport": "tcp", - "type": "ipv4", - "packets": 127 + "type": "ipv4" + }, + "type": "flow" + }, + { + "@timestamp": "2024-07-01T10:49:50.000Z", + "agent": { + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", + "type": "packetbeat", + "version": "8.9.1" }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -932,107 +2047,100 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", + "data_stream": { + "dataset": "endace.flow", + "namespace": "webserver", + "type": "logs" + }, "ecs": { "version": "8.11.0" }, - "data_stream": { - "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "containerized": false, - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" + "event": { + "action": "network_flow", + "agent_id_status": "verified", + "category": [ + "network" ], - "architecture": "x86_64" - }, - "event": { + "dataset": "endace.flow", "duration": 67392032290, - "agent_id_status": "verified", + "end": "2024-07-01T10:49:49.292Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830921900&end=1719830389292&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%2681.2.69.144", "start": "2024-07-01T10:48:41.900Z", - "action": "network_flow", - "end": "2024-07-01T10:49:49.292Z", - "category": [ - "network" - ], "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, "id": "EAT/////AP//////CP8AAAEKZAAdIlkMDLTBuwE" - } + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 195227, + "community_id": "1:nQ4W/+0XInOvc8X+dZywhVnJMxg=", + "packets": 127, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 182639, + "ip": "10.100.0.29", + "packets": 82, + "port": 49588 + }, + "type": "flow" }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "destination": { - "port": 6791, - "bytes": 6833, - "ip": "127.0.0.1", - "packets": 7 - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 39856, - "bytes": 2310, - "ip": "127.0.0.1", - "packets": 14 - }, - "type": "flow", - "network": { - "community_id": "1:VFRc3lML+k0fLfF36gdrSCu5udg=", - "bytes": 9143, - "transport": "tcp", - "type": "ipv4", - "packets": 21 - }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -1040,107 +2148,100 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", - "ecs": { - "version": "8.11.0" - }, "data_stream": { + "dataset": "endace.flow", "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "type": "logs" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "type": "linux", - "family": "debian", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 59712056664, + "action": "network_flow", "agent_id_status": "verified", + "category": [ + "network" + ], + "dataset": "endace.flow", + "duration": 59712056664, + "end": "2024-07-01T10:49:42.124Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830922412&end=1719830382124&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=127.0.0.1%26127.0.0.1", "start": "2024-07-01T10:48:42.412Z", - "action": "network_flow", - "end": "2024-07-01T10:49:42.124Z", "type": [ "connection" - ], - "category": [ - "network" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, "id": "EAT/////AP//////CP8AAAF/AAABfwAAAYcasJs" - } + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 9143, + "community_id": "1:VFRc3lML+k0fLfF36gdrSCu5udg=", + "packets": 21, + "transport": "tcp", + "type": "ipv4" + }, + "source": { + "bytes": 2310, + "ip": "127.0.0.1", + "packets": 14, + "port": 39856 + }, + "type": "flow" }, { + "@timestamp": "2024-07-01T10:49:50.000Z", "agent": { - "name": "webserver", + "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "name": "webserver", "type": "packetbeat", - "ephemeral_id": "20132874-04f9-4a32-8b53-050f938d1f31", "version": "8.9.1" }, - "destination": { - "port": 80, - "bytes": 25278, - "ip": "169.254.169.254", - "packets": 5 - }, - "elastic_agent": { - "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", - "version": "8.9.1", - "snapshot": false - }, - "source": { - "port": 47598, - "bytes": 452, - "ip": "10.100.0.29", - "packets": 4 - }, - "type": "flow", - "network": { - "community_id": "1:ZA5ezPNh0MumdIPxY03oJDcyLd8=", - "bytes": 25730, - "transport": "tcp", - "type": "ipv4", - "packets": 9 - }, "cloud": { + "account": { + "id": "elastic-sa" + }, "availability_zone": "europe-west2-c", "instance": { - "name": "test-security-demo-websever", - "id": "5975790316485631173" - }, - "provider": "gcp", - "service": { - "name": "GCE" + "id": "5975790316485631173", + "name": "test-security-demo-websever" }, "machine": { "type": "t2d-standard-1" @@ -1148,64 +2249,82 @@ "project": { "id": "elastic-sa" }, + "provider": "gcp", "region": "europe-west2", - "account": { - "id": "elastic-sa" + "service": { + "name": "GCE" } }, - "@timestamp": "2024-07-01T10:49:50.000Z", - "ecs": { - "version": "8.11.0" - }, "data_stream": { + "dataset": "endace.flow", "namespace": "webserver", - "type": "logs", - "dataset": "endace.flow" + "type": "logs" }, - "host": { - "hostname": "webserver", - "os": { - "kernel": "5.10.0-27-cloud-amd64", - "codename": "bullseye", - "name": "Debian GNU/Linux", - "family": "debian", - "type": "linux", - "version": "11 (bullseye)", - "platform": "debian" - }, - "containerized": false, - "ip": [ - "10.100.0.29", - "fe80::4001:aff:fe64:1d" - ], - "name": "webserver", - "id": "28bd70940d6b4dd105977a2b386fc78d", - "mac": [ - "42-01-0A-64-00-1D" - ], - "architecture": "x86_64" + "destination": { + "bytes": 25278, + "ip": "169.254.169.254", + "packets": 5, + "port": 80 + }, + "ecs": { + "version": "8.11.0" + }, + "elastic_agent": { + "id": "322cf2eb-a791-433b-bcc1-b4f5a7896f11", + "snapshot": false, + "version": "8.9.1" }, "event": { - "duration": 61759622403, - "agent_id_status": "verified", - "ingested": "2024-07-01T10:49:51Z", - "kind": "event", - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830922924&end=1719830384684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.100.0.29%26169.254.169.254", - "start": "2024-07-01T10:48:42.924Z", "action": "network_flow", - "end": "2024-07-01T10:49:44.684Z", + "agent_id_status": "verified", "category": [ "network" ], + "dataset": "endace.flow", + "duration": 61759622403, + "end": "2024-07-01T10:49:44.684Z", + "ingested": "2024-07-01T10:49:51Z", + "kind": "event", + "start": "2024-07-01T10:48:42.924Z", "type": [ "connection" - ], - "dataset": "endace.flow" + ] }, "flow": { "final": false, "id": "EAT/////AP//////CP8AAAEKZAAdqf6p/u65UAA" - } + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "webserver", + "id": "28bd70940d6b4dd105977a2b386fc78d", + "ip": [ + "10.100.0.29", + "fe80::4001:aff:fe64:1d" + ], + "mac": [ + "42-01-0A-64-00-1D" + ], + "name": "webserver", + "os": { + "codename": "bullseye", + "family": "debian", + "kernel": "5.10.0-27-cloud-amd64", + "name": "Debian GNU/Linux", + "platform": "debian", + "type": "linux", + "version": "11 (bullseye)" + } + }, + "network": { + "bytes": 25730, + "community_id": "1:ZA5ezPNh0MumdIPxY03oJDcyLd8=", + "packets": 9, + "transport": "tcp", + "type": "ipv4" + }, + "type": "flow" } ] } \ No newline at end of file diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml index 0bdad9bf488..6d75d46036a 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml @@ -8,14 +8,19 @@ processors: if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' tag: endace conversation set - - set: - description: "Set IP Conversation if either destination.ip and source.ip are present" - field: _conf.ipconv - value: "ip={{ source.ip }}{{ destination.ip }}" - if: ctx._conf.ipconv != null && ctx.destination?.ip != null && ctx.destination?.ip != '' || ctx.source?.ip != null && ctx.source?.ip != '' - tag: endace ip set + description: "Set IP Conversation if only destination.ip is present" + field: _conf.ip_conv + value: "ip={{ destination.ip }}" + if: ctx.destination?.ip != null && ctx.destination?.ip != '' && (ctx.source?.ip == null || ctx.source?.ip == '') + tag: endace destination ip set + - set: + description: "Set IP Conversation if only source.ip is present" + field: _conf.ip_conv + value: "ip={{ source.ip }}" + if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && ctx.source?.ip != null && ctx.source?.ip != '' + tag: endace source ip set - date: description: "Convert Start time to Epoch" @@ -26,11 +31,10 @@ processors: if: ctx.event?.start != null && ctx.event?.start != '' - convert: - field: _conf.event.start - type: long - description: "Convert Start time to Long" - if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' - + field: _conf.event.start + type: long + description: "Convert Start time to Long" + if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' - date: description: "Convert End time to Epoch" @@ -40,40 +44,45 @@ processors: output_format: epoch_millis if: ctx.event?.end != null && ctx.event?.end != '' - - convert: - field: _conf.event.end - type: long - description: "Convert End time to Long" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' - + field: _conf.event.end + type: long + description: "Convert End time to Long" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' - script: - source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" - tag: "Calculate Timedelta" - description: "Calculate Timedelta" - if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' - + source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" + tag: "Calculate Timedelta" + description: "Calculate Timedelta" + if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' - script: - source: "ctx._conf.event.end = ctx._conf.event.end - ctx._conf.timedelta" - tag: "Calculate Endtime + additional lookback" - description: "Calculate Endtime + additional lookback" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + source: "ctx._conf.event.end = ctx._conf.event.end + ctx._conf.timedelta/2" + tag: "Calculate Endtime as Timestamp + half of Timedelta" + description: "Calculate Endtime" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + - script: + source: "ctx._conf.event.start = ctx._conf.event.start - ctx._conf.timedelta/2" + tag: "Calculate Starttime as Timestamp - half of Timedelta" + description: "Calculate Endtime" + if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' - set: field: event.reference value: "{{ _conf.endace_url}}/vision2/pivotintovision/?title=endace_pivot&datasources={{_conf.endace_datasources }}&start={{ _conf.event.start }}&end={{ _conf.event.end }}&tools={{ _conf.endace_tools }}&{{ _conf.ip_conv }}" ignore_empty_value: true tag: endace reference url - if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + if: (ctx.destination?.ip != null && ctx.destination?.ip != '') || (ctx.source?.ip != null && ctx.source?.ip != '') + description: "Create P2V URL" on_failure: - append: field: error.message + description: "Error Message" value: |- Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" - set: field: event.kind + description: "Event Kind" value: pipeline_error diff --git a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json index 99ab16f813a..d8a498368a1 100644 --- a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json +++ b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json @@ -101,7 +101,8 @@ }, "destination": { "bytes": 0, - "packets": 0 + "packets": 0, + "ip": "10.36.236.100" }, "_conf": { "endace_url": "https://test.test.local", @@ -203,7 +204,8 @@ }, "source": { "bytes": 1477, - "packets": 6 + "packets": 6, + "ip": "10.127.32.11" }, "network": { "transport": "tcp", diff --git a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json index c4d15424718..1bfc4cf0254 100644 --- a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json +++ b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json @@ -15,6 +15,7 @@ }, "destination": { "bytes": 0, + "ip": "10.36.236.100", "packets": 0 }, "ecs": { @@ -215,6 +216,7 @@ }, "source": { "bytes": 1477, + "ip": "10.127.32.11", "packets": 6 } }, @@ -3177,10 +3179,10 @@ "network" ], "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079068960&end=1587079668963&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.127.32.11%2610.36.236.100", "type": [ "connection" - ], - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079368960&end=1587078768963&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.127.32.11%2610.36.236.100" + ] }, "flow": { "id": "6mUV1nPVG80", @@ -3253,10 +3255,10 @@ "network" ], "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079067995&end=1587079668404&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=89.160.20.112%2610.36.236.100", "type": [ "connection" - ], - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079367995&end=1587078768404&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=89.160.20.112%2610.36.236.100" + ] }, "flow": { "id": "HVg4SttTufc", @@ -3314,7 +3316,7 @@ }, "bytes": 7158, "geo": { - "city_name": "Link\u00f6ping", + "city_name": "Linköping", "continent_name": "Europe", "country_iso_code": "SE", "country_name": "Sweden", @@ -3323,7 +3325,7 @@ "lon": 15.6167 }, "region_iso_code": "SE-E", - "region_name": "\u00d6sterg\u00f6tland County" + "region_name": "Östergötland County" }, "ip": "89.160.20.112", "locality": "external", @@ -3341,7 +3343,7 @@ } }, "geo": { - "city_name": "Link\u00f6ping", + "city_name": "Linköping", "continent_name": "Europe", "country_iso_code": "SE", "country_name": "Sweden", @@ -3350,7 +3352,7 @@ "lon": 15.6167 }, "region_iso_code": "SE-E", - "region_name": "\u00d6sterg\u00f6tland County" + "region_name": "Östergötland County" }, "ip": "89.160.20.112", "locality": "external", @@ -3365,10 +3367,10 @@ "network" ], "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079067920&end=1587079668404&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.36.236.100%2689.160.20.112", "type": [ "connection" - ], - "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1587079367920&end=1587078768404&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip_conv=10.36.236.100%2689.160.20.112" + ] }, "flow": { "id": "HVg4SttTufc", diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml index 2f0b7aa07b2..14fe2e9fc9b 100644 --- a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml @@ -8,13 +8,19 @@ processors: if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' tag: endace conversation set - - set: - description: "Set IP Conversation if either destination.ip and source.ip are present" - field: _conf.ipconv - value: "ip={{ source.ip }}{{ destination.ip }}" - if: ctx._conf.ipconv != null && ctx.destination?.ip != null && ctx.destination?.ip != '' || ctx.source?.ip != null && ctx.source?.ip != '' - tag: endace ip set + - set: + description: "Set IP Conversation if only destination.ip is present" + field: _conf.ip_conv + value: "ip={{ destination.ip }}" + if: ctx.destination?.ip != null && ctx.destination?.ip != '' && (ctx.source?.ip == null || ctx.source?.ip == '') + tag: endace destination ip set + - set: + description: "Set IP Conversation if only source.ip is present" + field: _conf.ip_conv + value: "ip={{ source.ip }}" + if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && ctx.source?.ip != null && ctx.source?.ip != '' + tag: endace source ip set - date: description: "Convert Start time to Epoch" @@ -24,13 +30,11 @@ processors: output_format: epoch_millis if: ctx.netflow?.flow_start_milliseconds != null && ctx.netflow?.flow_start_milliseconds != '' - - convert: - field: _conf.event.start - type: long - description: "Convert Start time to Long" - if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' - + field: _conf.event.start + type: long + description: "Convert Start time to Long" + if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' - date: description: "Convert End time to Epoch" @@ -40,30 +44,34 @@ processors: output_format: epoch_millis if: ctx.netflow?.flow_end_milliseconds != null && ctx.netflow?.flow_end_milliseconds != '' - - convert: - field: _conf.event.end - type: long - description: "Convert End time to Long" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' + field: _conf.event.end + type: long + description: "Convert End time to Long" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' - script: - source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" - tag: "Calculate Timedelta" - description: "Calculate Timedelta" - if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' - + source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" + tag: "Calculate Timedelta" + description: "Calculate Timedelta" + if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' - script: - source: "ctx._conf.event.end = ctx._conf.event.end - ctx._conf.timedelta" - tag: "Calculate Endtime + additional lookback" - description: "Calculate Endtime + additional lookback" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + source: "ctx._conf.event.end = ctx._conf.event.end + ctx._conf.timedelta/2" + tag: "Calculate Endtime as Timestamp + half of Timedelta" + description: "Calculate Endtime + half of lookback" + if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + - script: + source: "ctx._conf.event.start = ctx._conf.event.start - ctx._conf.timedelta/2" + tag: "Calculate Starttime as Timestamp - half of Timedelta" + description: "Calculate Endtime minus half of Timedelta" + if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' - set: field: event.reference value: "{{ _conf.endace_url}}/vision2/pivotintovision/?title=endace_pivot&datasources={{_conf.endace_datasources }}&start={{ _conf.event.start }}&end={{ _conf.event.end }}&tools={{ _conf.endace_tools }}&{{ _conf.ip_conv }}" ignore_empty_value: true tag: endace reference url - if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + if: (ctx.destination?.ip != null && ctx.destination?.ip != '') || (ctx.source?.ip != null && ctx.source?.ip != '') + description: "Create P2V URL" From 0c953955cfb6b84a96e65e9c197aac3d42c550b7 Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 13:54:59 +0000 Subject: [PATCH 15/23] Fixed duplicate tags --- .../flow/elasticsearch/ingest_pipeline/default.yml | 6 +++--- .../flow/elasticsearch/ingest_pipeline/geoip.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml index 228026d07bd..ba5d9cec8d7 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml @@ -20,7 +20,7 @@ processors: pattern: '[-:.]' replacement: '' ignore_missing: true - tag: gsub_host_mac + tag: gsub_host_mac_remove_seperators - gsub: field: host.mac pattern: '(..)(?!$)' @@ -52,7 +52,7 @@ processors: pattern: '[-:.]' replacement: '' ignore_missing: true - tag: gsub_source_mac + tag: gsub_source_mac_remove_seperators - gsub: field: source.mac pattern: '(..)(?!$)' @@ -67,7 +67,7 @@ processors: pattern: '[-:.]' replacement: '' ignore_missing: true - tag: gsub_destination_mac + tag: gsub_destination_mac_remove_seperators - gsub: field: destination.mac pattern: '(..)(?!$)' diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml index eb88d38caf0..62d0462917f 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/geoip.yml @@ -14,7 +14,7 @@ processors: - asn - organization_name ignore_missing: true - tag: source_geo + tag: source_geo_as - rename: field: source.as.asn target_field: source.as.number @@ -37,7 +37,7 @@ processors: - asn - organization_name ignore_missing: true - tag: destination_geo + tag: destination_geo_as - rename: field: destination.as.asn target_field: destination.as.number @@ -60,7 +60,7 @@ processors: - asn - organization_name ignore_missing: true - tag: server_geo + tag: server_geo_as - rename: field: server.as.asn target_field: server.as.number @@ -83,7 +83,7 @@ processors: - asn - organization_name ignore_missing: true - tag: client_geo + tag: client_geo_as - rename: field: client.as.asn target_field: client.as.number From 7e1735f75d381ace776675107e3d1c1ba1ebe7e8 Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 13:57:53 +0000 Subject: [PATCH 16/23] Corrected typo in agent config --- packages/endace/data_stream/flow/agent/stream/flow.yml.hbs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs index c7c3a8ce262..b45b6edf849 100644 --- a/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs +++ b/packages/endace/data_stream/flow/agent/stream/flow.yml.hbs @@ -13,7 +13,7 @@ fields: endace_url: {{ endace_url }} endace_datasources: {{ endace_datasources }} endace_tools: {{ endace_tools }} - endace_lookback": {{ endace_lookback }} + endace_lookback: {{ endace_lookback }} {{#if tags}} tags: {{#each tags as |tag|}} From 667677bc102d29658c2c86ed542d21aeb491173e Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 13:58:30 +0000 Subject: [PATCH 17/23] Updated owners of this package to include upstream owener of the Flow datastream --- .github/CODEOWNERS | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 3c765988f50..9a441adddec 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -152,7 +152,9 @@ /packages/elastic_agent @elastic/elastic-agent /packages/elastic_package_registry @elastic/ecosystem /packages/elasticsearch @elastic/stack-monitoring -/packages/endace @elastic/sec-deployment-and-devices +/packages/endace @elastic/sec-deployment-and-devices @elastic/sec-linux-platform +/packages/endace/data_stream/flow @elastic/sec-linux-platform +/packages/endace/data_stream/ @elastic/sec-deployment-and-devices /packages/enterprisesearch @elastic/stack-monitoring /packages/entityanalytics_ad @elastic/security-service-integrations /packages/entityanalytics_entra_id @elastic/security-service-integrations From 04cb6d42fc8b4ba877472508018a56ac2d74c53e Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 20:00:16 +0000 Subject: [PATCH 18/23] updated docs --- packages/endace/_dev/build/docs/README.md | 30 ++++++++++++++++++++++ packages/endace/docs/README.md | 31 +++++++++++++++++++++++ 2 files changed, 61 insertions(+) diff --git a/packages/endace/_dev/build/docs/README.md b/packages/endace/_dev/build/docs/README.md index 9a6460ee4b9..d1a792f65de 100644 --- a/packages/endace/_dev/build/docs/README.md +++ b/packages/endace/_dev/build/docs/README.md @@ -4,6 +4,36 @@ Endace is a company known for its network recording, traffic capture, and analys This integration allows users to ingest Network flow data from either Endace Flow via syslog input or use Elastic Agent to generate and ship Network Flow data to an Elastic deployment. Both of these methods add the `event.reference` field to each event when ingested into Elasticsearch which is a URL used to pivot to Endace. +## Additional Setup + +### Dataview +Once the integration is deployed, in order for the pivot link to be clickable to format for the `event.reference` field needs to be set, this can be done via Kibana Dev Tools and making the following request: +``` +POST kbn:/api/data_views/data_view/logs-*/fields +{ + "fields": { + "event.reference": { + "format":{ + "id": "url" + } + } + } +} +``` + +### IP Reputation +When in Elastic Security users are able to quickly lookup information about IPs from external services, to add Endace as an IP Reputation lookup service run the following in Kibana Dev Tools. Ensure to replace `` with your Endace appliance URL. + +``` +POST kbn:/api/kibana/settings +{"changes":{"securitySolution:ipReputationLinks": """[ + { "name": "Endace", "url_template": "https:///vision2/v1/pivotintovision/?datasources=tag:all&title=Untitled&reltime=12h&sip={{`{{ip}}`}}&tools=conversations_by_ipaddress" }, + { "name": "virustotal.com", "url_template": "https://www.virustotal.com/gui/search/{{`{{ip}}`}}" }, + { "name": "talosIntelligence.com", "url_template": "https://talosintelligence.com/reputation_center/lookup?search={{`{{ip}}`}}" } +]"""}} +``` + + ## Integration Variables #### `endace_url` The base URL for Endace UI. Example: https://myvprobe.com diff --git a/packages/endace/docs/README.md b/packages/endace/docs/README.md index 99fdadc924c..e0426775db6 100644 --- a/packages/endace/docs/README.md +++ b/packages/endace/docs/README.md @@ -4,6 +4,36 @@ Endace is a company known for its network recording, traffic capture, and analys This integration allows users to ingest Network flow data from either Endace Flow via syslog input or use Elastic Agent to generate and ship Network Flow data to an Elastic deployment. Both of these methods add the `event.reference` field to each event when ingested into Elasticsearch which is a URL used to pivot to Endace. +## Additional Setup + +### Dataview +Once the integration is deployed, in order for the pivot link to be clickable to format for the `event.reference` field needs to be set, this can be done via Kibana Dev Tools and making the following request: +``` +POST kbn:/api/data_views/data_view/logs-*/fields +{ + "fields": { + "event.reference": { + "format":{ + "id": "url" + } + } + } +} +``` + +### IP Reputation +When in Elastic Security users are able to quickly lookup information about IPs from external services, to add Endace as an IP Reputation lookup service run the following in Kibana Dev Tools. Ensure to replace `` with your Endace appliance URL. + +``` +POST kbn:/api/kibana/settings +{"changes":{"securitySolution:ipReputationLinks": """[ + { "name": "Endace", "url_template": "https:///vision2/v1/pivotintovision/?datasources=tag:all&title=Untitled&reltime=12h&sip={{ip}}&tools=conversations_by_ipaddress" }, + { "name": "virustotal.com", "url_template": "https://www.virustotal.com/gui/search/{{ip}}" }, + { "name": "talosIntelligence.com", "url_template": "https://talosintelligence.com/reputation_center/lookup?search={{ip}}" } +]"""}} +``` + + ## Integration Variables #### `endace_url` The base URL for Endace UI. Example: https://myvprobe.com @@ -202,6 +232,7 @@ The default value is 10s. | event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.reference | Reference URL linking to additional information about this event. This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | | event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | From d6d46722f62774d735cef8a6884cbb3de365903a Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 20:00:58 +0000 Subject: [PATCH 19/23] Added reference field --- packages/endace/data_stream/flow/fields/ecs.yml | 2 ++ packages/endace/data_stream/log/fields/ecs.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/packages/endace/data_stream/flow/fields/ecs.yml b/packages/endace/data_stream/flow/fields/ecs.yml index 7b52299ab76..dbc20b5c446 100644 --- a/packages/endace/data_stream/flow/fields/ecs.yml +++ b/packages/endace/data_stream/flow/fields/ecs.yml @@ -26,6 +26,8 @@ name: event.end - external: ecs name: event.kind +- external: ecs + name: event.reference - external: ecs name: event.start - external: ecs diff --git a/packages/endace/data_stream/log/fields/ecs.yml b/packages/endace/data_stream/log/fields/ecs.yml index c25e61cef3c..d53120fc686 100644 --- a/packages/endace/data_stream/log/fields/ecs.yml +++ b/packages/endace/data_stream/log/fields/ecs.yml @@ -221,6 +221,8 @@ name: event.outcome - external: ecs name: event.provider +- external: ecs + name: event.reference - external: ecs name: event.risk_score - external: ecs From 154d45f0c1c8e5a28ca97ec2ac7efe64fc682f4e Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 21:51:28 +0000 Subject: [PATCH 20/23] Fixed pipeline tags, operator grouping and tests --- .../test-flow-events.json-expected.json | 10 +++++++ .../elasticsearch/ingest_pipeline/default.yml | 24 ++++++++++++++--- .../elasticsearch/ingest_pipeline/endace.yml | 10 +++---- ...test-netflow-log-events.json-expected.json | 2 ++ .../elasticsearch/ingest_pipeline/default.yml | 26 ++++++++++++++++--- .../ingest_pipeline/endace-netflow.yml | 10 +++---- 6 files changed, 66 insertions(+), 16 deletions(-) diff --git a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json index 40744a87df2..d237ef69fa7 100644 --- a/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json +++ b/packages/endace/data_stream/flow/_dev/test/pipeline/test-flow-events.json-expected.json @@ -1261,6 +1261,7 @@ "end": "2024-07-01T10:49:44.684Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830619852&end=1719831284684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=127.0.0.1", "start": "2024-07-01T10:48:39.852Z", "type": [ "connection" @@ -1385,6 +1386,7 @@ "end": "2024-07-01T10:49:40.076Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830619852&end=1719831280076&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=81.2.69.144", "start": "2024-07-01T10:48:39.852Z", "type": [ "connection" @@ -1524,6 +1526,7 @@ "end": "2024-07-01T10:49:41.100Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830620363&end=1719831281100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=81.2.69.144", "start": "2024-07-01T10:48:40.363Z", "type": [ "connection" @@ -1643,6 +1646,7 @@ "end": "2024-07-01T10:49:41.100Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830620364&end=1719831281100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=81.2.69.144", "start": "2024-07-01T10:48:40.364Z", "type": [ "connection" @@ -1738,6 +1742,7 @@ "end": "2024-07-01T10:49:45.708Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830620364&end=1719831285708&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=127.0.0.1", "start": "2024-07-01T10:48:40.364Z", "type": [ "connection" @@ -1863,6 +1868,7 @@ "end": "2024-07-01T10:49:41.100Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830621388&end=1719831281100&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=81.2.69.144", "start": "2024-07-01T10:48:41.388Z", "type": [ "connection" @@ -1982,6 +1988,7 @@ "end": "2024-07-01T10:49:48.268Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830621388&end=1719831288268&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=81.2.69.144", "start": "2024-07-01T10:48:41.388Z", "type": [ "connection" @@ -2077,6 +2084,7 @@ "end": "2024-07-01T10:49:49.292Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830621900&end=1719831289292&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=10.100.0.29", "start": "2024-07-01T10:48:41.900Z", "type": [ "connection" @@ -2178,6 +2186,7 @@ "end": "2024-07-01T10:49:42.124Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830622412&end=1719831282124&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=127.0.0.1", "start": "2024-07-01T10:48:42.412Z", "type": [ "connection" @@ -2285,6 +2294,7 @@ "end": "2024-07-01T10:49:44.684Z", "ingested": "2024-07-01T10:49:51Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=1719830622924&end=1719831284684&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=169.254.169.254", "start": "2024-07-01T10:48:42.924Z", "type": [ "connection" diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml index ba5d9cec8d7..be13b30eea8 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/default.yml @@ -4,6 +4,7 @@ processors: - set: field: ecs.version value: '8.11.0' + tag: set_ecs_version # ECS compatibility pipeline - pipeline: @@ -21,20 +22,26 @@ processors: replacement: '' ignore_missing: true tag: gsub_host_mac_remove_seperators + - gsub: field: host.mac pattern: '(..)(?!$)' replacement: '$1-' ignore_missing: true tag: gsub_host_mac + - uppercase: field: host.mac ignore_missing: true + tag: uppercase_host_mac + - append: field: related.hosts value: "{{{observer.hostname}}}" if: ctx.observer?.hostname != null && ctx.observer.hostname != '' allow_duplicates: false + tag: append_observer_hostname + - foreach: if: ctx.observer?.ip != null && ctx.observer.ip instanceof List tag: foreach_observer_ip @@ -44,53 +51,64 @@ processors: field: related.ip value: '{{{_ingest._value}}}' allow_duplicates: false + - remove: if: ctx.host != null && ctx.tags != null && ctx.tags.contains('forwarded') field: host + tag: remove_host_if_forwarded + - gsub: field: source.mac pattern: '[-:.]' replacement: '' ignore_missing: true tag: gsub_source_mac_remove_seperators + - gsub: field: source.mac pattern: '(..)(?!$)' replacement: '$1-' ignore_missing: true tag: gsub_source_mac + - uppercase: field: source.mac ignore_missing: true + tag: uppercase_source_mac + - gsub: field: destination.mac pattern: '[-:.]' replacement: '' ignore_missing: true tag: gsub_destination_mac_remove_seperators + - gsub: field: destination.mac pattern: '(..)(?!$)' replacement: '$1-' ignore_missing: true tag: gsub_destination_mac + - uppercase: field: destination.mac ignore_missing: true + tag: uppercase_destination_mac - pipeline: if: ctx._conf?.geoip_enrich != null && ctx._conf.geoip_enrich name: '{{ IngestPipeline "geoip" }}' - tag: pipeline_processor + tag: pipeline_processor_geoip - pipeline: name: '{{ IngestPipeline "endace" }}' - tag: pipeline_processor - if: ctx.source?.ip != null && ctx.destination?.ip != null && ctx.source?.ip != '0.0.0.0' && ctx.destination?.ip != '0.0.0.0' + if: (ctx.source?.ip != null || ctx.destination?.ip != null) && (ctx.source?.ip != '0.0.0.0' && ctx.destination?.ip != '0.0.0.0') + tag: pipeline_processor_endace - remove: field: _conf ignore_missing: true + tag: remove_conf on_failure: - append: diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml index 6d75d46036a..cec04f8a4bf 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml @@ -5,21 +5,21 @@ processors: description: "Set IP Conversation if both destination.ip and source.ip are present" field: _conf.ip_conv value: "ip_conv={{ source.ip }}%26{{ destination.ip }}" - if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + if: (ctx.destination?.ip != null && ctx.destination?.ip != '') && (ctx.source?.ip != null && ctx.source?.ip != '') tag: endace conversation set - set: description: "Set IP Conversation if only destination.ip is present" field: _conf.ip_conv value: "ip={{ destination.ip }}" - if: ctx.destination?.ip != null && ctx.destination?.ip != '' && (ctx.source?.ip == null || ctx.source?.ip == '') + if: (ctx.destination?.ip != null && ctx.destination?.ip != '') && (ctx.source?.ip == null || ctx.source?.ip == '') tag: endace destination ip set - set: description: "Set IP Conversation if only source.ip is present" field: _conf.ip_conv value: "ip={{ source.ip }}" - if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && ctx.source?.ip != null && ctx.source?.ip != '' + if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && (ctx.source?.ip != null && ctx.source?.ip != '') tag: endace source ip set - date: @@ -60,13 +60,13 @@ processors: source: "ctx._conf.event.end = ctx._conf.event.end + ctx._conf.timedelta/2" tag: "Calculate Endtime as Timestamp + half of Timedelta" description: "Calculate Endtime" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + if: (ctx._conf?.event?.end != null && ctx._conf?.event?.end != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') - script: source: "ctx._conf.event.start = ctx._conf.event.start - ctx._conf.timedelta/2" tag: "Calculate Starttime as Timestamp - half of Timedelta" description: "Calculate Endtime" - if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + if: (ctx._conf?.event?.start != null && ctx._conf?.event?.start != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') - set: field: event.reference diff --git a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json index 1bfc4cf0254..3bfddfa3d57 100644 --- a/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json +++ b/packages/endace/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json @@ -29,6 +29,7 @@ ], "created": "2021-05-19T09:08:51.938Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=&end=&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=10.36.236.100", "type": [ "connection" ] @@ -138,6 +139,7 @@ ], "created": "2021-05-19T09:08:51.938Z", "kind": "event", + "reference": "https://test.test.local/vision2/pivotintovision/?title=endace_pivot&datasources=tag:rotation-file&start=&end=&tools=trafficOverTime_by_app,conversations_by_ipaddress&ip=10.127.32.11", "type": [ "connection" ] diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml index f01170ba54e..978620ce9dc 100644 --- a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -5,69 +5,83 @@ processors: - set: field: ecs.version value: '8.11.0' + tag: add_ecs_version - convert: field: network.iana_number type: string ignore_missing: true ignore_failure: true + tag: convert_network_iana_number - rename: field: observer.ip target_field: _tmp_.observer.ip ignore_missing: true + tag: rename_observer_ip - append: field: observer.ip value: '{{_tmp_.observer.ip}}' if: ctx._tmp_?.observer?.ip != null + tag: append_observer_ip - set: field: event.category value: - network - session if: ctx.event?.category != null && ctx.event?.category == "network_session" + tag: set_event_category - set: field: network.type value: ipv4 if: ctx.netflow?.source_ipv4_address != null || ctx.netflow?.destination_ipv4_address != null + tag: set_network_type_ipv4 - set: field: network.type value: ipv6 if: (ctx.netflow?.source_ipv6_address != null || ctx.netflow?.destination_ipv6_address != null) && ctx.network?.type == null + tag: set_network_type_ipv6 - append: field: network.type value: ipv6 if: (ctx.netflow?.source_ipv6_address != null || ctx.netflow?.destination_ipv6_address != null) && ctx.network?.type == "ipv4" + tag: append_network_type_ipv6 - set: field: network.direction value: inbound if: ctx.source?.locality == "external" && ctx.destination?.locality == "internal" + tag: set_network_direction_inbound - set: field: network.direction value: outbound if: ctx.source?.locality == "internal" && ctx.destination?.locality == "external" + tag: set_network_direction_outbound - set: field: network.direction value: internal if: ctx.source?.locality == "internal" && ctx.destination?.locality == "internal" + tag: set_network_direction_internal - set: field: network.direction value: external if: ctx.source?.locality == "external" && ctx.destination?.locality == "external" + tag: set_network_direction_external - set: field: network.direction value: unknown if: ctx.network?.direction == null - + tag: set_network_direction # IP Geolocation Lookup - geoip: if: ctx.source?.geo == null field: source.ip target_field: source.geo ignore_missing: true + tag: geoip_source_lookup - geoip: if: ctx.destination?.geo == null field: destination.ip target_field: destination.geo - ignore_missing: true + ignore_missing: true + tag: geoip_destination_lookup # IP Autonomous System (AS) Lookup - geoip: @@ -78,6 +92,7 @@ processors: - asn - organization_name ignore_missing: true + tag: geoip_source_as_lookup - geoip: database_file: GeoLite2-ASN.mmdb field: destination.ip @@ -86,22 +101,27 @@ processors: - asn - organization_name ignore_missing: true + tag: geoip_dest_as_lookup - rename: field: source.as.asn target_field: source.as.number ignore_missing: true + tag: rename_source_as_field_asn - rename: field: source.as.organization_name target_field: source.as.organization.name ignore_missing: true + tag: rename_source_as_field_org - rename: field: destination.as.asn target_field: destination.as.number ignore_missing: true + tag: rename_as_field_asn - rename: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + tag: rename_as_field_org - remove: field: - _tmp_ @@ -109,7 +129,7 @@ processors: - pipeline: name: '{{ IngestPipeline "endace-netflow" }}' tag: pipeline_processor - if: ctx.source?.ip != null && ctx.destination?.ip != null && ctx.source?.ip != '0.0.0.0' && ctx.destination?.ip != '0.0.0.0' + if: (ctx.source?.ip != null || ctx.destination?.ip != null) && (ctx.source?.ip != '0.0.0.0' && ctx.destination?.ip != '0.0.0.0') - remove: field: "_conf" on_failure: diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml index 14fe2e9fc9b..4ae2420ff1a 100644 --- a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml @@ -5,21 +5,21 @@ processors: description: "Set IP Conversation if both destination.ip and source.ip are present" field: _conf.ip_conv value: "ip_conv={{ source.ip }}%26{{ destination.ip }}" - if: ctx.destination?.ip != null && ctx.destination?.ip != '' && ctx.source?.ip != null && ctx.source?.ip != '' + if: (ctx.destination?.ip != null && ctx.destination?.ip != '') && ( ctx.source?.ip != null && ctx.source?.ip != '' ) tag: endace conversation set - set: description: "Set IP Conversation if only destination.ip is present" field: _conf.ip_conv value: "ip={{ destination.ip }}" - if: ctx.destination?.ip != null && ctx.destination?.ip != '' && (ctx.source?.ip == null || ctx.source?.ip == '') + if: (ctx.destination?.ip != null && ctx.destination?.ip != '') && (ctx.source?.ip == null || ctx.source?.ip == '') tag: endace destination ip set - set: description: "Set IP Conversation if only source.ip is present" field: _conf.ip_conv value: "ip={{ source.ip }}" - if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && ctx.source?.ip != null && ctx.source?.ip != '' + if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && (ctx.source?.ip != null && ctx.source?.ip != '') tag: endace source ip set - date: @@ -60,13 +60,13 @@ processors: source: "ctx._conf.event.end = ctx._conf.event.end + ctx._conf.timedelta/2" tag: "Calculate Endtime as Timestamp + half of Timedelta" description: "Calculate Endtime + half of lookback" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + if: (ctx._conf?.event?.end != null && ctx._conf?.event?.end != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') - script: source: "ctx._conf.event.start = ctx._conf.event.start - ctx._conf.timedelta/2" tag: "Calculate Starttime as Timestamp - half of Timedelta" description: "Calculate Endtime minus half of Timedelta" - if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' && ctx._conf?.timedelta != null && ctx._conf?.timedelta != '' + if: (ctx._conf?.event?.start != null && ctx._conf?.event?.start != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') - set: field: event.reference From fafac5045175db7505177c99ffeb9b9290dd9ef5 Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 22:07:04 +0000 Subject: [PATCH 21/23] Removed redundant ? operators --- .../elasticsearch/ingest_pipeline/endace.yml | 20 ++++++++--------- .../ingest_pipeline/endace-netflow.yml | 22 +++++++++---------- 2 files changed, 21 insertions(+), 21 deletions(-) diff --git a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml index cec04f8a4bf..d6a1399695e 100644 --- a/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml +++ b/packages/endace/data_stream/flow/elasticsearch/ingest_pipeline/endace.yml @@ -12,14 +12,14 @@ processors: description: "Set IP Conversation if only destination.ip is present" field: _conf.ip_conv value: "ip={{ destination.ip }}" - if: (ctx.destination?.ip != null && ctx.destination?.ip != '') && (ctx.source?.ip == null || ctx.source?.ip == '') + if: (ctx.destination?.ip != null && ctx.destination.ip != '') && (ctx.source?.ip == null || ctx.source?.ip == '') tag: endace destination ip set - set: description: "Set IP Conversation if only source.ip is present" field: _conf.ip_conv value: "ip={{ source.ip }}" - if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && (ctx.source?.ip != null && ctx.source?.ip != '') + if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && (ctx.source?.ip != null && ctx.source.ip != '') tag: endace source ip set - date: @@ -28,13 +28,13 @@ processors: formats: ["ISO8601"] target_field: _conf.event.start output_format: epoch_millis - if: ctx.event?.start != null && ctx.event?.start != '' + if: ctx.event?.start != null && ctx.event.start != '' - convert: field: _conf.event.start type: long description: "Convert Start time to Long" - if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' + if: ctx._conf?.event?.start != null && ctx._conf.event.start != '' - date: description: "Convert End time to Epoch" @@ -42,38 +42,38 @@ processors: formats: ["ISO8601"] target_field: _conf.event.end output_format: epoch_millis - if: ctx.event?.end != null && ctx.event?.end != '' + if: ctx.event?.end != null && ctx.event.end != '' - convert: field: _conf.event.end type: long description: "Convert End time to Long" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' + if: ctx._conf?.event?.end != null && ctx._conf.event.end != '' - script: source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" tag: "Calculate Timedelta" description: "Calculate Timedelta" - if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' + if: ctx._conf?.endace_lookback != null && ctx._conf.endace_lookback != '' - script: source: "ctx._conf.event.end = ctx._conf.event.end + ctx._conf.timedelta/2" tag: "Calculate Endtime as Timestamp + half of Timedelta" description: "Calculate Endtime" - if: (ctx._conf?.event?.end != null && ctx._conf?.event?.end != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') + if: (ctx._conf?.event?.end != null && ctx._conf.event.end != '') && (ctx._conf?.timedelta != null && ctx._conf.timedelta != '') - script: source: "ctx._conf.event.start = ctx._conf.event.start - ctx._conf.timedelta/2" tag: "Calculate Starttime as Timestamp - half of Timedelta" description: "Calculate Endtime" - if: (ctx._conf?.event?.start != null && ctx._conf?.event?.start != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') + if: (ctx._conf?.event?.start != null && ctx._conf.event.start != '') && (ctx._conf?.timedelta != null && ctx._conf.timedelta != '') - set: field: event.reference value: "{{ _conf.endace_url}}/vision2/pivotintovision/?title=endace_pivot&datasources={{_conf.endace_datasources }}&start={{ _conf.event.start }}&end={{ _conf.event.end }}&tools={{ _conf.endace_tools }}&{{ _conf.ip_conv }}" ignore_empty_value: true tag: endace reference url - if: (ctx.destination?.ip != null && ctx.destination?.ip != '') || (ctx.source?.ip != null && ctx.source?.ip != '') + if: (ctx.destination?.ip != null && ctx.destination.ip != '') || (ctx.source?.ip != null && ctx.source.ip != '') description: "Create P2V URL" on_failure: diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml index 4ae2420ff1a..081b576785c 100644 --- a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/endace-netflow.yml @@ -5,21 +5,21 @@ processors: description: "Set IP Conversation if both destination.ip and source.ip are present" field: _conf.ip_conv value: "ip_conv={{ source.ip }}%26{{ destination.ip }}" - if: (ctx.destination?.ip != null && ctx.destination?.ip != '') && ( ctx.source?.ip != null && ctx.source?.ip != '' ) + if: (ctx.destination?.ip != null && ctx.destination.ip != '') && ( ctx.source?.ip != null && ctx.source.ip != '' ) tag: endace conversation set - set: description: "Set IP Conversation if only destination.ip is present" field: _conf.ip_conv value: "ip={{ destination.ip }}" - if: (ctx.destination?.ip != null && ctx.destination?.ip != '') && (ctx.source?.ip == null || ctx.source?.ip == '') + if: (ctx.destination?.ip != null && ctx.destination.ip != '') && (ctx.source?.ip == null || ctx.source?.ip == '') tag: endace destination ip set - set: description: "Set IP Conversation if only source.ip is present" field: _conf.ip_conv value: "ip={{ source.ip }}" - if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && (ctx.source?.ip != null && ctx.source?.ip != '') + if: (ctx.destination?.ip == null || ctx.destination?.ip == '') && (ctx.source?.ip != null && ctx.source.ip != '') tag: endace source ip set - date: @@ -28,13 +28,13 @@ processors: formats: ["ISO8601"] target_field: _conf.event.start output_format: epoch_millis - if: ctx.netflow?.flow_start_milliseconds != null && ctx.netflow?.flow_start_milliseconds != '' + if: ctx.netflow?.flow_start_milliseconds != null && ctx.netflow.flow_start_milliseconds != '' - convert: field: _conf.event.start type: long description: "Convert Start time to Long" - if: ctx._conf?.event?.start != null && ctx._conf?.event?.start != '' + if: ctx._conf?.event?.start != null && ctx._conf.event.start != '' - date: description: "Convert End time to Epoch" @@ -42,36 +42,36 @@ processors: formats: ["ISO8601"] target_field: _conf.event.end output_format: epoch_millis - if: ctx.netflow?.flow_end_milliseconds != null && ctx.netflow?.flow_end_milliseconds != '' + if: ctx.netflow?.flow_end_milliseconds != null && ctx.netflow.flow_end_milliseconds != '' - convert: field: _conf.event.end type: long description: "Convert End time to Long" - if: ctx._conf?.event?.end != null && ctx._conf?.event?.end != '' + if: ctx._conf?.event?.end != null && ctx._conf.event.end != '' - script: source: "ctx._conf.timedelta = ctx._conf.endace_lookback * 60 * 1000" tag: "Calculate Timedelta" description: "Calculate Timedelta" - if: ctx._conf?.endace_lookback != null && ctx._conf?.endace_lookback != '' + if: ctx._conf?.endace_lookback != null && ctx._conf.endace_lookback != '' - script: source: "ctx._conf.event.end = ctx._conf.event.end + ctx._conf.timedelta/2" tag: "Calculate Endtime as Timestamp + half of Timedelta" description: "Calculate Endtime + half of lookback" - if: (ctx._conf?.event?.end != null && ctx._conf?.event?.end != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') + if: (ctx._conf?.event?.end != null && ctx._conf.event.end != '') && (ctx._conf?.timedelta != null && ctx._conf.timedelta != '') - script: source: "ctx._conf.event.start = ctx._conf.event.start - ctx._conf.timedelta/2" tag: "Calculate Starttime as Timestamp - half of Timedelta" description: "Calculate Endtime minus half of Timedelta" - if: (ctx._conf?.event?.start != null && ctx._conf?.event?.start != '') && (ctx._conf?.timedelta != null && ctx._conf?.timedelta != '') + if: (ctx._conf?.event?.start != null && ctx._conf.event.start != '') && (ctx._conf?.timedelta != null && ctx._conf.timedelta != '') - set: field: event.reference value: "{{ _conf.endace_url}}/vision2/pivotintovision/?title=endace_pivot&datasources={{_conf.endace_datasources }}&start={{ _conf.event.start }}&end={{ _conf.event.end }}&tools={{ _conf.endace_tools }}&{{ _conf.ip_conv }}" ignore_empty_value: true tag: endace reference url - if: (ctx.destination?.ip != null && ctx.destination?.ip != '') || (ctx.source?.ip != null && ctx.source?.ip != '') + if: (ctx.destination?.ip != null && ctx.destination.ip != '') || (ctx.source?.ip != null && ctx.source.ip != '') description: "Create P2V URL" From 505622d2f10f0d11b4838c991525941bd63dbd72 Mon Sep 17 00:00:00 2001 From: James Garside Date: Mon, 22 Jul 2024 23:13:57 +0100 Subject: [PATCH 22/23] Update CODEOWNERS --- .github/CODEOWNERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 9a441adddec..0bc8a980149 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -154,7 +154,7 @@ /packages/elasticsearch @elastic/stack-monitoring /packages/endace @elastic/sec-deployment-and-devices @elastic/sec-linux-platform /packages/endace/data_stream/flow @elastic/sec-linux-platform -/packages/endace/data_stream/ @elastic/sec-deployment-and-devices +/packages/endace/data_stream/log @elastic/sec-deployment-and-devices /packages/enterprisesearch @elastic/stack-monitoring /packages/entityanalytics_ad @elastic/security-service-integrations /packages/entityanalytics_entra_id @elastic/security-service-integrations From f1405b0d6e950b5752a9b0efa8cdb98a1e2156bf Mon Sep 17 00:00:00 2001 From: James Garside Date: Fri, 26 Jul 2024 16:51:10 +0100 Subject: [PATCH 23/23] Add failure Co-authored-by: Taylor Swanson <90622908+taylor-swanson@users.noreply.github.com> --- .../data_stream/log/elasticsearch/ingest_pipeline/default.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 978620ce9dc..a781774a3ee 100644 --- a/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/endace/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -138,4 +138,4 @@ on_failure: value: pipeline_error - append: field: error.message - value: '{{{ _ingest.on_failure_message }}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'