forked from elastic/ecs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
server.yml
121 lines (102 loc) · 4.01 KB
/
server.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
---
- name: server
title: Server
group: 2
short: Fields about the server side of a network connection, used with client.
description: >
A Server is defined as the responder in a network connection for events regarding sessions, connections, or bidirectional flow records.
For TCP events, the server is the receiver of the initial SYN packet(s) of the TCP connection.
For other protocols, the server is generally the responder in the network transaction.
Some systems actually use the term "responder" to refer the server in TCP connections.
The server fields describe details about the system acting as the server in the network event.
Server fields are usually populated in conjunction with client fields.
Server fields are generally not populated for packet-level events.
Client / server representations can add semantic context to an exchange,
which is helpful to visualize the data in certain situations.
If your context falls in that category, you should still ensure that source and destination are filled appropriately.
type: group
fields:
- name: address
level: extended
type: keyword
short: Server network address.
description: >
Some event server addresses are defined ambiguously. The event will
sometimes list an IP, a domain or a unix socket. You should always
store the raw address in the `.address` field.
Then it should be duplicated to `.ip` or `.domain`, depending on which
one it is.
- name: ip
level: core
type: ip
short: IP address of the server.
description: >
IP address of the server (IPv4 or IPv6).
- name: port
format: string
level: core
type: long
description: >
Port of the server.
- name: mac
level: core
type: keyword
description: >
MAC address of the server.
- name: domain
level: core
type: keyword
description: >
Server domain.
- name: registered_domain
level: extended
type: keyword
short: The highest registered server domain, stripped of the subdomain.
description: >
The highest registered server domain, stripped of the subdomain.
For example, the registered domain for "foo.google.com" is "google.com".
This value can be determined precisely with a list like the public
suffix list (http://publicsuffix.org). Trying to approximate this by
simply taking the last two labels will not work well for TLDs such as "co.uk".
example: google.com
- name: top_level_domain
level: extended
type: keyword
short: The effective top level domain (com, org, net, co.uk).
description: >
The effective top level domain (eTLD), also known as the domain suffix,
is the last part of the domain name.
For example, the top level domain for google.com is "com".
This value can be determined precisely with a list like the public
suffix list (http://publicsuffix.org). Trying to approximate this by
simply taking the last label will not work well for effective TLDs such as "co.uk".
example: co.uk
# Metrics
- name: bytes
format: bytes
level: core
type: long
example: 184
description: >
Bytes sent from the server to the client.
- name: packets
level: core
type: long
example: 12
description: >
Packets sent from the server to the client.
- name: nat.ip
level: extended
type: ip
short: Server NAT ip
description: >
Translated ip of destination based NAT sessions (e.g. internet to private DMZ)
Typically used with load balancers, firewalls, or routers.
- name: nat.port
format: string
level: extended
type: long
short: Server NAT port
description: >
Translated port of destination based NAT sessions (e.g. internet to private DMZ)
Typically used with load balancers, firewalls, or routers.