Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

living target for ECS #528

Closed
5 of 29 tasks
neu5ron opened this issue Dec 17, 2019 · 1 comment
Closed
5 of 29 tasks

living target for ECS #528

neu5ron opened this issue Dec 17, 2019 · 1 comment
Assignees
@neu5ron
Labels
Other Repo Tag for when the issue needs to be fixed in one of the other rock repos

Comments

@neu5ron
Copy link
Contributor

neu5ron commented Dec 17, 2019 •
edited
Loading

Logstash

  • Document or note new ECS fields
    • TLS
    • Threat
    • Rule
    • DNS
      • sub_domain
      • top_level_domain
    • Domain
      • sub_domain
      • top_level_domain
  • Document or note new ECS fields for Zeek
    • TLS
      • ssl.log
      • no other logs that seem to apply, maybe a field or two in rdp.log or smtp.log but they i would say no...
    • notice.log to rule.name
  • Document or note new Suricata
    • TLS
      • tls log
        • generate logs with extended/custom
    • alert log to rule schema
  • Update logstash config for Zeek
    • TLS
  • Update logstash config for Suricata
    • TLS

Kibana

  • Update migration dashboards for Zeek
  • Update migration dashboards for Suricata
  • Tweak docket pivot
  • Check any other dashboards
  • Test / Save everything for 7.5 objects
@neu5ron neu5ron added the Other Repo Tag for when the issue needs to be fixed in one of the other rock repos label Dec 17, 2019
@neu5ron
Copy link
Contributor Author

neu5ron commented Dec 20, 2019

moved to rocknsm/rock-dashboards#46 like a normal human being would logically place it..

@neu5ron neu5ron closed this as completed Dec 20, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@neu5ron neu5ron

Labels
Other Repo Tag for when the issue needs to be fixed in one of the other rock repos
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@neu5ron