Skip to content

[Azure] set event.module and event.dataset #1238

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtojek merged 3 commits into from
Jun 29, 2021
Merged

[Azure] set event.module and event.dataset #1238

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
60f3d20
[Azure] set event.module and event.dataset
Jun 29, 2021
1d8597e
Fix
Jun 29, 2021
8704505
Fix
Jun 29, 2021
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/azure/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "0.4.0"
changes:
- description: Set "event.module" and "event.dataset"
type: enhancement
link: https://github.com/elastic/integrations/pull/1238
- version: "0.3.1"
changes:
- description: sync package with module changes
Expand Down
17 changes: 8 additions & 9 deletions packages/azure/data_stream/activitylogs/fields/base-fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,14 @@
- name: data_stream.namespace
type: constant_keyword
description: Data stream namespace.
- name: dataset.type

@ruflin ruflin Jun 30, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mtojek Good catch. At first I thought you removed the fields but these were duplicated 😌
type: constant_keyword
description: Dataset type.
- name: dataset.name
type: constant_keyword
description: Dataset name.
- name: dataset.namespace
type: constant_keyword
description: Dataset namespace.
- name: '@timestamp'
type: date
description: Event timestamp.
- name: event.module
type: constant_keyword
description: Event module
value: azure
- name: event.dataset
type: constant_keyword
description: Event dataset
value: azure.activitylogs
17 changes: 8 additions & 9 deletions packages/azure/data_stream/auditlogs/fields/base-fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,14 @@
- name: data_stream.namespace
type: constant_keyword
description: Data stream namespace.
- name: dataset.type
type: constant_keyword
description: Dataset type.
- name: dataset.name
type: constant_keyword
description: Dataset name.
- name: dataset.namespace
type: constant_keyword
description: Dataset namespace.
- name: '@timestamp'
type: date
description: Event timestamp.
- name: event.module
type: constant_keyword
description: Event module
value: azure
- name: event.dataset
type: constant_keyword
description: Event dataset
value: azure.auditlogs
17 changes: 8 additions & 9 deletions packages/azure/data_stream/platformlogs/fields/base-fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,14 @@
- name: data_stream.namespace
type: constant_keyword
description: Data stream namespace.
- name: dataset.type
type: constant_keyword
description: Dataset type.
- name: dataset.name
type: constant_keyword
description: Dataset name.
- name: dataset.namespace
type: constant_keyword
description: Dataset namespace.
- name: '@timestamp'
type: date
description: Event timestamp.
- name: event.module
type: constant_keyword
description: Event module
value: azure
- name: event.dataset
type: constant_keyword
description: Event dataset
value: azure.platformlogs
17 changes: 8 additions & 9 deletions packages/azure/data_stream/signinlogs/fields/base-fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,14 @@
- name: data_stream.namespace
type: constant_keyword
description: Data stream namespace.
- name: dataset.type
type: constant_keyword
description: Dataset type.
- name: dataset.name
type: constant_keyword
description: Dataset name.
- name: dataset.namespace
type: constant_keyword
description: Dataset namespace.
- name: '@timestamp'
type: date
description: Event timestamp.
- name: event.module
type: constant_keyword
description: Event module
value: azure
- name: event.dataset
type: constant_keyword
description: Event dataset
value: azure.signinlogs
20 changes: 8 additions & 12 deletions packages/azure/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,9 +201,6 @@ An example event for `activitylogs` looks as following:
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| dataset.name | Dataset name. | constant_keyword |
| dataset.namespace | Dataset namespace. | constant_keyword |
| dataset.type | Dataset type. | constant_keyword |
| destination.address | Destination network address. | keyword |
| destination.as.number | Unique number allocated to the autonomous system. | long |
| destination.as.organization.name | Organization name. | keyword |
Expand All @@ -222,9 +219,11 @@ An example event for `activitylogs` looks as following:
| event.action | The action captured by the event. | keyword |
| event.category | Event category. The second categorization field in the hierarchy. | keyword |
| event.created | Time when the event was first read by an agent or by your pipeline. | date |
| event.dataset | Event dataset | constant_keyword |
| event.id | Unique ID to describe the event. | keyword |
| event.ingested | Timestamp when an event arrived in the central data store. | date |
| event.kind | The kind of the event. The highest categorization field in the hierarchy. | keyword |
| event.module | Event module | constant_keyword |
| event.type | Event type. The third categorization field in the hierarchy. | keyword |
| file.mime_type | Media type of file, document, or arrangement of bytes. | keyword |
| file.size | File size in bytes. | long |
Expand Down Expand Up @@ -385,9 +384,6 @@ An example event for `platformlogs` looks as following:
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| dataset.name | Dataset name. | constant_keyword |
| dataset.namespace | Dataset namespace. | constant_keyword |
| dataset.type | Dataset type. | constant_keyword |
| destination.address | Destination network address. | keyword |
| destination.as.number | Unique number allocated to the autonomous system. | long |
| destination.as.organization.name | Organization name. | keyword |
Expand All @@ -406,9 +402,11 @@ An example event for `platformlogs` looks as following:
| event.action | The action captured by the event. | keyword |
| event.category | Event category. The second categorization field in the hierarchy. | keyword |
| event.created | Time when the event was first read by an agent or by your pipeline. | date |
| event.dataset | Event dataset | constant_keyword |
| event.id | Unique ID to describe the event. | keyword |
| event.ingested | Timestamp when an event arrived in the central data store. | date |
| event.kind | The kind of the event. The highest categorization field in the hierarchy. | keyword |
| event.module | Event module | constant_keyword |
| event.type | Event type. The third categorization field in the hierarchy. | keyword |
| file.mime_type | Media type of file, document, or arrangement of bytes. | keyword |
| file.size | File size in bytes. | long |
Expand Down Expand Up @@ -572,9 +570,6 @@ An example event for `auditlogs` looks as following:
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| dataset.name | Dataset name. | constant_keyword |
| dataset.namespace | Dataset namespace. | constant_keyword |
| dataset.type | Dataset type. | constant_keyword |
| destination.address | Destination network address. | keyword |
| destination.as.number | Unique number allocated to the autonomous system. | long |
| destination.as.organization.name | Organization name. | keyword |
Expand All @@ -593,9 +588,11 @@ An example event for `auditlogs` looks as following:
| event.action | The action captured by the event. | keyword |
| event.category | Event category. The second categorization field in the hierarchy. | keyword |
| event.created | Time when the event was first read by an agent or by your pipeline. | date |
| event.dataset | Event dataset | constant_keyword |
| event.id | Unique ID to describe the event. | keyword |
| event.ingested | Timestamp when an event arrived in the central data store. | date |
| event.kind | The kind of the event. The highest categorization field in the hierarchy. | keyword |
| event.module | Event module | constant_keyword |
| event.type | Event type. The third categorization field in the hierarchy. | keyword |
| file.mime_type | Media type of file, document, or arrangement of bytes. | keyword |
| file.size | File size in bytes. | long |
Expand Down Expand Up @@ -775,9 +772,6 @@ An example event for `signinlogs` looks as following:
| data_stream.dataset | Data stream dataset name. | constant_keyword |
| data_stream.namespace | Data stream namespace. | constant_keyword |
| data_stream.type | Data stream type. | constant_keyword |
| dataset.name | Dataset name. | constant_keyword |
| dataset.namespace | Dataset namespace. | constant_keyword |
| dataset.type | Dataset type. | constant_keyword |
| destination.address | Destination network address. | keyword |
| destination.as.number | Unique number allocated to the autonomous system. | long |
| destination.as.organization.name | Organization name. | keyword |
Expand All @@ -796,9 +790,11 @@ An example event for `signinlogs` looks as following:
| event.action | The action captured by the event. | keyword |
| event.category | Event category. The second categorization field in the hierarchy. | keyword |
| event.created | Time when the event was first read by an agent or by your pipeline. | date |
| event.dataset | Event dataset | constant_keyword |
| event.id | Unique ID to describe the event. | keyword |
| event.ingested | Timestamp when an event arrived in the central data store. | date |
| event.kind | The kind of the event. The highest categorization field in the hierarchy. | keyword |
| event.module | Event module | constant_keyword |
| event.type | Event type. The third categorization field in the hierarchy. | keyword |
| file.mime_type | Media type of file, document, or arrangement of bytes. | keyword |
| file.size | File size in bytes. | long |
Expand Down
4 changes: 2 additions & 2 deletions packages/azure/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: azure
title: Azure
version: 0.3.1
version: 0.4.0
release: beta
description: Azure Integration
type: integration
Expand All @@ -17,7 +17,7 @@ categories:
- network
- security
conditions:
kibana.version: ^7.9.0
kibana.version: ^7.14.0
screenshots:
- src: /img/filebeat-azure-overview.png
title: filebeat azure overview
Expand Down