Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEM] Bad network.direction ingested by Cisco module #13891

Closed
adriansr opened this issue Oct 3, 2019 · 2 comments · Fixed by #13903
Closed

[SIEM] Bad network.direction ingested by Cisco module #13891

adriansr opened this issue Oct 3, 2019 · 2 comments · Fixed by #13903
Labels
bug Filebeat Filebeat

Comments

@adriansr
Copy link
Contributor

adriansr commented Oct 3, 2019

User is getting

"Expected a value of type "NetworkDirectionEcs" but received: Inbound"

Looks like network.direction is Inbound where it should be inbound.
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

adriansr added a commit to adriansr/beats that referenced this issue Oct 3, 2019
@adriansr
[SIEM] Normalize network.direction in Cisco asa/ftd
4ac4662 
In some case network.direction can be `Inbound` instead of `inbound`
as expected. This happens with message 106001 in the ASA and FTD.

Fixes elastic#13891
@adriansr adriansr mentioned this issue Oct 3, 2019
Merged
@adriansr
Copy link
Contributor Author

adriansr commented Oct 3, 2019

A fix in case this error appears in your SIEM :

POST /filebeat-*/_update_by_query
{
  "query": {
    "match": {
      "network.direction": "Inbound"
    }
  },
  "script": {
    "lang": "painless",
    "source": "ctx._source.network.direction='inbound'"
  }
}

adriansr added a commit that referenced this issue Oct 4, 2019
@adriansr
[SIEM] Fix Cisco ASA and FTD message 106001 producing bad network.dir…
e40fbdd 
…ection (#13903)

In some case network.direction can be `Inbound` instead of `inbound`
as expected. This happens with message 106001 in the ASA and FTD.

Fixes #13891
adriansr added a commit to adriansr/beats that referenced this issue Oct 4, 2019
@adriansr
[SIEM] Fix Cisco ASA and FTD message 106001 producing bad network.dir…
a6f2fb7 
…ection (elastic#13903)

In some case network.direction can be `Inbound` instead of `inbound`
as expected. This happens with message 106001 in the ASA and FTD.

Fixes elastic#13891

(cherry picked from commit e40fbdd)
@adriansr adriansr mentioned this issue Oct 4, 2019
Merged
adriansr added a commit that referenced this issue Oct 4, 2019
@adriansr
Cherry-pick #13903 to 7.4: [SIEM] Fix Cisco ASA and FTD message 10600…
c2c88be 
…1 producing bad network.direction (#13912)

In some case network.direction can be `Inbound` instead of `inbound`
as expected. This happens with message 106001 in the ASA and FTD.

Fixes #13891
leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
@adriansr
Cherry-pick elastic#13903 to 7.4: [SIEM] Fix Cisco ASA and FTD messag…
0e29f5e 
…e 106001 producing bad network.direction (elastic#13912)

In some case network.direction can be `Inbound` instead of `inbound`
as expected. This happens with message 106001 in the ASA and FTD.

Fixes elastic#13891
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Filebeat Filebeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[SIEM] Fix Cisco ASA and FTD message 106001 producing bad network.direction adriansr/beats
2 participants
@adriansr @elasticmachine