Add Netflow dashboards based on Logstash Netflow #12857

andrewkroh · 2019-07-11T05:25:01Z

Convert Logstash dashboards to work on Filebeat netflow data.

Changes

Change all UUIDs to not conflict with Logstash dashboards.
Rename fields used in dashboards.

	// These fields don't exist in the same capacity in ECS so just use destination.
	"geoip.autonomous_system": "destination.as.organization.name",
	"geoip.city_name":         "destination.geo.city_name",
	"geoip.country_name":      "destination.geo.country_name",
	"geoip.location":          "destination.geo.location",

	"geoip_dst.autonomous_system": "destination.as.organization.name",
	"geoip_src.autonomous_system": "source.as.organization.name",
	"host":                        "agent.hostname",
	"netflow.bytes":               "network.bytes",
	"netflow.direction":           "network.direction",
	"netflow.dst_addr":            "destination.ip",
	"netflow.dst_port_name":       "destination.port",
	"netflow.flow_locality":       "flow.locality",
	"netflow.input_snmp":          "netflow.ingress_interface",
	"netflow.ip_version":          "network.type",
	"netflow.last_switched":       "event.end",
	"netflow.output_snmp":         "netflow.egress_interface",
	"netflow.packets":             "network.packets",
	"netflow.protocol_name":       "network.transport",
	"netflow.src_addr":            "source.ip",
	"netflow.src_port_name":       "source.port",
	"netflow.tcp_flags_label":     "netflow.tcp_control_bits",
	"netflow.tos":                 "netflow.ip_class_of_service",
	"netflow.version":             "netflow.exporter.version",
	"netflow.vlan":                "netflow.vlan_id",

Change index pattern from netflow-* to filebeat-*
Add "input.type: netflow" filter. Uses can remove this to view other
flow data in dashboards (this mostly works fine b/c of ECS).
Prepend [Filebeat Netflow] to dashboards. And append [Filebeat Netflow] to visualizations.
Update netflow pipeline to enrich flows with ASN info.

Convert Logstash dashboards to work on Filebeat netflow data. Changes - Change all UUIDs to not conflict with Logstash dashboards. - Rename fields used in dashboards. ``` // These fields don't exist in the same capacity in ECS so just destination. "geoip.autonomous_system": "destination.as.organization.name", "geoip.city_name": "destination.geo.city_name", "geoip.country_name": "destination.geo.country_name", "geoip.location": "destination.geo.location", "geoip_dst.autonomous_system": "destination.as.organization.name", "geoip_src.autonomous_system": "source.as.organization.name", "host": "agent.hostname", "netflow.bytes": "network.bytes", "netflow.direction": "network.direction", "netflow.dst_addr": "destination.ip", "netflow.dst_port_name": "destination.port", "netflow.flow_locality": "flow.locality", "netflow.input_snmp": "netflow.ingress_interface", "netflow.ip_version": "network.type", "netflow.last_switched": "event.end", "netflow.output_snmp": "netflow.egress_interface", "netflow.packets": "network.packets", "netflow.protocol_name": "network.transport", "netflow.src_addr": "source.ip", "netflow.src_port_name": "source.port", "netflow.tcp_flags_label": "netflow.tcp_control_bits", "netflow.tos": "netflow.ip_class_of_service", "netflow.version": "netflow.exporter.version", "netflow.vlan": "netflow.vlan_id", ``` - Change index pattern from netflow-* to filebeat-* - Add "input.type: netflow" filter. Uses can remove this to view other flow data in dashboards (this mostly works fine b/c of ECS). - Prepend [Filebeat] to dashboards. And append [Filebeat] to visualizations. - Update netflow pipeline to enrich flows with ASN info.