Skip to content

Commit

Permalink
Swap source.bytes and destination.bytes traffic log mappings (#32927
Browse files Browse the repository at this point in the history
) (#33060)

* Swap `source.bytes` and `destination.bytes` traffic log mappings

This documentation currently mapps `Bytes Received` to `server.bytes` and `source.bytes` as well as `Bytes Sent` to `client.bytes` and `destination.bytes`.

This mapping is incorrect as per the [Palot Alto Docs](https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields), `bytes_sent` is defined as `Number of bytes in the client-to-server direction of the session.` and matches the ECS definitions for `client.bytes` and `source.bytes` being bytes from `client/source => server/destination`.

Likewise, `bytes_received` is defined as `Number of bytes in the server-to-client direction of the session.` and matches the `destination.bytes` and `server.bytes` definitions in ECS being the bytes sent from `server/destination => client/source`.

Furthermore, the [panw filebeat module mapping](https://github.com/elastic/beats/blob/v8.4.0/x-pack/filebeat/module/panw/panos/config/input.yml#L95) and [integration pipeline](https://github.com/elastic/integrations/blob/main/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/traffic.yml#L212) both follow the above conventions.

This proposed change will map `Bytes Received` to `destination.bytes` and `Bytes Sent` to `client.bytes`.

* Swap `source.bytes` and `destination.bytes` traffic log mappings

Swapping the values of `source.bytes` and `destination.bytes` in order to align the documentation with the changes implemented in #18525

* Run make update

Co-authored-by: dedemorton <dede.morton@elastic.co>
(cherry picked from commit 0930b9b)

Co-authored-by: Austin Smith <76973609+asmith-elastic@users.noreply.github.com>
  • Loading branch information
mergify[bot] and asmith-elastic committed Sep 13, 2022
1 parent 16abaa5 commit b00a6bc
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
4 changes: 2 additions & 2 deletions filebeat/docs/modules/panw.asciidoc
Expand Up @@ -110,8 +110,8 @@ in ECS that are added under the `panw.panos` prefix:
| Protocol | network.transport |
| Action | event.outcome |
| Bytes | network.bytes |
| Bytes Sent | client.bytes destination.bytes |
| Bytes Received | server.bytes source.bytes |
| Bytes Sent | client.bytes source.bytes |
| Bytes Received | server.bytes destination.bytes |
| Packets | network.packets |
| Start Time | event.start |
| Elapsed Time | event.duration |
Expand Down
4 changes: 2 additions & 2 deletions x-pack/filebeat/module/panw/_meta/docs.asciidoc
Expand Up @@ -103,8 +103,8 @@ in ECS that are added under the `panw.panos` prefix:
| Protocol | network.transport |
| Action | event.outcome |
| Bytes | network.bytes |
| Bytes Sent | client.bytes destination.bytes |
| Bytes Received | server.bytes source.bytes |
| Bytes Sent | client.bytes source.bytes |
| Bytes Received | server.bytes destination.bytes |
| Packets | network.packets |
| Start Time | event.start |
| Elapsed Time | event.duration |
Expand Down

0 comments on commit b00a6bc

Please sign in to comment.