Skip to content

Commit

Permalink
Adding risk.* fields as experimental (#1994)
Browse files Browse the repository at this point in the history
  • Loading branch information
@kgeller
kgeller authored Jul 26, 2022
1 parent b9cded6 commit 8c4c636
Show file tree
Hide file tree
Showing 10 changed files with 1,554 additions and 0 deletions.
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ Thanks, you're awesome :-) -->

#### Added

* Adding `risk.*` fields as experimental. #1994

#### Improvements

* Advances `threat.enrichments.indicator` to GA. #1928
Expand Down
283 changes: 283 additions & 0 deletions experimental/generated/beats/fields.ecs.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3652,6 +3652,52 @@
system (nsfs). Unsigned int inum in include/linux/ns_common.h.
example: 256383
default_field: false
- name: risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: type
level: core
type: keyword
Expand Down Expand Up @@ -7162,6 +7208,59 @@
ignore_above: 1024
description: All the user names or other user identifiers seen on the event.
default_field: false
- name: risk
title: Risk score information
group: 2
description: Fields for describing the risk score and level.
type: group
default_field: true
fields:
- name: calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: rule
title: Rule
group: 2
Expand Down Expand Up @@ -11987,6 +12086,52 @@
description: Short name or login of the user.
example: a.einstein
default_field: false
- name: changes.risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: changes.risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: changes.risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: changes.risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: changes.risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: changes.risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: changes.roles
level: extended
type: keyword
Expand Down Expand Up @@ -12072,6 +12217,52 @@
description: Short name or login of the user.
example: a.einstein
default_field: false
- name: effective.risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: effective.risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: effective.risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: effective.risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: effective.risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: effective.risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: effective.roles
level: extended
type: keyword
Expand Down Expand Up @@ -12136,6 +12327,52 @@
default_field: false
description: Short name or login of the user.
example: a.einstein
- name: risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: roles
level: extended
type: keyword
Expand Down Expand Up @@ -12214,6 +12451,52 @@
description: Short name or login of the user.
example: a.einstein
default_field: false
- name: target.risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: target.risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: target.risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: target.risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: target.risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: target.risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: target.roles
level: extended
type: keyword
Expand Down
Loading

0 comments on commit 8c4c636

Please sign in to comment.