Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding risk.* fields as experimental #1994

Merged
merged 10 commits into from
Jul 26, 2022
Merged

Adding risk.* fields as experimental #1994

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
545105d
adding the risk score fields to experimental
kgeller Jul 13, 2022
a2246ed
artifacts and formatting
kgeller Jul 13, 2022
f062051
formatting again
kgeller Jul 13, 2022
f06a543
formatting again
kgeller Jul 13, 2022
31590d7
changelog
kgeller Jul 13, 2022
98812ac
Merge branch 'main' into experimental-risk-fields
kgeller Jul 19, 2022
6d2ceb5
fixing
kgeller Jul 22, 2022
29408ab
artifacts
kgeller Jul 22, 2022
85c2afd
:wqerge branch 'experimental-risk-fields' of github.com:kgeller/ecs i…
kgeller Jul 22, 2022
7a6d30a
Merge branch 'main' into experimental-risk-fields
kgeller Jul 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ Thanks, you're awesome :-) -->

#### Added

* Adding `risk.*` fields as experimental. #1994

#### Improvements

* Advances `threat.enrichments.indicator` to GA. #1928
Expand Down
283 changes: 283 additions & 0 deletions experimental/generated/beats/fields.ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3652,6 +3652,52 @@
system (nsfs). Unsigned int inum in include/linux/ns_common.h.
example: 256383
default_field: false
- name: risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: type
level: core
type: keyword
Expand Down Expand Up @@ -7162,6 +7208,59 @@
ignore_above: 1024
description: All the user names or other user identifiers seen on the event.
default_field: false
- name: risk
title: Risk score information
group: 2
description: Fields for describing the risk score and level.
type: group
default_field: true
fields:
- name: calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: rule
title: Rule
group: 2
Expand Down Expand Up @@ -11987,6 +12086,52 @@
description: Short name or login of the user.
example: a.einstein
default_field: false
- name: changes.risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: changes.risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: changes.risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: changes.risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: changes.risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: changes.risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: changes.roles
level: extended
type: keyword
Expand Down Expand Up @@ -12072,6 +12217,52 @@
description: Short name or login of the user.
example: a.einstein
default_field: false
- name: effective.risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: effective.risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: effective.risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: effective.risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: effective.risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: effective.risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: effective.roles
level: extended
type: keyword
Expand Down Expand Up @@ -12136,6 +12327,52 @@
default_field: false
description: Short name or login of the user.
example: a.einstein
- name: risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: roles
level: extended
type: keyword
Expand Down Expand Up @@ -12214,6 +12451,52 @@
description: Short name or login of the user.
example: a.einstein
default_field: false
- name: target.risk.calculated_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level calculated by an internal system as
part of entity analytics and entity risk scoring.
example: High
default_field: false
- name: target.risk.calculated_score
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring.
example: 880.73
default_field: false
- name: target.risk.calculated_score_norm
level: extended
type: float
description: A risk classification score calculated by an internal system as
part of entity analytics and entity risk scoring, and normalized to a range
of 0 to 100.
example: 88.73
default_field: false
- name: target.risk.static_level
level: extended
type: keyword
ignore_above: 1024
description: A risk classification level obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: High
default_field: false
- name: target.risk.static_score
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform.
example: 830.0
default_field: false
- name: target.risk.static_score_norm
level: extended
type: float
description: A risk classification score obtained from outside the system, such
as from some external Threat Intelligence Platform, and normalized to a range
of 0 to 100.
example: 83.0
default_field: false
- name: target.roles
level: extended
type: keyword
Expand Down
Loading