Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add os.full, to allow capturing full OS name string, including version #259

Merged
merged 6 commits into from
Dec 11, 2018
Merged

Add os.full, to allow capturing full OS name string, including version #259

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9972fce
Add `os.full_name`, to allow capturing full OS name string.
Dec 7, 2018
e9692cf
Changelog
Dec 7, 2018
6ea87b1
Rename to `os.full`.
Dec 11, 2018
a66d01d
Changelog
Dec 11, 2018
28d8483
Use the same version strings in both `os` examples, for consistency
Dec 11, 2018
d14bb32
Make `os.full` definition a bit more loose to allow for code name...
Dec 11, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ All notable changes to this project will be documented in this file based on the
* Add `event.timezone` to allow for proper interpretation of incomplete timestamps. #258
* Add fields `source.address`, `destination.address`, `client.address`, and
`server.address`. #247
* Add `os.full` to capture full OS name, including version. #259

### Improvements
* Improved the definition of the file fields #196
Expand Down
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,9 +380,10 @@ Note also that the `os` fields are not expected to be used directly at the top l
| Field | Description | Level | Type | Example |
|---|---|---|---|---|
| <a name="os.platform"></a>os.platform | Operating system platform (such centos, ubuntu, windows). | extended | keyword | `darwin` |
| <a name="os.name"></a>os.name | Operating system name. | extended | keyword | `Mac OS X` |
| <a name="os.name"></a>os.name | Operating system name, without the version. | extended | keyword | `Mac OS X` |
| <a name="os.full"></a>os.full | Operating system name, including the version or code name. | extended | keyword | `Mac OS Mojave` |
| <a name="os.family"></a>os.family | OS family (such as redhat, debian, freebsd, windows). | extended | keyword | `debian` |
| <a name="os.version"></a>os.version | Operating system version as a raw string. | extended | keyword | `10.12.6-rc2` |
| <a name="os.version"></a>os.version | Operating system version as a raw string. | extended | keyword | `10.14.1` |
| <a name="os.kernel"></a>os.kernel | Operating system kernel version as a raw string. | extended | keyword | `4.4.0-112-generic` |


Expand Down
11 changes: 9 additions & 2 deletions fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1189,7 +1189,14 @@
type: keyword
example: "Mac OS X"
description: >
Operating system name.
Operating system name, without the version.

- name: full
level: extended
type: keyword
example: "Mac OS Mojave"
description: >
Operating system name, including the version or code name.

- name: family
level: extended
Expand All @@ -1201,7 +1208,7 @@
- name: version
level: extended
type: keyword
example: "10.12.6-rc2"
example: "10.14.1"
description: >
Operating system version as a raw string.

Expand Down
3 changes: 2 additions & 1 deletion schema.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,10 +121,11 @@ observer.version,keyword,core,
organization.id,keyword,extended,
organization.name,keyword,extended,
os.family,keyword,extended,debian
os.full,keyword,extended,Mac OS Mojave
os.kernel,keyword,extended,4.4.0-112-generic
os.name,keyword,extended,Mac OS X
os.platform,keyword,extended,darwin
os.version,keyword,extended,10.12.6-rc2
os.version,keyword,extended,10.14.1
process.args,keyword,extended,"['ssh', '-l', 'user', '10.0.0.16']"
process.executable,keyword,extended,/usr/bin/ssh
process.name,keyword,extended,ssh
Expand Down
11 changes: 9 additions & 2 deletions schemas/os.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,14 @@
type: keyword
example: "Mac OS X"
description: >
Operating system name.
Operating system name, without the version.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think an OS name is always without the version? I see the context you are coming from but I don't think we should mention that here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The user agent parser gives us the following. Check out os:

          "user_agent" : {
            "patch" : "3538",
            "major" : "70",
            "minor" : "0",
            "os" : "Mac OS X 10.14.0",
            "os_minor" : "14",
            "os_major" : "10",
            "name" : "Chrome",
            "os_name" : "Mac OS X",
            "device" : "Other"
          }

I do think that's useful to have this value to compare overall OS usage. The broken down os name and os version in two fields is useful for broader analysis (os name) and then filtering down one OS at a time to see the version breakdowns. But it's not obvious how to use these two fields to get a sense of the overall usage of each specific OS version, all at the same time.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't it be that there is first a filter on the OS and then an aggregation on the version to get a correct result?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you want to look at the breakdown within one OS, yes, filtering first works, and then the versions you're looking at are consistent and make sense within the context of that OS.

If you want to look at the overall "population" however (e.g. looking at all the OSes accessing your website), then having the full name with version is helpful.

Then you can see a ranking like:

  • Mac OS X 10.12: 43345
  • Windows 10: 40300
  • Mac OS X 10.11: 20000
  • Windows 7: 12000

and so on...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think an OS name is always without the version? I see the context you are coming from but I don't think we should mention that here.

Actually this brings up an interesting case to mind. Do people consider "Windows 7" to be the OS name, or is it "Windows"? I think if we don't keep this clarification, we'll get "Windows 7" and "Windows 10" in this field (just without the minor & patch versions).


- name: full
level: extended
type: keyword
example: "Mac OS Mojave"
description: >
Operating system name, including the version or code name.

- name: family
level: extended
Expand All @@ -36,7 +43,7 @@
- name: version
level: extended
type: keyword
example: "10.12.6-rc2"
example: "10.14.1"
description: >
Operating system version as a raw string.

Expand Down
4 changes: 4 additions & 0 deletions template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -578,6 +578,10 @@
"ignore_above": 1024,
"type": "keyword"
},
"full": {
"ignore_above": 1024,
"type": "keyword"
},
"kernel": {
"ignore_above": 1024,
"type": "keyword"
Expand Down