Added location and name field to observer.

[mbudge]

Web proxies can block traffic in the same way as an Intrusion Prevention System which is listed as a type of Observer. Added a location and name field so observer can also store fields use to describe web proxy appliances found in web proxy logs.

[MikePaquette]

@mbudge Indeed a proxy would be considered an observer in ECS. In fact, it is listed as one of the examples for the observer.type field in the ECS observer docs.

Please note that the geo.* fields maybe nested below observer.* providing you with multiple fields to store the location-related information regarding an observer. For example:
observer.geo.city_name, observer.geo.continent_name, observer.geo.country_iso_code, observer.geo.country_name observer.geo.location, observer.geo.name, observer.geo.region_iso_code, and observer.geo.region_name.

In addition, ECS specifies observer.vendor and observer.version and observer.os.nameandobserver.os.version`.

For example: you might have: observer.vendor:"symantec", observer.version:"s200", observer.os.name:"proxysg", and observer.geo.name:"3rd_floor_mdf".

So I think we already have enough observer fields to capture this information, so I don't think we should proceed with your proposed observer.location and observer.name.

Thanks!

[mbudge]

Hi,

Didn't see the observer.os.location so we'll use that.

Not sure about observer.os.name for the appliance name, as we want to store the appliances custom name used to identify the appliance. This is similar to the agent.name field but for appliances instead of an agent.

There could be several if there are multiple web proxies on the network.
1_proxysg
2_proxysg
3_proxysg

Thanks!

[MikePaquette]

@mbudge Good point about the actual name of the observer in addition to its location. Also, I think my above use of observer.os.name was not correct. In fact, I think we are missing another field like observer.product. What do you think of the following improved mapping examples?

• observer.type:"proxy"
• observer.name:"1_proxysg" (this is the new field that you are suggesting)
• observer.vendor:"symantec"
• observer.product:"s200" (this is another new field - could also be observer.model)
• observer.os.name:"sgos"
• observer.os.version:"7.1"
• observer.geo.name:"3rd_floor_mdf"

and another:

• observer.type:"firewall"
• observer.name:"gateway_firewall_1a"
• observer.vendor:"palo alto"
• observer.product:"pa5060"
• observer.os.name:"panos"
• observer.os.version:"9.1"
• observer.geo.name:"3rd_floor_mdf"

If you agree that these are good mappings, then if you would modify this PR to include only the observer.name and observer.product additions, then I will be happy to review.

Thanks for your active contributions!

[mbudge]

Agreed those fields would be a great addition.

[webmat]

Thanks for sending this over, this looks good! It will make the observer field set that much more aligned with agent :-)

I have a few small requests before we merge this in, please:

• Add a changelog entry to CHANGELOG.next.md
• Adjust the descriptions for .name and .product as described in the comments below
• Add the corresponding example to .vendor, so we have "Symantec s200" broken out to their appropriate fields, in their respective examples

Thanks again!

[webmat]

Please flesh out this description a little more, to make it clear that this is meant to be user-configured.

For inspiration, here's two other places in ECS where we have .name meant to be a user-customizable value: agent.name and host.name

[webmat]

For consistency's sake with the other field definitions, please use

Suggested change

	The observers product name.
	The product name of the observer.

[webmat]

Another request, since we're going with @MikePaquette's s200 example, could you also add a corresponding example to the "vendor" field, with value "Symantec", please?

[ruflin]

can we make these fields extended for now? Easy to move it to core later but not sure about the other way around.

[MikePaquette]

👍 for level: extended for these new additions

[MikePaquette]

👍 for level: extended for these new additions