struct

ECS::LogEntry::Dns

Inherits JSON::Serializable < Struct < Value < Object

Constructors

new(pull : JSON::PullParser)
Source
new

Initialize all values as nil

Source
new(*, __pull_for_json_serializable pull : JSON::PullParser)
Source

Instance methods

answers(new_value : Hash(String, String))

A chainable setter for answers

Source
answers(value : Answers)

A chainable setter for answers

Source
answers

dns.answers

An array containing an object for each answer section returned by the server.

The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.

Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the data key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields.

Level: Extended Type: Object Object Type: Keyword

Source
answers

Initialize a new Answers, yield it to the block

Source
answers=(answers : Hash(String, String) | Nil)

dns.answers

An array containing an object for each answer section returned by the server.

The main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.

Not all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the data key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields.

Level: Extended Type: Object Object Type: Keyword

Source
answers=(answers : Answers | Nil)
Source
header_flags(new_value : String)

A chainable setter for header_flags

Source
header_flags

dns.header_flags

Array of 2 letter DNS header flags.

Expected values are: AA, TC, RD, RA, AD, CD, DO.

Level: Extended Type: Keyword Example:

["RD", "RA"]
Source
header_flags=(header_flags : String | Nil)

dns.header_flags

Array of 2 letter DNS header flags.

Expected values are: AA, TC, RD, RA, AD, CD, DO.

Level: Extended Type: Keyword Example:

["RD", "RA"]
Source
id(new_value : String)

A chainable setter for id

Source
id

dns.id

The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.

Level: Extended Type: Keyword Example:

62111
Source
id=(id : String | Nil)

dns.id

The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response.

Level: Extended Type: Keyword Example:

62111
Source
op_code(new_value : String)

A chainable setter for op_code

Source
op_code

dns.op_code

The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.

Level: Extended Type: Keyword Example:

QUERY
Source
op_code=(op_code : String | Nil)

dns.op_code

The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response.

Level: Extended Type: Keyword Example:

QUERY
Source
question(value : Question)

A chainable setter for question

Source
question
Source
question

Initialize a new Question, yield it to the block

Source
question=(question : Question | Nil)
Source
resolved_ip(new_value : String)

A chainable setter for resolved_ip

Source
resolved_ip

dns.resolved_ip

Array containing all IPs seen in answers.data.

The answers array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to dns.resolved_ip makes it possible to index them as IP addresses, and makes them easier to visualize and query for.

Level: Extended Type: IP Example:

["10.10.10.10", "10.10.10.11"]
Source
resolved_ip=(resolved_ip : String | Nil)

dns.resolved_ip

Array containing all IPs seen in answers.data.

The answers array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to dns.resolved_ip makes it possible to index them as IP addresses, and makes them easier to visualize and query for.

Level: Extended Type: IP Example:

["10.10.10.10", "10.10.10.11"]
Source
response_code(new_value : String)

A chainable setter for response_code

Source
response_code

dns.response_code

The DNS response code.

Level: Extended Type: Keyword Example:

NOERROR
Source
response_code=(response_code : String | Nil)

dns.response_code

The DNS response code.

Level: Extended Type: Keyword Example:

NOERROR
Source
type(new_value : String)

A chainable setter for type

Source
type

dns.type

The type of DNS event captured, query or answer.

If your source of DNS events only gives you DNS queries, you should only create dns events of type dns.type:query.

If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers.

Level: Extended Type: Keyword Example:

answer
Source
type=(type : String | Nil)

dns.type

The type of DNS event captured, query or answer.

If your source of DNS events only gives you DNS queries, you should only create dns events of type dns.type:query.

If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers.

Level: Extended Type: Keyword Example:

answer
Source

Nested types