struct

ECS::LogEntry::Network

Inherits JSON::Serializable < Struct < Value < Object

Constructors

new(pull : JSON::PullParser)

new

Initialize all values as nil

new(*, __pull_for_json_serializable pull : JSON::PullParser)

Instance methods

application(new_value : String)

A chainable setter for application

application

network.application

A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Extended Type: Keyword Example:

aim

application=(application : String | Nil)

network.application

A name given to an application level protocol. This can be arbitrarily assigned for things like microservices, but also apply to things like skype, icq, facebook, twitter. This would be used in situations where the vendor or service can be decoded such as from the source/dest IP owners, ports, or wire format.

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Extended Type: Keyword Example:

aim

bytes(new_value : UInt64)

A chainable setter for bytes

bytes

network.bytes

Total bytes transferred in both directions.

If source.bytes and destination.bytes are known, network.bytes is their sum.

Level: Core Type: Long Example:

bytes=(bytes : UInt64 | Nil)

network.bytes

Total bytes transferred in both directions.

If source.bytes and destination.bytes are known, network.bytes is their sum.

Level: Core Type: Long Example:

community_id(new_value : String)

A chainable setter for community_id

community_id

network.community_id

A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.

Learn more at https://github.com/corelight/community-id-spec.

Level: Extended Type: Keyword Example:

1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=

community_id=(community_id : String | Nil)

network.community_id

A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.

Learn more at https://github.com/corelight/community-id-spec.

Level: Extended Type: Keyword Example:

1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0=

direction(new_value : String)

A chainable setter for direction

direction

network.direction

Direction of the network traffic.

Recommended values are:

inbound
outbound
internal
external
unknown

When mapping events from a host-based monitoring context, populate this field from the host's point of view.

When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of your network perimeter.

Level: Core Type: Keyword Example:

inbound

direction=(direction : String | Nil)

network.direction

Direction of the network traffic.

Recommended values are:

inbound
outbound
internal
external
unknown

When mapping events from a host-based monitoring context, populate this field from the host's point of view.

When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of your network perimeter.

Level: Core Type: Keyword Example:

inbound

forwarded_ip(new_value : String)

A chainable setter for forwarded_ip

forwarded_ip

network.forwarded_ip

Host IP address when the source IP address is the proxy.

Level: Core Type: IP Example:

192.1.1.2

forwarded_ip=(forwarded_ip : String | Nil)

network.forwarded_ip

Host IP address when the source IP address is the proxy.

Level: Core Type: IP Example:

192.1.1.2

iana_number(new_value : String)

A chainable setter for iana_number

iana_number

network.iana_number

IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.

Level: Extended Type: Keyword Example:

iana_number=(iana_number : String | Nil)

network.iana_number

IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.

Level: Extended Type: Keyword Example:

inner(new_value : Hash(String, String))

A chainable setter for inner

inner

network.inner

Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)

Level: Extended Type: Object Object Type: Keyword

inner=(inner : Hash(String, String) | Nil)

network.inner

Network.inner fields are added in addition to network.vlan fields to describe the innermost VLAN when q-in-q VLAN tagging is present. Allowed fields include vlan.id and vlan.name. Inner vlan fields are typically used when sending traffic with multiple 802.1q encapsulations to a network sensor (e.g. Zeek, Wireshark.)

Level: Extended Type: Object Object Type: Keyword

name(new_value : String)

A chainable setter for name

name

network.name

Name given by operators to sections of their network.

Level: Extended Type: Keyword Example:

Guest Wifi

name=(name : String | Nil)

network.name

Name given by operators to sections of their network.

Level: Extended Type: Keyword Example:

Guest Wifi

packets(new_value : UInt64)

A chainable setter for packets

packets

network.packets

Total packets transferred in both directions.

If source.packets and destination.packets are known, network.packets is their sum.

Level: Core Type: Long Example:

packets=(packets : UInt64 | Nil)

network.packets

Total packets transferred in both directions.

If source.packets and destination.packets are known, network.packets is their sum.

Level: Core Type: Long Example:

protocol(new_value : String)

A chainable setter for protocol

protocol

network.protocol

L7 Network protocol name. ex. http, lumberjack, transport protocol.

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Core Type: Keyword Example:

http

protocol=(protocol : String | Nil)

network.protocol

L7 Network protocol name. ex. http, lumberjack, transport protocol.

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Core Type: Keyword Example:

http

transport(new_value : String)

A chainable setter for transport

transport

network.transport

Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Core Type: Keyword Example:

tcp

transport=(transport : String | Nil)

network.transport

Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Core Type: Keyword Example:

tcp

type(new_value : String)

A chainable setter for type

type

network.type

In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Core Type: Keyword Example:

ipv4

type=(type : String | Nil)

network.type

In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc

The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".

Level: Core Type: Keyword Example:

ipv4

vlan(value : Vlan)

A chainable setter for vlan

vlan

vlan

Initialize a new Vlan, yield it to the block

vlan=(vlan : Vlan | Nil)

Nested types