Skip to content

Addition of related.mac and related.port #2288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Addition of related.mac and related.port #2288

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions schemas/related.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,3 +70,25 @@
identifiers include FQDNs, domain names, workstation names, or aliases.
normalize:
- array

- name: mac
level: extended
type: keyword
short: All the mac addresses seen on your event.
description: >
All the mac addresses seen on your event. The mac addresses should be standardized
before they populate this array. For this, The notation format from RFC 7042 is suggested:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

typo in uppercase ..., The notation...

Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving
the value of the octet as an unsigned integer. Successive octets are separated by a
hyphen.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think an example would be useful here.

normalize:
- array

- name: port
level: extended
type: long
short: All the port numbers seen on your event.
description: >
All the port numbers seen on your event, as specified by RFC 6335
normalize:
- array