Skip to content

Map ocsf.src_endpoint.uid in DNS Activity [4003] pipelines #24855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jbfeldman-dd wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Map ocsf.src_endpoint.uid in DNS Activity [4003] pipelines #24855

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
979a137
Map ocsf.src_endpoint.uid in DNS Activity [4003] pipelines
jbfeldman-dd Aug 13, 2026
267a3f1
cisco_umbrella_dns: select the roaming identity for src_endpoint.uid
jbfeldman-dd Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions bluecat_integrity/assets/logs/bluecat-integrity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -644,6 +644,15 @@ pipeline:
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.uid`
sources:
- ocsf.src_endpoint.ip
sourceType: attribute
target: ocsf.src_endpoint.uid
Comment thread
jbfeldman-dd marked this conversation as resolved.
targetFormat: string
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `sourcePort` to `ocsf.src_endpoint.port`
sources:
- sourcePort
Expand Down
4 changes: 4 additions & 0 deletions bluecat_integrity/assets/logs/bluecat-integrity_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 57895
uid: "10.10.10.10"
time: 1772082904884
payloadType: "dnstap"
requestData:
Expand Down Expand Up @@ -283,6 +284,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 39927
uid: "10.10.10.10"
time: 1771522140526
payloadType: "dnstap"
responseAddress: "10.1.1.1"
Expand Down Expand Up @@ -530,6 +532,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 18456
uid: "10.10.10.10"
time: 1772001594423
payloadType: "dnstap"
queryZone: "google.local."
Expand Down Expand Up @@ -828,6 +831,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 39927
uid: "10.10.10.10"
time: 1771522140526
payloadType: "dnstap"
requestData:
Expand Down
9 changes: 9 additions & 0 deletions cisco_umbrella_dns/assets/logs/cisco-umbrella-dns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -873,6 +873,15 @@ pipeline:
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `identities.0.id` to `ocsf.src_endpoint.uid`
sources:
- identities.0.id
sourceType: attribute
target: ocsf.src_endpoint.uid
Comment thread
jbfeldman-dd marked this conversation as resolved.
Outdated
targetFormat: string
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `externalip` to `ocsf.proxy_endpoint.ip`
sources:
- externalip
Expand Down
3 changes: 3 additions & 0 deletions cisco_umbrella_dns/assets/logs/cisco-umbrella-dns_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,7 @@ tests:
severity_id: 1
src_endpoint:
ip: "185.64.148.0"
uid: "617808138"
status: "Failure"
status_id: 2
time: 1702288020000
Expand Down Expand Up @@ -428,6 +429,7 @@ tests:
severity_id: 1
src_endpoint:
ip: "185.64.148.0"
uid: "618368586"
status: "Success"
status_id: 1
time: 1702990616000
Expand Down Expand Up @@ -668,6 +670,7 @@ tests:
severity_id: 1
src_endpoint:
ip: "185.64.148.0"
uid: "618368586"
time: 1702990616000
policycategories:
-
Expand Down
9 changes: 9 additions & 0 deletions coredns/assets/logs/coredns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,6 +452,15 @@ pipeline:
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.uid`
sources:
- ocsf.src_endpoint.ip
sourceType: attribute
target: ocsf.src_endpoint.uid
targetFormat: string
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `network.client.port` to `ocsf.src_endpoint.port`
sources:
- network.client.port
Expand Down
2 changes: 2 additions & 0 deletions coredns/assets/logs/coredns_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ tests:
src_endpoint:
ip: "10.145.105.176"
port: 36008
uid: "10.145.105.176"
status: "Failure"
status_code: "NXDOMAIN"
status_id: 2
Expand Down Expand Up @@ -127,6 +128,7 @@ tests:
src_endpoint:
ip: "127.0.0.1"
port: 50759
uid: "127.0.0.1"
status: "Success"
status_code: "NOERROR"
status_id: 1
Expand Down
8 changes: 8 additions & 0 deletions zeek/assets/logs/zeek.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3505,6 +3505,14 @@ pipeline:
target: ocsf.src_endpoint.ip
preserveSource: true
overrideOnConflict: true
- type: schema-remapper
name: Map `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.uid`
sources:
- ocsf.src_endpoint.ip
target: ocsf.src_endpoint.uid
preserveSource: true
overrideOnConflict: true
targetFormat: string
- type: schema-remapper
name: Map `id.orig_p` to `ocsf.src_endpoint.port`
sources:
Expand Down
3 changes: 3 additions & 0 deletions zeek/assets/logs/zeek_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -417,6 +417,7 @@ tests:
src_endpoint:
ip: 185.64.148.0
port: 58013
uid: 185.64.148.0
status: Success
status_detail: NOERROR
status_id: 1
Expand Down Expand Up @@ -565,6 +566,7 @@ tests:
src_endpoint:
ip: 10.10.10.10
port: 123
uid: 10.10.10.10
status: Unknown
status_id: 0
time: 1709786320085
Expand Down Expand Up @@ -1090,6 +1092,7 @@ tests:
src_endpoint:
ip: 185.64.148.0
port: 58013
uid: 185.64.148.0
status: Success
status_detail: NOERROR
status_id: 1
Expand Down
Loading