Ecs: Example Mapping of CEF to ECS 1.0.0-beta2

[MikePaquette]

The attached Excel file proposes a logical mapping of _ArcSight CEF_ logs to ECS 1.0.0-beta2.

The CEF field definitions were obtained from CEF Specification v25.

Notes:

• CEF includes a number of custom fields. This mapping does not address custom fields.
• This mapping is not an official part of ECS, it is simply offered as an example of how a logical mapping of a commonly used security logging format would be performed in ECS
• This example does not contain an index mapping template, nor an ingest node pipeline, nor a Logstash configuration. Creating those is left to you :-)
• There are columns in this spreadsheet for "enhancement request fields" - that is, fields that are not currently defined by ECS, but would likely be useful in the future.
• see tab CEF_V25 Mapping_b2

ECS_CEF_Mapping_Example.xlsx

Questions and/or feedback about the mappings, the value of such logical mappings, and whether or not such logical mappings might be useful as part of the repo in the future, are all welcome.

[danielyahn]

Is there a plan for having a FileBeat module for CEF format data?

Also, kind of related, are you aware of any open source Logstash plugin that can map Arcsight data (CEF formatted data from either EventBroker or SmartConnector) to ECS?

[petiepooo]

This seems to be the only place so far I've seen any hint of this. We are currently an ArcSight shop but are looking to replace at least Logger with the ELK stack, and hopefully explore your SIEM app capabilities while we're at it.

I understand the long-term goal would be to replace all the AS connectors with native Elastic capabilities (logstash/beats), and there are definitely benefits to doing so. The drawback is that there are ArcSight connectors for many more platforms, at least for now, than there are for Elastic. Until that changes, conversion to ECS at the source would take too much effort for our current deployment. On-the-fly conversion from CEF to ECS would be the next best thing.

While we could store everything in Elastic using CEF as the schema, we'd miss out on all the new capabilities that rely on ECS. Therefore, deploying it with ECS is in our best interest, but I believe it's in your best interest too, as it showcases your newest capabilities.

Please consider releasing official OSS tools for this capability rather than leaving it as an exercise for us. I believe that doing so would significantly expand your number of formerly-ArcSight clients.

[webmat]

A Filebeat processor is coming for it, yes.

You can follow https://github.com/elastic/beats/pull/13264