Add DNS header_flags, registered_domain, resolved_ip

[andrewkroh]

Add DNS fields for ECS. This adds three fields:

• dns.question.registered_domain
• dns.header_flags
• dns.resolved_ip

Relates #13320

[elasticmachine]

Pinging @elastic/siem

[andrewkroh]

Sample event:

{
	"@timestamp": "2015-08-27T08:00:55.638Z",
	"@metadata": {
		"beat": "packetbeat",
		"type": "_doc",
		"version": "8.0.0"
	},
	"destination": {
		"ip": "192.168.238.1",
		"port": 53,
		"bytes": 284
	},
	"query": "class IN, type A, google.com",
	"host": {
		"name": "host"
	},
	"agent": {
		"id": "d7c50ec8-fb6d-48b0-84ca-d28e6c1d2968",
		"version": "8.0.0",
		"type": "packetbeat",
		"ephemeral_id": "13579485-59ff-4b16-a2bd-25ea70f93e20",
		"hostname": "host"
	},
	"client": {
		"bytes": 28,
		"ip": "192.168.238.68",
		"port": 60893
	},
	"server": {
		"bytes": 284,
		"ip": "192.168.238.1",
		"port": 53
	},
	"type": "dns",
	"ecs": {
		"version": "1.1.0"
	},
	"method": "QUERY",
	"source": {
		"port": 60893,
		"bytes": 28,
		"ip": "192.168.238.68"
	},
	"status": "OK",
	"event": {
		"end": "2015-08-27T08:00:55.700Z",
		"kind": "event",
		"category": "network_traffic",
		"dataset": "dns",
		"duration": 61782000,
		"start": "2015-08-27T08:00:55.638Z"
	},
	"dns": {
		"header_flags": [
			"RD",
			"RA"
		],
		"answers": [
			{
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.249",
				"name": "google.com",
				"type": "A"
			},
			{
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.216",
				"name": "google.com",
				"type": "A"
			},
			{
				"data": "62.214.62.223",
				"name": "google.com",
				"type": "A",
				"class": "IN",
				"ttl": "126"
			},
			{
				"ttl": "126",
				"data": "62.214.62.227",
				"name": "google.com",
				"type": "A",
				"class": "IN"
			},
			{
				"type": "A",
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.219",
				"name": "google.com"
			},
			{
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.208",
				"name": "google.com",
				"type": "A"
			},
			{
				"data": "62.214.62.234",
				"name": "google.com",
				"type": "A",
				"class": "IN",
				"ttl": "126"
			},
			{
				"name": "google.com",
				"type": "A",
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.240"
			},
			{
				"data": "62.214.62.245",
				"name": "google.com",
				"type": "A",
				"class": "IN",
				"ttl": "126"
			},
			{
				"type": "A",
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.241",
				"name": "google.com"
			},
			{
				"ttl": "126",
				"data": "62.214.62.251",
				"name": "google.com",
				"type": "A",
				"class": "IN"
			},
			{
				"ttl": "126",
				"data": "62.214.62.212",
				"name": "google.com",
				"type": "A",
				"class": "IN"
			},
			{
				"name": "google.com",
				"type": "A",
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.229"
			},
			{
				"name": "google.com",
				"type": "A",
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.238"
			},
			{
				"data": "62.214.62.230",
				"name": "google.com",
				"type": "A",
				"class": "IN",
				"ttl": "126"
			},
			{
				"type": "A",
				"class": "IN",
				"ttl": "126",
				"data": "62.214.62.218",
				"name": "google.com"
			}
		],
		"flags": {
			"recursion_desired": true,
			"recursion_available": true,
			"authentic_data": false,
			"checking_disabled": false,
			"authoritative": false,
			"truncated_response": false
		},
		"resolved_ip": [
			"62.214.62.249",
			"62.214.62.216",
			"62.214.62.223",
			"62.214.62.227",
			"62.214.62.219",
			"62.214.62.208",
			"62.214.62.234",
			"62.214.62.240",
			"62.214.62.245",
			"62.214.62.241",
			"62.214.62.251",
			"62.214.62.212",
			"62.214.62.229",
			"62.214.62.238",
			"62.214.62.230",
			"62.214.62.218"
		],
		"id": 18439,
		"op_code": "QUERY",
		"answers_count": 16,
		"response_code": "NOERROR",
		"question": {
			"class": "IN",
			"etld_plus_one": "google.com",
			"registered_domain": "google.com",
			"name": "google.com",
			"type": "A"
		},
		"authorities_count": 0,
		"additionals_count": 0
	},
	"resource": "google.com",
	"network": {
		"community_id": "1:Pix/jA+kRGP8oB9kgM7RKCq76kk=",
		"bytes": 312,
		"type": "ipv4",
		"transport": "udp",
		"protocol": "dns"
	}
}

[webmat]

LGTM overall

Are there golden files that could be updated? If not, the sample you shared with the PR is looking good 👍

[andrewkroh]

There are no golden files used in automated testing that I'm aware of for this beat.