Add network.address

[vbohata]

I often need to somehow store the network name and network address. I propose to add network.address field for values like 192.168.0.0/24 ...

[ruflin]

@webmat @robgil Would be great to get your feedback on this one.

@vbohata Can you share a bit of background on what queries you would run against the above field?

[vbohata]

Currently for firewall logs I filter documents by exact match of some network address value like "192.168.50.0/24". It would be handy to be able to do some network vs. ip comparison natively in ES, but ES do not have a data type for network address.

[robgil]

@ruflin @vbohata Yes, this makes sense. We definitely need a field for this. How about network.cidr? This would avoid confusion with other addresses like MAC or IP. We should probably also add network.netmask to be complete here.

[vbohata]

network.cidr sounds reasonable. Netmask is also useful, but if there will be netmask, you should add also network base address. The network object will be maybe even more complicated because I can imagine someone will need to store both IPv4 and IPv6 addresses. Also there is missing interface object (maybe network.interface.name) which will be probably handy for metricbeat network module.

[ruflin]

++ on cidr. Do you want to open a PR?

[vbohata]

Yes, please.

[vbohata]

Btw. I just found ES knows ip_range type which can be entered as CIDR ... good to know :)

[ruflin]

Good point, should we make the field an ip_range then?

Also nice to see that ip addresses can be queried with a cidr notation: https://www.elastic.co/guide/en/elasticsearch/reference/current/ip.html

[vbohata]

AFAIK for term aggregations it should be keyword, for ip comparisons it should be ip_range.
So probably network.cidr should be ip_range type and using fields network.cidr.keyword for keyword data type.

[MikePaquette]

@vbohata @rgil Quick question: From where would this field be populated? For example is this a field that would normally be found in an event? Can you provide examples? Or is this a kind of enrichment field that you might populate by doing a lookup from an external db?

[robgil]

@MikePaquette any number of logs will write cidr ranges. @vbohata mentions their firewall logs above, but this can also be BGP logs, firewall policy logs (when policies apply to cidr ranges), VPN/IPSec Logs (left / right networks are in cidr notation), VPCs, VPC subnets (source and destination subnet for example). Another even more common case would be to log the CIDR of a public IP thats involved in an attack. You might log the CIDR, owner, country of origin, etc of an attacking/suspicious IP.

This can also be used for enrichment. Examples

• Adding the cidr a particular host is part of 10.10.10.10 being in 10.10.10.0/24
• VPC specific events (cloudtrail logs can be enriched with the CIDR of the VPC)

[vbohata]

Also part of dhcp logs and more.

[MikePaquette]

Thanks @robgil @vbohata Sounds good.

[ruflin]

@robgil Do you want to open a PR with it?