[netflow]: Append all ip addresses found to the related.ip field.

[aleksmaus]

Proposed commit message

Append all ip addresses found to the related.ip field.

I was not sure if the original issue meant specific fields, if yes then ipv6 was not included in the list.

Anyways, in the first cut appending all the fields that end with *_ipv4_address or *_ipv6_address.
Can redo if the list of the fields limited to just: netflow.post_nat_destination_ipv4_address , netflow.post_nat_source_ipv4_address, netflow.post_nat_destination_ipv6_address , netflow.post_nat_source_ipv6_address.

Let me know.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Closes NetFlow Records Integration: Append Network Address Translation IP fields to related.ip #9202

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[taylor-swanson]

Do we want to handle observer.ip as well?

[aleksmaus]

Do we want to handle observer.ip as well?

I don't know what are the rules. Do we usually add that related.ip?
The original ticket doesn't say anything about this.

[taylor-swanson]

I poked around other integrations. While we're not great at setting related fields, I am seeing other integrations adding observer fields to the related fields, so we should do the same here. If you don't want to mess with the painless script, you could add an append processor for observer.ip instead.

[taylor-swanson]

This is what ECS says about related.ip:

[aleksmaus]

Added observer.ip to related.ip

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 1a267ce

History

• 💚 Build #16205 succeeded 923ae28
• 💚 Build #16204 succeeded 76bb788

cc @aleksmaus

[elastic-vault-github-plugin-prod]

Package netflow - 2.19.0 containing this change is available at https://epr.elastic.co/search?package=netflow