Software - Source/Destination and/or Client/Server
- Dominant language
- Python
- Stars
- 1.1k
- Forks
- 455
- Avg merge
- 17h 8m
- Merged PRs (30d)
- 5
Description
Looking into the ECS documentation I don't see a schema for software.
I think this is different than user agent, which is more along the lines of HTTP user agent or such.
This would include things like software name, major version, minor version, minor2, minor3, etc...
Therefore, I would like to discuss and propose adding or documenting a schema for `software` specifically for source and destination.
I would be open to using source.user_agent. for this as well. But would like to discuss if software makes sense first.
This is especially useful in network data. For example when an ssh client makes a connection to an ssh server the client/source & destination/server software informatino is logged.
Example data:
source/client: `OpenSSH_12.6p1`
destination/server: `Cisco-5.9`
### Using example data above
```
"source.software.original": "OpenSSH_12.6p1",
"source.software.name": "OpenSSH",
"source.software.version.major": 12,
"source.software.version.minor": 6,
"source.software.version.additional": "p1",
"destination.software.original": "Cisco-5.9",
"destination.software.name": "Cisco",
"destination.software.version.major": 5,
"destination.software.version.minor": 9,
```
Contributor guide
Assessment
This issue has not been assessed yet.