elastic / elastic/ecs

Software - Source/Destination and/or Client/Server

Open
#416 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.1k
Forks
455
Avg merge
17h 8m
Merged PRs (30d)
5

Description

Looking into the ECS documentation I don't see a schema for software.
I think this is different than user agent, which is more along the lines of HTTP user agent or such.
This would include things like software name, major version, minor version, minor2, minor3, etc...

Therefore, I would like to discuss and propose adding or documenting a schema for `software` specifically for source and destination.
I would be open to using source.user_agent. for this as well. But would like to discuss if software makes sense first.

This is especially useful in network data. For example when an ssh client makes a connection to an ssh server the client/source & destination/server software informatino is logged.
Example data:
source/client: `OpenSSH_12.6p1`
destination/server: `Cisco-5.9`

### Using example data above
```
"source.software.original": "OpenSSH_12.6p1",
"source.software.name": "OpenSSH",
"source.software.version.major": 12,
"source.software.version.minor": 6,
"source.software.version.additional": "p1",
"destination.software.original": "Cisco-5.9",
"destination.software.name": "Cisco",
"destination.software.version.major": 5,
"destination.software.version.minor": 9,
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.