elastic / elastic/integrations
[Network Package Capture]: event.action ECS Fields missing
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Network Packet Capture [network_traffic]
### Dataset Name
network_traffic.tls, network_traffic.http, network_traffic.dns
### Integration Version
1.33
### Agent Version
8.17.4
### Agent Output Type
logstash
### Elasticsearch Version
8.17.1
### OS Version and Architecture
Windows 11
### Software/API Version
_No response_
### Error Message
data_stream.dataset:network_traffic.tls
data_stream.dataset:network_traffic.http
data_stream.dataset:network_traffic.dns
Missing
event.action (core)
### Event Original
_No response_
### What did you do?
Installed per docs
### What did you see?
Discover view, event.action is missing from NPC. Defend's DNS logs have an event.action filled out.
### What did you expect to see?
Data in the field.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.