elastic / elastic/integrations

[Network Package Capture]: event.action ECS Fields missing

Open
#13,566 3 comments 0 reactions 0 assignees View on GitHub
Integration:network_traffic needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

Network Packet Capture [network_traffic]

### Dataset Name

network_traffic.tls, network_traffic.http, network_traffic.dns

### Integration Version

1.33

### Agent Version

8.17.4

### Agent Output Type

logstash

### Elasticsearch Version

8.17.1

### OS Version and Architecture

Windows 11

### Software/API Version

_No response_

### Error Message

data_stream.dataset:network_traffic.tls
data_stream.dataset:network_traffic.http
data_stream.dataset:network_traffic.dns

Missing
event.action (core)

### Event Original

_No response_

### What did you do?

Installed per docs

### What did you see?

Discover view, event.action is missing from NPC. Defend's DNS logs have an event.action filled out.

### What did you expect to see?

Data in the field.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.