elastic / elastic/integrations

[Common Event Format (CEF)]: network.transport should use Keyword name

Open
#19,928 3 comments 0 reactions 1 assignee Claimed by @qcorporation View on GitHub
Integration:cef needs:triage Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Common Event Format (CEF) [packages/cef]

### Dataset Name

cef.log

### Integration Version

2.23.2

### Agent Version

8.19

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.19

### OS Version and Architecture

Irrelevant.

### Software/API Version

_No response_

### Error Message

The integration writes protocol numbers into network.transport, but according to the ECS, it should use the keyword name

> Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)

### Event Original

_No response_

### What did you do?

nothing

### What did you see?

protocol numbers instead of keywords

### What did you expect to see?

keywords, but not protocol numbers

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.