elastic / elastic/integrations
[Common Event Format (CEF)]: network.transport should use Keyword name
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Common Event Format (CEF) [packages/cef]
### Dataset Name
cef.log
### Integration Version
2.23.2
### Agent Version
8.19
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.19
### OS Version and Architecture
Irrelevant.
### Software/API Version
_No response_
### Error Message
The integration writes protocol numbers into network.transport, but according to the ECS, it should use the keyword name
> Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
### Event Original
_No response_
### What did you do?
nothing
### What did you see?
protocol numbers instead of keywords
### What did you expect to see?
keywords, but not protocol numbers
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.