opensearch-project / opensearch-project/security-analytics
[FEATURE] Rename network events to Network events: Zeek
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 111
- Forks
- 111
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 13
Description
Is your feature request related to a problem?
There are no docs per log type, this makes implementing and using the security analytics quite difficult. That being said, the field mapping for the network events seems to hint at that the source should be Zeek. There are many more solutions like Suricata, so it would be more user friendly to call the network logs by it's actual implementation: Zeek or Network logs: Zeek?
What solution would you like?
Clear naming and better documentation
What alternatives have you considered?
n/a
Do you have any additional context?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names the “Network events” label, its field mapping, and missing per-log-type documentation, but no files, tests, or entry points. Start by locating the label and mapping referenced in the issue, then review the existing network-log documentation. Done means the naming is clarified and documentation identifies the log type and its source.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100