Module observer 

An observer is defined as a special network, security, or application device used to detect, observe, or create network, security, or application-related events and metrics. This could be a custom hardware appliance or a server that has been configured to run special network, security, or application software. Examples include firewalls, web proxies, intrusion detection/prevention systems, network monitoring sensors, web application firewalls, data loss prevention systems, and APM servers. The observer.* fields shall be populated with details of the system, if any, that detects, observes and/or creates a network, security, or application event or metric. Message queues and ETL components used in processing events or metrics are not considered observers in ECS.

Constants

OBSERVER_EGRESS

Observer.egress holds information like interface number and name, vlan, and zone information to classify egress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

OBSERVER_EGRESS_INTERFACE_ALIAS

Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.

OBSERVER_EGRESS_INTERFACE_ID

Interface ID as reported by an observer (typically SNMP interface ID).

OBSERVER_EGRESS_INTERFACE_NAME

Interface name as reported by the system.

OBSERVER_EGRESS_VLAN_ID

VLAN ID as reported by the observer.

OBSERVER_EGRESS_VLAN_NAME

Optional VLAN name as reported by the observer.

OBSERVER_EGRESS_ZONE

Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc.

OBSERVER_GEO_CITY_NAME

City name.

OBSERVER_GEO_CONTINENT_CODE

Two-letter code representing continent’s name.

OBSERVER_GEO_CONTINENT_NAME

Name of the continent.

OBSERVER_GEO_COUNTRY_ISO_CODE

Country ISO code.

OBSERVER_GEO_COUNTRY_NAME

Country name.

OBSERVER_GEO_LOCATION

Longitude and latitude.

OBSERVER_GEO_NAME

User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation.

OBSERVER_GEO_POSTAL_CODE

Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.

OBSERVER_GEO_REGION_ISO_CODE

Region ISO code.

OBSERVER_GEO_REGION_NAME

Region name.

OBSERVER_GEO_TIMEZONE

The time zone of the location, such as IANA time zone name.

OBSERVER_HOSTNAME

Hostname of the observer.

OBSERVER_INGRESS

Observer.ingress holds information like interface number and name, vlan, and zone information to classify ingress traffic. Single armed monitoring such as a network sensor on a span port should only use observer.ingress to categorize traffic.

OBSERVER_INGRESS_INTERFACE_ALIAS

Interface alias as reported by the system, typically used in firewall implementations for e.g. inside, outside, or dmz logical interface naming.

OBSERVER_INGRESS_INTERFACE_ID

Interface ID as reported by an observer (typically SNMP interface ID).

OBSERVER_INGRESS_INTERFACE_NAME

Interface name as reported by the system.

OBSERVER_INGRESS_VLAN_ID

VLAN ID as reported by the observer.

OBSERVER_INGRESS_VLAN_NAME

Optional VLAN name as reported by the observer.

OBSERVER_INGRESS_ZONE

Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc.

OBSERVER_IP

IP addresses of the observer.

OBSERVER_MAC

MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

OBSERVER_NAME

Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty.

OBSERVER_OS_FAMILY

OS family (such as redhat, debian, freebsd, windows).

OBSERVER_OS_FULL

Operating system name, including the version or code name.

OBSERVER_OS_KERNEL

Operating system kernel version as a raw string.

OBSERVER_OS_NAME

Operating system name, without the version.

OBSERVER_OS_PLATFORM

Operating system platform (such centos, ubuntu, windows).

OBSERVER_OS_TYPE

Use the os.type field to categorize the operating system into one of the broad commercial families. If the OS you’re dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.

OBSERVER_OS_VERSION

Operating system version as a raw string.

OBSERVER_PRODUCT

The product name of the observer.

OBSERVER_SERIAL_NUMBER

Observer serial number.

OBSERVER_TYPE

The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are forwarder, firewall, ids, ips, proxy, poller, sensor, APM server.

OBSERVER_VENDOR

Vendor name of the observer.

OBSERVER_VERSION

Observer version.