Discussion Topic: Verbs

We’re attempting to adapt our feeds to ECS to try it out. So far, so good when it comes to identifying the Nouns in the events, but we’re struggling with the Verbs.

If a firewall (covered) blocks traffic, some source IP (covered) some dest IP (covered) on such and such ports (all covered) at some time (covered), I get to what happened: REJECT

Where does that go…

I see the http now and I’m thinking, maybe we could abstract that and use it for other services? Maybe service is that abstraction?

{ 
  "service: {
    "name": "httpd",
    "verb":  404,
   ...
}

{ 
  "service": {
    "name": "firewall",
    "verb": "reject",
   ...
}

That doesn’t feel exactly right… but I feel like we need something like that. Anyone else thinking about that?

Whether it was an authentication failure (or success) for ssh, or a firewall blocking something, or whatever… something is happening in those logged messages. I want to capture that part.

I feel like making tags for every service is the wrong path, I’m not sure what to do. :-\

Thanks for listening anyway 😄

[ave19]

We’ll have to try some things and see how they go. I’ll try to keep you posted.

[praseodym]

I would expect something like event.action for this use case!