URL Category / Policy (proxy, webfilter data)

Proxy/webfilter/etc device types that handle URL data will generally categorize that data. E.g., “Search Engines”, “Entertainment”, “Education”, etc

We’re missing a field to place this information, url.category or url.type. I would have suggested event.category, but that’s listed as a field where a future change is intended to enumerate field values, so that wouldn’t fit with device-provided parsed data.

In addition, I would suggested a url.policy or url.rule which would contain the rule number or keyword value that either allowed or blocked a request through a device. This could also go under event itself, as a police or rule field there.

If the http object is a better choice for this information, that is fine as well

[webmat]

Thanks for bringing this to our attention. We’ll consider this for future versions of ECS.

I like url.category best, among these choices. I’d say it’s safe for you to add url.category as a custom field right now.

[ebeahan]

We now even require file classification which can be implemented the same way as URL one. So what about to create reusable *.classification.[class/category/subcategory] subfields?

@vbohata Do the rule.* fields also align with some of your new needs? Happy to discuss more if needed, but I suggest we start up a new issue.