User metadata as field

Network Flows
1

Hello

Is it possible to overwrite the field client.as.organization.name using the user metadata file User-Defined Metadata | ElastiFlow ?

Best regards

Kaare

2

Hi Kaare,

Yes you can use the same field name in the ipaddrs.yml to overwrite the value for a specific IP subnet, range or host IP.

Eric

1 Like
3

Ok, so I have tried this in ipaddres.yml:

10.10.0.0/24:
  client.as.organization.name: "companyA"

But the value stays PRIVATE can I overrule this?

image
image902×80 4.73 KB

4

Is EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE in flowcoll.yml set to true?

Should the syntax in ipaddrs.yml be?

10.10.0.0/24:
  metadata:
     client.as.organization.name: "companyA"
5

I have this i the settings, and other metadata settings are working fine:

      EF_PROCESSOR_ENRICH_IPADDR_METADATA_ENABLE: 'true'
      EF_PROCESSOR_ENRICH_IPADDR_METADATA_USERDEF_PATH: '/etc/elastiflow/metadata/ipaddrs.yml'
      EF_PROCESSOR_ENRICH_IPADDR_METADATA_REFRESH_RATE: 15

Putting the client.as.organization.name under metadata does not change the PRIVATE value

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.