Restrict x509.serial_number to base 16 for 9.x (#2398)

We made 8.x a `should` for the same field in 4fa0abd. As discussed in #2383 (comment) we are making this a `must` for 9.x. Co-authored-by: Michael Wolf <[email protected]>
elastic · Nov 22, 2024 · 4fd9584 · 4fd9584
1 parent cb1a2c1
commit 4fd9584
Show file tree

Hide file tree

Showing 9 changed files with 47 additions and 46 deletions.
diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md
@@ -19,6 +19,7 @@ Thanks, you're awesome :-) -->
 #### Improvements
 
 * Define base encoding of `x509.serial_number`. #2383
+* Restrict the encoding of `x509.serial_number` to base 16. #2398
 
 #### Deprecated
 

diff --git a/docs/fields/field-details.asciidoc b/docs/fields/field-details.asciidoc
@@ -13803,7 +13803,7 @@ example: `2048`
 [[field-x509-serial-number]]
 <<field-x509-serial-number, x509.serial_number>>
 
-a| Unique serial number issued by the certificate authority. For consistency, this should be encoded in base 16 and formatted without colons and uppercase characters.
+a| Unique serial number issued by the certificate authority. For consistency, this must be encoded in base 16 and formatted without colons and uppercase characters.
 
 type: keyword
 

diff --git a/experimental/generated/beats/fields.ecs.yml b/experimental/generated/beats/fields.ecs.yml
@@ -3339,7 +3339,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -9984,7 +9984,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -10541,7 +10541,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -11606,7 +11606,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12174,7 +12174,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12590,7 +12590,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12872,7 +12872,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false

diff --git a/experimental/generated/ecs/ecs_flat.yml b/experimental/generated/ecs/ecs_flat.yml
@@ -5510,7 +5510,7 @@ file.x509.public_key_size:
 file.x509.serial_number:
   dashed_name: file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: file.x509.serial_number
   ignore_above: 1024
@@ -16159,7 +16159,7 @@ threat.enrichments.indicator.file.x509.public_key_size:
 threat.enrichments.indicator.file.x509.serial_number:
   dashed_name: threat-enrichments-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -17085,7 +17085,7 @@ threat.enrichments.indicator.x509.public_key_size:
 threat.enrichments.indicator.x509.serial_number:
   dashed_name: threat-enrichments-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.x509.serial_number
   ignore_above: 1024
@@ -18894,7 +18894,7 @@ threat.indicator.file.x509.public_key_size:
 threat.indicator.file.x509.serial_number:
   dashed_name: threat-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -19836,7 +19836,7 @@ threat.indicator.x509.public_key_size:
 threat.indicator.x509.serial_number:
   dashed_name: threat-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.x509.serial_number
   ignore_above: 1024
@@ -20526,7 +20526,7 @@ tls.client.x509.public_key_size:
 tls.client.x509.serial_number:
   dashed_name: tls-client-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.client.x509.serial_number
   ignore_above: 1024
@@ -21002,7 +21002,7 @@ tls.server.x509.public_key_size:
 tls.server.x509.serial_number:
   dashed_name: tls-server-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.server.x509.serial_number
   ignore_above: 1024

diff --git a/experimental/generated/ecs/ecs_nested.yml b/experimental/generated/ecs/ecs_nested.yml
@@ -6558,7 +6558,7 @@ file:
     file.x509.serial_number:
       dashed_name: file-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: file.x509.serial_number
@@ -18863,7 +18863,7 @@ threat:
     threat.enrichments.indicator.file.x509.serial_number:
       dashed_name: threat-enrichments-indicator-file-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.enrichments.indicator.file.x509.serial_number
@@ -19794,7 +19794,7 @@ threat:
     threat.enrichments.indicator.x509.serial_number:
       dashed_name: threat-enrichments-indicator-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.enrichments.indicator.x509.serial_number
@@ -21606,7 +21606,7 @@ threat:
     threat.indicator.file.x509.serial_number:
       dashed_name: threat-indicator-file-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.indicator.file.x509.serial_number
@@ -22553,7 +22553,7 @@ threat:
     threat.indicator.x509.serial_number:
       dashed_name: threat-indicator-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: threat.indicator.x509.serial_number
@@ -23308,7 +23308,7 @@ tls:
     tls.client.x509.serial_number:
       dashed_name: tls-client-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: tls.client.x509.serial_number
@@ -23788,7 +23788,7 @@ tls:
     tls.server.x509.serial_number:
       dashed_name: tls-server-x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: tls.server.x509.serial_number
@@ -25706,7 +25706,7 @@ x509:
     x509.serial_number:
       dashed_name: x509-serial-number
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       flat_name: x509.serial_number

diff --git a/generated/beats/fields.ecs.yml b/generated/beats/fields.ecs.yml
@@ -3289,7 +3289,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -9934,7 +9934,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -10491,7 +10491,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -11556,7 +11556,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12124,7 +12124,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12540,7 +12540,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false
@@ -12822,7 +12822,7 @@
       type: keyword
       ignore_above: 1024
       description: Unique serial number issued by the certificate authority. For consistency,
-        this should be encoded in base 16 and formatted without colons and uppercase
+        this must be encoded in base 16 and formatted without colons and uppercase
         characters.
       example: 55FBB9C7DEBF09809D12CCAA
       default_field: false

diff --git a/generated/ecs/ecs_flat.yml b/generated/ecs/ecs_flat.yml
@@ -5441,7 +5441,7 @@ file.x509.public_key_size:
 file.x509.serial_number:
   dashed_name: file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: file.x509.serial_number
   ignore_above: 1024
@@ -16090,7 +16090,7 @@ threat.enrichments.indicator.file.x509.public_key_size:
 threat.enrichments.indicator.file.x509.serial_number:
   dashed_name: threat-enrichments-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -17016,7 +17016,7 @@ threat.enrichments.indicator.x509.public_key_size:
 threat.enrichments.indicator.x509.serial_number:
   dashed_name: threat-enrichments-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.enrichments.indicator.x509.serial_number
   ignore_above: 1024
@@ -18825,7 +18825,7 @@ threat.indicator.file.x509.public_key_size:
 threat.indicator.file.x509.serial_number:
   dashed_name: threat-indicator-file-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.file.x509.serial_number
   ignore_above: 1024
@@ -19767,7 +19767,7 @@ threat.indicator.x509.public_key_size:
 threat.indicator.x509.serial_number:
   dashed_name: threat-indicator-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: threat.indicator.x509.serial_number
   ignore_above: 1024
@@ -20457,7 +20457,7 @@ tls.client.x509.public_key_size:
 tls.client.x509.serial_number:
   dashed_name: tls-client-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.client.x509.serial_number
   ignore_above: 1024
@@ -20933,7 +20933,7 @@ tls.server.x509.public_key_size:
 tls.server.x509.serial_number:
   dashed_name: tls-server-x509-serial-number
   description: Unique serial number issued by the certificate authority. For consistency,
-    this should be encoded in base 16 and formatted without colons and uppercase characters.
+    this must be encoded in base 16 and formatted without colons and uppercase characters.
   example: 55FBB9C7DEBF09809D12CCAA
   flat_name: tls.server.x509.serial_number
   ignore_above: 1024