diff --git a/ecs/states-inventory-networks/event-generator/event_generator.py b/ecs/states-inventory-networks/event-generator/event_generator.py index c22314d4a9860..46c479d8a8e65 100644 --- a/ecs/states-inventory-networks/event-generator/event_generator.py +++ b/ecs/states-inventory-networks/event-generator/event_generator.py @@ -44,8 +44,8 @@ def generate_random_agent(): return agent -def generate_random_host(is_root_level=False): - if is_root_level: +def generate_random_host(is_root_level_level=False): + if is_root_level_level: host = { 'ip': f'{random.randint(1, 255)}.{random.randint(0, 255)}.{random.randint(0, 255)}.{random.randint(0, 255)}', 'mac': f'{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}', @@ -158,14 +158,25 @@ def generate_random_network(): } return network +def generate_random_interface(is_root_level=False): + if is_root_level: + interface = { + 'mtu': f'{random.randint(1000000, 99999999)}', + 'state': random.choice(['Active', 'Inactive', 'Unknown']), + 'type': random.choice(['wireless', 'ethernet']) + } + else: + interface = { + 'alias': f'alias{random.randint(0, 9999)}', + 'name': f'name{random.randint(0, 9999)}', + } + + return interface def generate_random_observer(): observer = { 'ingress': { - 'interface': { - 'alias': f'alias{random.randint(0, 9999)}', - 'name': f'name{random.randint(0, 9999)}' - } + 'interface': generate_random_interface(False) } } return observer @@ -179,7 +190,8 @@ def generate_random_data(number): 'agent': generate_random_agent(), 'host': generate_random_host(True), 'network': generate_random_network(), - 'observer': generate_random_observer() + 'observer': generate_random_observer(), + 'interface': generate_random_interface(True) } data.append(event_data) return data diff --git a/ecs/states-inventory-networks/fields/custom/interface.yml b/ecs/states-inventory-networks/fields/custom/interface.yml index 57bfd2c5eb2eb..4d9a5625f22f0 100644 --- a/ecs/states-inventory-networks/fields/custom/interface.yml +++ b/ecs/states-inventory-networks/fields/custom/interface.yml @@ -1,5 +1,9 @@ --- - name: interface + reusable: + top_level: true + expected: + - { at: observer.egress.interface, as: observer.ingress.interface } title: Interface type: group group: 2