Usageedit
Creating an ECS eventedit
The recommended way to create instances of EcsDocument is through:
var doc = EcsDocument.CreateNewWithDefaults<EcsDocument>();
This will automatically assign most common ECS fields that can be inferred from the running process.
However there is no requirement to do so, simply creating a new EcsDocument instance directly
is completely valid and supported.
var ecsDocument = new EcsDocument
{
Timestamp = DateTimeOffset.Parse("2019-10-23T19:44:38.485Z"),
Dns = new Dns
{
Id = "23666",
OpCode = "QUERY",
Type = "answer",
QuestionName = "www.example.com",
QuestionType = "A",
QuestionClass = "IN",
QuestionRegisteredDomain = "example.com",
HeaderFlags = new[] { "RD", "RA" },
ResponseCode = "NOERROR",
ResolvedIp = new[] { "10.0.190.47", "10.0.190.117" },
Answers = new[]
{
new DnsAnswers
{
Data = "10.0.190.47",
Name = "www.example.com",
Type = "A",
Class = "IN",
Ttl = 59
},
new DnsAnswers
{
Data = "10.0.190.117",
Name = "www.example.com",
Type = "A",
Class = "IN",
Ttl = 59
}
}
},
Network = new Network
{
Type = "ipv4",
Transport = "udp",
Protocol = "dns",
Direction = "outbound",
CommunityId = "1:19beef+RWVW9+BEEF/Q45VFU+2Y=",
Bytes = 126
},
Source = new Source { Ip = "192.168.86.26", Port = 5785, Bytes = 31 },
Destination = new Destination { Ip = "8.8.4.4", Port = 53, Bytes = 95 },
Client = new Client { Ip = "192.168.86.26", Port = 5785, Bytes = 31 },
Server = new Server { Ip = "8.8.4.4", Port = 53, Bytes = 95 },
Event = new Event
{
Duration = 122433000,
Start = DateTimeOffset.Parse("2019-10-23T19:44:38.485Z"),
End = DateTimeOffset.Parse("2019-10-23T19:44:38.607Z"),
Kind = "event",
Category = new[] { "network_traffic" }
},
Ecs = new Ecs { Version = "1.2.0" },
Metadata = new Dictionary<string, object> { { "client", "ecs-dotnet" } }
};
Dynamically assign ECS fieldsedit
Additionally, ECS fields can be dynamically assigned through
ecsDocument.AssignProperty("orchestrator.cluster.id", "id");
This will assign ecsDocument.Orchestrator.ClusterId to "id" and automatically create a new Orchestrator instance if needed.
Any string or boolean value that is not a known ecs field will be assigned to labels.* and everything else to metatadata.*