add expected values to dns.header field in firewall_logs data stream

elastic · Jun 26, 2024 · f452d01 · f452d01
1 parent b4138a6
commit f452d01
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/packages/azure/data_stream/firewall_logs/fields/ecs.yml b/packages/azure/data_stream/firewall_logs/fields/ecs.yml
@@ -1 +1,11 @@
-- name: dns.response_code
+- name: dns.header_flags
+  external: ecs
+  expected_values:
+    - AA
+    - TC
+    - RD
+    - RA
+    - AD
+    - CD
+    - DO
+    - QR
diff --git a/packages/azure/docs/firewall_logs.md b/packages/azure/docs/firewall_logs.md
@@ -193,7 +193,7 @@ Please refer to the following [document](https://www.elastic.co/guide/en/ecs/cur
 | data_stream.dataset | Data stream dataset. | constant_keyword |
 | data_stream.namespace | Data stream namespace. | constant_keyword |
 | data_stream.type | Data stream type. | constant_keyword |
-| dns.response_code |  |  |
+| dns.header_flags | Array of 2 letter DNS header flags. | keyword |
 | event.dataset | Event dataset | constant_keyword |
 | event.module | Event module | constant_keyword |
 | geo.city_name | City name. | keyword |