diff --git a/CHANGELOG.md b/CHANGELOG.md
index 061e1d8ee..4f2947d78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -85,6 +85,7 @@ Thankyou! -->
1. Added `ancestry` as a list of `process_entity`. #1317
1. Added `internal_name` as a `string_t`. #1322
1. Added `cc_mailboxes`, `from_mailbox`, `to_mailboxes`, `delivered_to_list` and `reply_to_mailboxes`. #1307
+ 1. Added `flag_history` and `bytes_missed` attributes. #1316
* #### Objects
1. Added `environment_variable` object. #1172, #1288
@@ -189,6 +190,8 @@ Thankyou! -->
1. Added `internal_name` to the `file` object. #1322
1. Added `cc_mailboxes`, `from_mailbox`, `to_mailboxes`, `delivered_to_list` and `reply_to_mailboxes` to `email` object. #1307
1. Added `sans` array to `certificate` object. #1325
+ 1. Added `flag_history` attribute to the `network_connection_info` object. #1316
+ 1. Added `bytes_missed` attribute to the `network_traffic` object. #1316
### Bugfixes
1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180
diff --git a/dictionary.json b/dictionary.json
index 85c17feca..10928278c 100644
--- a/dictionary.json
+++ b/dictionary.json
@@ -486,6 +486,11 @@
"description": "The number of bytes sent from the destination to the source.",
"type": "long_t"
},
+ "bytes_missed": {
+ "caption": "Bytes Missed",
+ "description": "Indicates the number of bytes missed, which is representative of packet loss.",
+ "type": "long_t"
+ },
"bytes_out": {
"caption": "Bytes Out",
"description": "The number of bytes sent from the source to the destination.",
@@ -2294,6 +2299,17 @@
"description": "The software package version in which a reported vulnerability was patched/fixed.",
"type": "string_t"
},
+ "flag_history": {
+ "caption": "Connection Flag History",
+ "description": "The Connection Flag History summarizes events in a network connection. For example flags ShAD
representing SYN, SYN/ACK, ACK and Data exchange.",
+ "references": [
+ {
+ "description": "Zeek History",
+ "url": "https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is"
+ }
+ ],
+ "type": "string_t"
+ },
"flag_ids": {
"caption": "Communication Flag IDs",
"description": "The list of normalized identifiers of the communication flag IDs. See specific usage.",
@@ -2313,7 +2329,7 @@
},
"flags": {
"caption": "Flags",
- "description": "The list of communication flags, normalized to the captions of the flag_ids values. In the case of 'Other', they are defined by the event source.",
+ "description": "The list of communication flags, normalized to the captions of the flag_ids values. See specific usage.",
"type": "string_t",
"is_array": true
},
@@ -2546,8 +2562,16 @@
"sibling": "impact",
"type": "integer_t",
"source": "impact value; impact level",
- "references": [{"description": "NIST SP 800-172 from FIPS 199", "url": "https://doi.org/10.6028/NIST.FIPS.199"},
- {"description": "NIST Computer Security Resource Center", "url": "https://doi.org/10.6028/NIST.FIPS.199"}],
+ "references": [
+ {
+ "description": "NIST SP 800-172 from FIPS 199",
+ "url": "https://doi.org/10.6028/NIST.FIPS.199"
+ },
+ {
+ "description": "NIST Computer Security Resource Center",
+ "url": "https://doi.org/10.6028/NIST.FIPS.199"
+ }
+ ],
"enum": {
"0": {
"caption": "Unknown",
diff --git a/objects/network_connection_info.json b/objects/network_connection_info.json
index 14a3f45fd..d4fa68e9b 100644
--- a/objects/network_connection_info.json
+++ b/objects/network_connection_info.json
@@ -20,6 +20,9 @@
"direction_id": {
"requirement": "required"
},
+ "flag_history": {
+ "requirement": "optional"
+ },
"protocol_name": {
"caption": "Protocol Name",
"description": "The IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: tcp
or udp
.",
diff --git a/objects/network_traffic.json b/objects/network_traffic.json
index 9adb1e8e7..f0fd83b07 100644
--- a/objects/network_traffic.json
+++ b/objects/network_traffic.json
@@ -11,16 +11,10 @@
"bytes_in": {
"requirement": "optional"
},
- "bytes_out": {
+ "bytes_missed": {
"requirement": "optional"
},
- "packets": {
- "requirement": "recommended"
- },
- "packets_in": {
- "requirement": "optional"
- },
- "packets_out": {
+ "bytes_out": {
"requirement": "optional"
},
"chunks": {
@@ -34,6 +28,15 @@
"chunks_out": {
"description": "The number of chunks sent from the source to the destination.",
"requirement": "optional"
+ },
+ "packets": {
+ "requirement": "recommended"
+ },
+ "packets_in": {
+ "requirement": "optional"
+ },
+ "packets_out": {
+ "requirement": "optional"
}
}
}
diff --git a/objects/request.json b/objects/request.json
index 1e277b9a5..1132b88c9 100644
--- a/objects/request.json
+++ b/objects/request.json
@@ -12,6 +12,7 @@
"requirement": "optional"
},
"flags": {
+ "description": "The communication flags that are associated with the api request.",
"requirement": "optional"
},
"uid": {
diff --git a/objects/response.json b/objects/response.json
index 65f36af25..7de60eedd 100644
--- a/objects/response.json
+++ b/objects/response.json
@@ -21,6 +21,7 @@
"requirement": "recommended"
},
"flags": {
+ "description": "The communication flags that are associated with the api response.",
"requirement": "optional"
},
"message": {