[filebeat][decode_cef] Add hyphen support

CHANGELOG.next.asciidoc

@@ -38,10 +38,12 @@ https:/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Implement Elastic Agent status and health reporting for Winlog Filebeat input. {pull}40163[40163]
 - Fix filestream's registry GC: registry entries will never be removed if clean_inactive is set to "-1". {pull}40258[40258]
 - Added `ignore_empty_values` flag in `decode_cef` Filebeat processor. {pull}40268[40268]
+- Added support for hyphens in extension keys in `decode_cef` Filebeat processor. {pull}40427[40427]
 - Journald: removed configuration options `include_matches.or`, `include_matches.and`, `backoff`, `max_backoff`, `cursor_seek_fallback`. {pull}40061[40061]
 - Journald: `include_matches.match` now behaves in the same way as matchers in `journalctl`. Users should carefully update their input configuration. {pull}40061[40061]
 - Journald: `seek` and `since` behaviour have been simplified, if there is a cursor (state) `seek` and `since` are ignored and the cursor is used. {pull}40061[40061]
 
+
 *Heartbeat*
 
 

x-pack/filebeat/processors/decode_cef/cef/.gitignore

@@ -1,2 +1,3 @@
 *.svg
 *.dot
+*.ri

x-pack/filebeat/processors/decode_cef/cef/cef.rl

@@ -32,7 +32,7 @@
  # Only alnum is defined in the CEF spec. The other characters allow
  # non-conforming extension keys to be parsed.
  extension_key_start_chars = alnum | '_';
- extension_key_chars = extension_key_start_chars | '.' | ',' | '[' | ']';
+ extension_key_chars = extension_key_start_chars | '.' | ',' | '[' | ']' | '-';
  extension_key_pattern = extension_key_start_chars extension_key_chars*;
  extension_value_chars_nospace = extension_value_escapes | (any -- equal -- escape -- space);
 

x-pack/filebeat/processors/decode_cef/cef/cef_test.go

@@ -60,6 +60,8 @@ const (
 
  noValueInExtension = `CEF:26|security|threat=manager|1.0|100|trojan successfully stopped|10|src= dst=12.121.122.82 spt=`
 
+ hyphenInExtensionKey = `CEF:26|security|threatmanager|1.0|100|trojan successfully stopped|10|Some-Key=123456`
+
  // Found by fuzzing but minimised by hand.
  fuzz0 = `CEF:0|a=\\ b|`
  fuzz1 = `CEF:0|\|a=|b=`
@@ -87,6 +89,7 @@ var testMessages = []string{
  escapedMessage,
  truncatedHeader,
  noValueInExtension,
+ hyphenInExtensionKey,
  fuzz0,
  fuzz1,
  fuzz2,
@@ -180,6 +183,24 @@ func TestEventUnpack(t *testing.T) {
  }, e.Extensions)
  })
 
+ t.Run("hyphenInExtensionKey", func(t *testing.T) {
+ var e Event
+ err := e.Unpack(hyphenInExtensionKey)
+ assert.NoError(t, err)
+ assert.Equal(t, 26, e.Version)
+ assert.Equal(t, "security", e.DeviceVendor)
+ assert.Equal(t, "threatmanager", e.DeviceProduct)
+ assert.Equal(t, "1.0", e.DeviceVersion)
+ assert.Equal(t, "100", e.DeviceEventClassID)
+ assert.Equal(t, "trojan successfully stopped", e.Name)
+ assert.Equal(t, "10", e.Severity)
+ assert.Equal(t, map[string]*Field{
+ "Some-Key": {
+ String: "123456",
+ },
+ }, e.Extensions)
+ })
+
  t.Run("equalsSignInHeader", func(t *testing.T) {
  var e Event
  err := e.Unpack(equalsSignInHeader)