Fix spelling typos in Okta and CEF field descriptions

[Copilot]

Corrects four spelling errors in user-facing exported field descriptions across Okta and CEF metadata files.

Changes

• x-pack/filebeat/module/okta/system/_meta/fields.yml

  • informaton → information (3×: raw_user_agent, os, and browser field descriptions)
  • identifer → identifier (external_session_id field description)

• x-pack/filebeat/processors/decode_cef/_meta/fields.yml

  • colon-seperated → colon-separated (destinationMacAddress field description)
  • Thee URI → The URI (deviceZoneURI field description)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[text-auditor] Fix several user-facing field-description typos in Okta and CEF metadata</issue_title>
<issue_description>## Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort fix.

1. Multiple informaton typos in Okta user-agent descriptions

File: x-pack/filebeat/module/okta/system/_meta/fields.yml (lines 86, 91, 96)
Current text: The raw informaton of the user agent. / The OS informaton. / The browser informaton of the client.
Suggested fix: information in all three strings
Why: Clear spelling typo in user-facing exported field descriptions.

2. identifer typo in Okta external session description

File: x-pack/filebeat/module/okta/system/_meta/fields.yml (line 354)
Current text: The session identifer of the external session if any.
Suggested fix: The session identifier of the external session if any.
Why: Clear spelling typo in user-facing exported field descriptions.

3. seperated typo in CEF MAC address description

File: x-pack/filebeat/processors/decode_cef/_meta/fields.yml (line 162)
Current text: Six colon-seperated hexadecimal numbers.
Suggested fix: Six colon-separated hexadecimal numbers.
Why: Clear spelling typo in user-facing exported field descriptions.

4. Thee typo in CEF device zone URI description

File: x-pack/filebeat/processors/decode_cef/_meta/fields.yml (line 474)
Current text: Thee URI for the Zone that the device asset has been assigned to in ArcSight.
Suggested fix: The URI for the Zone that the device asset has been assigned to in ArcSight.
Why: Clear typo in user-facing exported field description.

Suggested Actions

• Replace informaton with information at lines 86, 91, and 96 in x-pack/filebeat/module/okta/system/_meta/fields.yml.
• Replace identifer with identifier at line 354 in x-pack/filebeat/module/okta/system/_meta/fields.yml.
• Replace colon-seperated with colon-separated at line 162 in x-pack/filebeat/processors/decode_cef/_meta/fields.yml.
• Replace Thee URI with The URI at line 474 in x-pack/filebeat/processors/decode_cef/_meta/fields.yml.
• Regenerate docs derived from _meta/fields.yml so published exported-fields text reflects these fixes.

Duplicate check

• Checked /tmp/previous-findings.json; existing tracked item ([text-auditor] Fix two user-facing "occured" typos in exported field descriptions #49082) covers only occured typos, not the four typos above.
• Searched repository issues for informaton, identifer, and colon-seperated; no matching open tracking issue was found for these typos.

---

What is this? | From workflow: Text Auditor

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

• expires on Mar 6, 2026, 2:07 AM UTC

Comments on the Issue (you are @copilot in this section)

• Fixes [text-auditor] Fix several user-facing field-description typos in Okta and CEF metadata #49156

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @Copilot? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[botelastic]

This pull request doesn't have a Team:<team> label.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c6f22b0 and 281d00d.

📒 Files selected for processing (2)

• x-pack/filebeat/module/okta/system/_meta/fields.yml
• x-pack/filebeat/processors/decode_cef/_meta/fields.yml

---

📝 Walkthrough

Walkthrough

This pull request corrects spelling errors in field description metadata files. In the Okta system module fields configuration, three instances of "informaton" are corrected to "information" and one instance of "identifer" is corrected to "identifier". In the CEF decoder fields configuration, "seperated" is corrected to "separated" and "Thee" is corrected to "The". These corrections affect user-facing field descriptions in two YAML metadata files, with six total text edits across both files.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	All four spelling corrections specified in issue #49156 are present in the PR: 'informaton'→'information' fixes (3x), 'identifer'→'identifier', 'colon-seperated'→'colon-separated', and 'Thee'→'The'.
Out of Scope Changes check	✅ Passed	All changes are limited to the two specified YAML metadata files and consist solely of the four requested typo corrections with no extraneous modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch copilot/fix-typos-in-okta-metadata

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[andrewkroh]

This requires a 'make update' to rebuild the content embedded in .go files and possibly docs.

[strawgate]

Closing in favour of a restructured set of PRs that minimise the number of codeowner teams per PR, making approval more tractable. Replacements: #49638 #49639 #49640 #49641 #49642 #49643 #49644