From 9624d76bb915ba4fd579617e4c29583745820ae9 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Wed, 25 Nov 2020 16:26:18 -0500 Subject: [PATCH 01/27] Small bugfix when no --include (not even []) --- scripts/generator.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/generator.py b/scripts/generator.py index 7e009d5fad..4e9e4181be 100644 --- a/scripts/generator.py +++ b/scripts/generator.py @@ -41,7 +41,7 @@ def main(): # ecs_helpers.yaml_dump('ecs.yml', fields) # Detect usage of experimental changes to tweak artifact version label - if loader.EXPERIMENTAL_SCHEMA_DIR in args.include: + if args.include and loader.EXPERIMENTAL_SCHEMA_DIR in args.include: ecs_version += "+exp" fields = loader.load_schemas(ref=args.ref, included_files=args.include) From 9c342f958775624f802f6111daef21d5386212f3 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 09:44:04 -0500 Subject: [PATCH 02/27] Sort the imports --- scripts/generators/es_template.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 086d5246b9..724e925646 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -1,8 +1,9 @@ +import copy import json import sys -import copy from os.path import join + from generators import ecs_helpers From 60038418b25097cd798cb1e308e69710edb52b43 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 09:49:51 -0500 Subject: [PATCH 03/27] Initial implementation, generating only the component templates --- .../elasticsearch/component/agent.json | 39 ++ .../generated/elasticsearch/component/as.json | 28 ++ .../elasticsearch/component/base.json | 22 ++ .../elasticsearch/component/client.json | 167 +++++++++ .../elasticsearch/component/cloud.json | 68 ++++ .../component/code_signature.json | 29 ++ .../elasticsearch/component/container.json | 39 ++ .../elasticsearch/component/destination.json | 167 +++++++++ .../elasticsearch/component/dll.json | 92 +++++ .../elasticsearch/component/dns.json | 85 +++++ .../elasticsearch/component/ecs.json | 16 + .../elasticsearch/component/error.json | 36 ++ .../elasticsearch/component/event.json | 105 ++++++ .../elasticsearch/component/file.json | 276 ++++++++++++++ .../elasticsearch/component/geo.json | 42 +++ .../elasticsearch/component/group.json | 24 ++ .../elasticsearch/component/hash.json | 28 ++ .../elasticsearch/component/host.json | 178 +++++++++ .../elasticsearch/component/http.json | 80 ++++ .../elasticsearch/component/interface.json | 24 ++ .../elasticsearch/component/log.json | 81 ++++ .../elasticsearch/component/network.json | 82 ++++ .../elasticsearch/component/observer.json | 197 ++++++++++ .../elasticsearch/component/organization.json | 25 ++ .../generated/elasticsearch/component/os.json | 50 +++ .../elasticsearch/component/package.json | 62 ++++ .../generated/elasticsearch/component/pe.json | 39 ++ .../elasticsearch/component/process.json | 328 ++++++++++++++++ .../elasticsearch/component/registry.json | 41 ++ .../elasticsearch/component/related.json | 27 ++ .../elasticsearch/component/rule.json | 52 +++ .../elasticsearch/component/server.json | 167 +++++++++ .../elasticsearch/component/service.json | 44 +++ .../elasticsearch/component/source.json | 167 +++++++++ .../elasticsearch/component/threat.json | 76 ++++ .../elasticsearch/component/tls.json | 342 +++++++++++++++++ .../elasticsearch/component/tracing.json | 32 ++ .../elasticsearch/component/url.json | 74 ++++ .../elasticsearch/component/user.json | 236 ++++++++++++ .../elasticsearch/component/user_agent.json | 79 ++++ .../elasticsearch/component/vlan.json | 20 + .../component/vulnerability.json | 75 ++++ .../elasticsearch/component/x509.json | 112 ++++++ generated/elasticsearch/component/agent.json | 40 ++ generated/elasticsearch/component/as.json | 29 ++ generated/elasticsearch/component/base.json | 22 ++ generated/elasticsearch/component/client.json | 174 +++++++++ generated/elasticsearch/component/cloud.json | 68 ++++ .../component/code_signature.json | 29 ++ .../elasticsearch/component/container.json | 39 ++ .../elasticsearch/component/destination.json | 174 +++++++++ generated/elasticsearch/component/dll.json | 93 +++++ generated/elasticsearch/component/dns.json | 87 +++++ generated/elasticsearch/component/ecs.json | 16 + generated/elasticsearch/component/error.json | 40 ++ generated/elasticsearch/component/event.json | 105 ++++++ generated/elasticsearch/component/file.json | 282 ++++++++++++++ generated/elasticsearch/component/geo.json | 43 +++ generated/elasticsearch/component/group.json | 24 ++ generated/elasticsearch/component/hash.json | 28 ++ generated/elasticsearch/component/host.json | 185 +++++++++ generated/elasticsearch/component/http.json | 83 +++++ .../elasticsearch/component/interface.json | 24 ++ generated/elasticsearch/component/log.json | 83 +++++ .../elasticsearch/component/network.json | 82 ++++ .../elasticsearch/component/observer.json | 200 ++++++++++ .../elasticsearch/component/organization.json | 26 ++ generated/elasticsearch/component/os.json | 52 +++ .../elasticsearch/component/package.json | 62 ++++ generated/elasticsearch/component/pe.json | 40 ++ .../elasticsearch/component/process.json | 342 +++++++++++++++++ .../elasticsearch/component/registry.json | 44 +++ .../elasticsearch/component/related.json | 27 ++ generated/elasticsearch/component/rule.json | 52 +++ generated/elasticsearch/component/server.json | 174 +++++++++ .../elasticsearch/component/service.json | 44 +++ generated/elasticsearch/component/source.json | 174 +++++++++ generated/elasticsearch/component/threat.json | 76 ++++ generated/elasticsearch/component/tls.json | 350 ++++++++++++++++++ .../elasticsearch/component/tracing.json | 32 ++ generated/elasticsearch/component/url.json | 79 ++++ generated/elasticsearch/component/user.json | 68 ++++ .../elasticsearch/component/user_agent.json | 82 ++++ generated/elasticsearch/component/vlan.json | 20 + .../component/vulnerability.json | 75 ++++ generated/elasticsearch/component/x509.json | 114 ++++++ scripts/generator.py | 3 +- scripts/generators/es_template.py | 49 ++- 88 files changed, 7878 insertions(+), 10 deletions(-) create mode 100644 experimental/generated/elasticsearch/component/agent.json create mode 100644 experimental/generated/elasticsearch/component/as.json create mode 100644 experimental/generated/elasticsearch/component/base.json create mode 100644 experimental/generated/elasticsearch/component/client.json create mode 100644 experimental/generated/elasticsearch/component/cloud.json create mode 100644 experimental/generated/elasticsearch/component/code_signature.json create mode 100644 experimental/generated/elasticsearch/component/container.json create mode 100644 experimental/generated/elasticsearch/component/destination.json create mode 100644 experimental/generated/elasticsearch/component/dll.json create mode 100644 experimental/generated/elasticsearch/component/dns.json create mode 100644 experimental/generated/elasticsearch/component/ecs.json create mode 100644 experimental/generated/elasticsearch/component/error.json create mode 100644 experimental/generated/elasticsearch/component/event.json create mode 100644 experimental/generated/elasticsearch/component/file.json create mode 100644 experimental/generated/elasticsearch/component/geo.json create mode 100644 experimental/generated/elasticsearch/component/group.json create mode 100644 experimental/generated/elasticsearch/component/hash.json create mode 100644 experimental/generated/elasticsearch/component/host.json create mode 100644 experimental/generated/elasticsearch/component/http.json create mode 100644 experimental/generated/elasticsearch/component/interface.json create mode 100644 experimental/generated/elasticsearch/component/log.json create mode 100644 experimental/generated/elasticsearch/component/network.json create mode 100644 experimental/generated/elasticsearch/component/observer.json create mode 100644 experimental/generated/elasticsearch/component/organization.json create mode 100644 experimental/generated/elasticsearch/component/os.json create mode 100644 experimental/generated/elasticsearch/component/package.json create mode 100644 experimental/generated/elasticsearch/component/pe.json create mode 100644 experimental/generated/elasticsearch/component/process.json create mode 100644 experimental/generated/elasticsearch/component/registry.json create mode 100644 experimental/generated/elasticsearch/component/related.json create mode 100644 experimental/generated/elasticsearch/component/rule.json create mode 100644 experimental/generated/elasticsearch/component/server.json create mode 100644 experimental/generated/elasticsearch/component/service.json create mode 100644 experimental/generated/elasticsearch/component/source.json create mode 100644 experimental/generated/elasticsearch/component/threat.json create mode 100644 experimental/generated/elasticsearch/component/tls.json create mode 100644 experimental/generated/elasticsearch/component/tracing.json create mode 100644 experimental/generated/elasticsearch/component/url.json create mode 100644 experimental/generated/elasticsearch/component/user.json create mode 100644 experimental/generated/elasticsearch/component/user_agent.json create mode 100644 experimental/generated/elasticsearch/component/vlan.json create mode 100644 experimental/generated/elasticsearch/component/vulnerability.json create mode 100644 experimental/generated/elasticsearch/component/x509.json create mode 100644 generated/elasticsearch/component/agent.json create mode 100644 generated/elasticsearch/component/as.json create mode 100644 generated/elasticsearch/component/base.json create mode 100644 generated/elasticsearch/component/client.json create mode 100644 generated/elasticsearch/component/cloud.json create mode 100644 generated/elasticsearch/component/code_signature.json create mode 100644 generated/elasticsearch/component/container.json create mode 100644 generated/elasticsearch/component/destination.json create mode 100644 generated/elasticsearch/component/dll.json create mode 100644 generated/elasticsearch/component/dns.json create mode 100644 generated/elasticsearch/component/ecs.json create mode 100644 generated/elasticsearch/component/error.json create mode 100644 generated/elasticsearch/component/event.json create mode 100644 generated/elasticsearch/component/file.json create mode 100644 generated/elasticsearch/component/geo.json create mode 100644 generated/elasticsearch/component/group.json create mode 100644 generated/elasticsearch/component/hash.json create mode 100644 generated/elasticsearch/component/host.json create mode 100644 generated/elasticsearch/component/http.json create mode 100644 generated/elasticsearch/component/interface.json create mode 100644 generated/elasticsearch/component/log.json create mode 100644 generated/elasticsearch/component/network.json create mode 100644 generated/elasticsearch/component/observer.json create mode 100644 generated/elasticsearch/component/organization.json create mode 100644 generated/elasticsearch/component/os.json create mode 100644 generated/elasticsearch/component/package.json create mode 100644 generated/elasticsearch/component/pe.json create mode 100644 generated/elasticsearch/component/process.json create mode 100644 generated/elasticsearch/component/registry.json create mode 100644 generated/elasticsearch/component/related.json create mode 100644 generated/elasticsearch/component/rule.json create mode 100644 generated/elasticsearch/component/server.json create mode 100644 generated/elasticsearch/component/service.json create mode 100644 generated/elasticsearch/component/source.json create mode 100644 generated/elasticsearch/component/threat.json create mode 100644 generated/elasticsearch/component/tls.json create mode 100644 generated/elasticsearch/component/tracing.json create mode 100644 generated/elasticsearch/component/url.json create mode 100644 generated/elasticsearch/component/user.json create mode 100644 generated/elasticsearch/component/user_agent.json create mode 100644 generated/elasticsearch/component/vlan.json create mode 100644 generated/elasticsearch/component/vulnerability.json create mode 100644 generated/elasticsearch/component/x509.json diff --git a/experimental/generated/elasticsearch/component/agent.json b/experimental/generated/elasticsearch/component/agent.json new file mode 100644 index 0000000000..66fe0572a2 --- /dev/null +++ b/experimental/generated/elasticsearch/component/agent.json @@ -0,0 +1,39 @@ +{ + "template": { + "mappings": { + "properties": { + "agent": { + "properties": { + "build": { + "properties": { + "original": { + "type": "wildcard" + } + } + }, + "ephemeral_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/as.json b/experimental/generated/elasticsearch/component/as.json new file mode 100644 index 0000000000..85b465e03e --- /dev/null +++ b/experimental/generated/elasticsearch/component/as.json @@ -0,0 +1,28 @@ +{ + "template": { + "mappings": { + "properties": { + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/base.json b/experimental/generated/elasticsearch/component/base.json new file mode 100644 index 0000000000..d1818f4faa --- /dev/null +++ b/experimental/generated/elasticsearch/component/base.json @@ -0,0 +1,22 @@ +{ + "template": { + "mappings": { + "properties": { + "@timestamp": { + "type": "date" + }, + "labels": { + "type": "object" + }, + "message": { + "norms": false, + "type": "text" + }, + "tags": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/client.json b/experimental/generated/elasticsearch/component/client.json new file mode 100644 index 0000000000..5e628839f5 --- /dev/null +++ b/experimental/generated/elasticsearch/component/client.json @@ -0,0 +1,167 @@ +{ + "template": { + "mappings": { + "properties": { + "client": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "type": "wildcard" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "type": "wildcard" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "type": "wildcard" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/cloud.json b/experimental/generated/elasticsearch/component/cloud.json new file mode 100644 index 0000000000..feb7e24db8 --- /dev/null +++ b/experimental/generated/elasticsearch/component/cloud.json @@ -0,0 +1,68 @@ +{ + "template": { + "mappings": { + "properties": { + "cloud": { + "properties": { + "account": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "availability_zone": { + "ignore_above": 1024, + "type": "keyword" + }, + "instance": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "machine": { + "properties": { + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "project": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "provider": { + "ignore_above": 1024, + "type": "keyword" + }, + "region": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/code_signature.json b/experimental/generated/elasticsearch/component/code_signature.json new file mode 100644 index 0000000000..66c183f3f7 --- /dev/null +++ b/experimental/generated/elasticsearch/component/code_signature.json @@ -0,0 +1,29 @@ +{ + "template": { + "mappings": { + "properties": { + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/container.json b/experimental/generated/elasticsearch/component/container.json new file mode 100644 index 0000000000..c9db580555 --- /dev/null +++ b/experimental/generated/elasticsearch/component/container.json @@ -0,0 +1,39 @@ +{ + "template": { + "mappings": { + "properties": { + "container": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "image": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "tag": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "labels": { + "type": "object" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "runtime": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/destination.json b/experimental/generated/elasticsearch/component/destination.json new file mode 100644 index 0000000000..d6b0c73c14 --- /dev/null +++ b/experimental/generated/elasticsearch/component/destination.json @@ -0,0 +1,167 @@ +{ + "template": { + "mappings": { + "properties": { + "destination": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "type": "wildcard" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "type": "wildcard" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "type": "wildcard" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/dll.json b/experimental/generated/elasticsearch/component/dll.json new file mode 100644 index 0000000000..c42dd2ae07 --- /dev/null +++ b/experimental/generated/elasticsearch/component/dll.json @@ -0,0 +1,92 @@ +{ + "template": { + "mappings": { + "properties": { + "dll": { + "properties": { + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "type": "wildcard" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/dns.json b/experimental/generated/elasticsearch/component/dns.json new file mode 100644 index 0000000000..c40e9ff2ab --- /dev/null +++ b/experimental/generated/elasticsearch/component/dns.json @@ -0,0 +1,85 @@ +{ + "template": { + "mappings": { + "properties": { + "dns": { + "properties": { + "answers": { + "properties": { + "class": { + "ignore_above": 1024, + "type": "keyword" + }, + "data": { + "type": "wildcard" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "ttl": { + "type": "long" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + }, + "type": "object" + }, + "header_flags": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "op_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "question": { + "properties": { + "class": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "type": "wildcard" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "resolved_ip": { + "type": "ip" + }, + "response_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/ecs.json b/experimental/generated/elasticsearch/component/ecs.json new file mode 100644 index 0000000000..df4b5d56e4 --- /dev/null +++ b/experimental/generated/elasticsearch/component/ecs.json @@ -0,0 +1,16 @@ +{ + "template": { + "mappings": { + "properties": { + "ecs": { + "properties": { + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/error.json b/experimental/generated/elasticsearch/component/error.json new file mode 100644 index 0000000000..6726920778 --- /dev/null +++ b/experimental/generated/elasticsearch/component/error.json @@ -0,0 +1,36 @@ +{ + "template": { + "mappings": { + "properties": { + "error": { + "properties": { + "code": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "message": { + "norms": false, + "type": "text" + }, + "stack_trace": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "type": { + "type": "wildcard" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/event.json b/experimental/generated/elasticsearch/component/event.json new file mode 100644 index 0000000000..a8a6eb1f55 --- /dev/null +++ b/experimental/generated/elasticsearch/component/event.json @@ -0,0 +1,105 @@ +{ + "template": { + "mappings": { + "properties": { + "event": { + "properties": { + "action": { + "ignore_above": 1024, + "type": "keyword" + }, + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "code": { + "ignore_above": 1024, + "type": "keyword" + }, + "created": { + "type": "date" + }, + "dataset": { + "ignore_above": 1024, + "type": "keyword" + }, + "duration": { + "type": "long" + }, + "end": { + "type": "date" + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "ingested": { + "type": "date" + }, + "kind": { + "ignore_above": 1024, + "type": "keyword" + }, + "module": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "doc_values": false, + "ignore_above": 1024, + "index": false, + "type": "keyword" + }, + "outcome": { + "ignore_above": 1024, + "type": "keyword" + }, + "provider": { + "ignore_above": 1024, + "type": "keyword" + }, + "reason": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "risk_score": { + "type": "float" + }, + "risk_score_norm": { + "type": "float" + }, + "sequence": { + "type": "long" + }, + "severity": { + "type": "long" + }, + "start": { + "type": "date" + }, + "timezone": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "url": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/file.json b/experimental/generated/elasticsearch/component/file.json new file mode 100644 index 0000000000..67890178e2 --- /dev/null +++ b/experimental/generated/elasticsearch/component/file.json @@ -0,0 +1,276 @@ +{ + "template": { + "mappings": { + "properties": { + "file": { + "properties": { + "accessed": { + "type": "date" + }, + "attributes": { + "ignore_above": 1024, + "type": "keyword" + }, + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "created": { + "type": "date" + }, + "ctime": { + "type": "date" + }, + "device": { + "ignore_above": 1024, + "type": "keyword" + }, + "directory": { + "type": "wildcard" + }, + "drive_letter": { + "ignore_above": 1, + "type": "keyword" + }, + "extension": { + "ignore_above": 1024, + "type": "keyword" + }, + "gid": { + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "ignore_above": 1024, + "type": "keyword" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "inode": { + "ignore_above": 1024, + "type": "keyword" + }, + "mime_type": { + "ignore_above": 1024, + "type": "keyword" + }, + "mode": { + "ignore_above": 1024, + "type": "keyword" + }, + "mtime": { + "type": "date" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "owner": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "type": "wildcard" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "size": { + "type": "long" + }, + "target_path": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "uid": { + "ignore_above": 1024, + "type": "keyword" + }, + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/geo.json b/experimental/generated/elasticsearch/component/geo.json new file mode 100644 index 0000000000..81dc5defcb --- /dev/null +++ b/experimental/generated/elasticsearch/component/geo.json @@ -0,0 +1,42 @@ +{ + "template": { + "mappings": { + "properties": { + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "type": "wildcard" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/group.json b/experimental/generated/elasticsearch/component/group.json new file mode 100644 index 0000000000..7500ad89c0 --- /dev/null +++ b/experimental/generated/elasticsearch/component/group.json @@ -0,0 +1,24 @@ +{ + "template": { + "mappings": { + "properties": { + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/hash.json b/experimental/generated/elasticsearch/component/hash.json new file mode 100644 index 0000000000..d7776dcf12 --- /dev/null +++ b/experimental/generated/elasticsearch/component/hash.json @@ -0,0 +1,28 @@ +{ + "template": { + "mappings": { + "properties": { + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/host.json b/experimental/generated/elasticsearch/component/host.json new file mode 100644 index 0000000000..c77aaf43e2 --- /dev/null +++ b/experimental/generated/elasticsearch/component/host.json @@ -0,0 +1,178 @@ +{ + "template": { + "mappings": { + "properties": { + "host": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "type": "wildcard" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hostname": { + "type": "wildcard" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "uptime": { + "type": "long" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/http.json b/experimental/generated/elasticsearch/component/http.json new file mode 100644 index 0000000000..78885efcea --- /dev/null +++ b/experimental/generated/elasticsearch/component/http.json @@ -0,0 +1,80 @@ +{ + "template": { + "mappings": { + "properties": { + "http": { + "properties": { + "request": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + }, + "bytes": { + "type": "long" + }, + "method": { + "ignore_above": 1024, + "type": "keyword" + }, + "mime_type": { + "ignore_above": 1024, + "type": "keyword" + }, + "referrer": { + "type": "wildcard" + } + } + }, + "response": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + }, + "bytes": { + "type": "long" + }, + "mime_type": { + "ignore_above": 1024, + "type": "keyword" + }, + "status_code": { + "type": "long" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/interface.json b/experimental/generated/elasticsearch/component/interface.json new file mode 100644 index 0000000000..67b95e8dc9 --- /dev/null +++ b/experimental/generated/elasticsearch/component/interface.json @@ -0,0 +1,24 @@ +{ + "template": { + "mappings": { + "properties": { + "interface": { + "properties": { + "alias": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/log.json b/experimental/generated/elasticsearch/component/log.json new file mode 100644 index 0000000000..05477692cd --- /dev/null +++ b/experimental/generated/elasticsearch/component/log.json @@ -0,0 +1,81 @@ +{ + "template": { + "mappings": { + "properties": { + "log": { + "properties": { + "file": { + "properties": { + "path": { + "type": "wildcard" + } + } + }, + "level": { + "ignore_above": 1024, + "type": "keyword" + }, + "logger": { + "type": "wildcard" + }, + "origin": { + "properties": { + "file": { + "properties": { + "line": { + "type": "integer" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "function": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "original": { + "doc_values": false, + "ignore_above": 1024, + "index": false, + "type": "keyword" + }, + "syslog": { + "properties": { + "facility": { + "properties": { + "code": { + "type": "long" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "priority": { + "type": "long" + }, + "severity": { + "properties": { + "code": { + "type": "long" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + }, + "type": "object" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/network.json b/experimental/generated/elasticsearch/component/network.json new file mode 100644 index 0000000000..74a7b796e9 --- /dev/null +++ b/experimental/generated/elasticsearch/component/network.json @@ -0,0 +1,82 @@ +{ + "template": { + "mappings": { + "properties": { + "network": { + "properties": { + "application": { + "ignore_above": 1024, + "type": "keyword" + }, + "bytes": { + "type": "long" + }, + "community_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "direction": { + "ignore_above": 1024, + "type": "keyword" + }, + "forwarded_ip": { + "type": "ip" + }, + "iana_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "inner": { + "properties": { + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + }, + "type": "object" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "packets": { + "type": "long" + }, + "protocol": { + "ignore_above": 1024, + "type": "keyword" + }, + "transport": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/observer.json b/experimental/generated/elasticsearch/component/observer.json new file mode 100644 index 0000000000..3e58dabf8a --- /dev/null +++ b/experimental/generated/elasticsearch/component/observer.json @@ -0,0 +1,197 @@ +{ + "template": { + "mappings": { + "properties": { + "observer": { + "properties": { + "egress": { + "properties": { + "interface": { + "properties": { + "alias": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "zone": { + "ignore_above": 1024, + "type": "keyword" + } + }, + "type": "object" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "type": "wildcard" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hostname": { + "ignore_above": 1024, + "type": "keyword" + }, + "ingress": { + "properties": { + "interface": { + "properties": { + "alias": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "zone": { + "ignore_above": 1024, + "type": "keyword" + } + }, + "type": "object" + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "vendor": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/organization.json b/experimental/generated/elasticsearch/component/organization.json new file mode 100644 index 0000000000..32cf3ab4f5 --- /dev/null +++ b/experimental/generated/elasticsearch/component/organization.json @@ -0,0 +1,25 @@ +{ + "template": { + "mappings": { + "properties": { + "organization": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/os.json b/experimental/generated/elasticsearch/component/os.json new file mode 100644 index 0000000000..db3eca753d --- /dev/null +++ b/experimental/generated/elasticsearch/component/os.json @@ -0,0 +1,50 @@ +{ + "template": { + "mappings": { + "properties": { + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/package.json b/experimental/generated/elasticsearch/component/package.json new file mode 100644 index 0000000000..bc7324b6ba --- /dev/null +++ b/experimental/generated/elasticsearch/component/package.json @@ -0,0 +1,62 @@ +{ + "template": { + "mappings": { + "properties": { + "package": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "build_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "checksum": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "install_scope": { + "ignore_above": 1024, + "type": "keyword" + }, + "installed": { + "type": "date" + }, + "license": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "size": { + "type": "long" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/pe.json b/experimental/generated/elasticsearch/component/pe.json new file mode 100644 index 0000000000..b5ca655c97 --- /dev/null +++ b/experimental/generated/elasticsearch/component/pe.json @@ -0,0 +1,39 @@ +{ + "template": { + "mappings": { + "properties": { + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "type": "wildcard" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/process.json b/experimental/generated/elasticsearch/component/process.json new file mode 100644 index 0000000000..d87851392b --- /dev/null +++ b/experimental/generated/elasticsearch/component/process.json @@ -0,0 +1,328 @@ +{ + "template": { + "mappings": { + "properties": { + "process": { + "properties": { + "args": { + "ignore_above": 1024, + "type": "keyword" + }, + "args_count": { + "type": "long" + }, + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "command_line": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "entity_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "executable": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "exit_code": { + "type": "long" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "parent": { + "properties": { + "args": { + "ignore_above": 1024, + "type": "keyword" + }, + "args_count": { + "type": "long" + }, + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "command_line": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "entity_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "executable": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "exit_code": { + "type": "long" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "type": "wildcard" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "pgid": { + "type": "long" + }, + "pid": { + "type": "long" + }, + "ppid": { + "type": "long" + }, + "start": { + "type": "date" + }, + "thread": { + "properties": { + "id": { + "type": "long" + }, + "name": { + "type": "wildcard" + } + } + }, + "title": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "uptime": { + "type": "long" + }, + "working_directory": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "type": "wildcard" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "pgid": { + "type": "long" + }, + "pid": { + "type": "long" + }, + "ppid": { + "type": "long" + }, + "start": { + "type": "date" + }, + "thread": { + "properties": { + "id": { + "type": "long" + }, + "name": { + "type": "wildcard" + } + } + }, + "title": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "uptime": { + "type": "long" + }, + "working_directory": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/registry.json b/experimental/generated/elasticsearch/component/registry.json new file mode 100644 index 0000000000..315490a950 --- /dev/null +++ b/experimental/generated/elasticsearch/component/registry.json @@ -0,0 +1,41 @@ +{ + "template": { + "mappings": { + "properties": { + "registry": { + "properties": { + "data": { + "properties": { + "bytes": { + "ignore_above": 1024, + "type": "keyword" + }, + "strings": { + "type": "wildcard" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hive": { + "ignore_above": 1024, + "type": "keyword" + }, + "key": { + "type": "wildcard" + }, + "path": { + "type": "wildcard" + }, + "value": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/related.json b/experimental/generated/elasticsearch/component/related.json new file mode 100644 index 0000000000..0d5227f3c1 --- /dev/null +++ b/experimental/generated/elasticsearch/component/related.json @@ -0,0 +1,27 @@ +{ + "template": { + "mappings": { + "properties": { + "related": { + "properties": { + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "hosts": { + "ignore_above": 1024, + "type": "keyword" + }, + "ip": { + "type": "ip" + }, + "user": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/rule.json b/experimental/generated/elasticsearch/component/rule.json new file mode 100644 index 0000000000..43de55f11e --- /dev/null +++ b/experimental/generated/elasticsearch/component/rule.json @@ -0,0 +1,52 @@ +{ + "template": { + "mappings": { + "properties": { + "rule": { + "properties": { + "author": { + "ignore_above": 1024, + "type": "keyword" + }, + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "license": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "ruleset": { + "ignore_above": 1024, + "type": "keyword" + }, + "uuid": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/server.json b/experimental/generated/elasticsearch/component/server.json new file mode 100644 index 0000000000..fcdbaaa7ad --- /dev/null +++ b/experimental/generated/elasticsearch/component/server.json @@ -0,0 +1,167 @@ +{ + "template": { + "mappings": { + "properties": { + "server": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "type": "wildcard" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "type": "wildcard" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "type": "wildcard" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/service.json b/experimental/generated/elasticsearch/component/service.json new file mode 100644 index 0000000000..c36de81125 --- /dev/null +++ b/experimental/generated/elasticsearch/component/service.json @@ -0,0 +1,44 @@ +{ + "template": { + "mappings": { + "properties": { + "service": { + "properties": { + "ephemeral_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "node": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "state": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/source.json b/experimental/generated/elasticsearch/component/source.json new file mode 100644 index 0000000000..9fb01d3652 --- /dev/null +++ b/experimental/generated/elasticsearch/component/source.json @@ -0,0 +1,167 @@ +{ + "template": { + "mappings": { + "properties": { + "source": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "type": "wildcard" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "type": "wildcard" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "type": "wildcard" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/threat.json b/experimental/generated/elasticsearch/component/threat.json new file mode 100644 index 0000000000..6d7662b039 --- /dev/null +++ b/experimental/generated/elasticsearch/component/threat.json @@ -0,0 +1,76 @@ +{ + "template": { + "mappings": { + "properties": { + "threat": { + "properties": { + "framework": { + "ignore_above": 1024, + "type": "keyword" + }, + "tactic": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "technique": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "subtechnique": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/tls.json b/experimental/generated/elasticsearch/component/tls.json new file mode 100644 index 0000000000..b4d7d730d1 --- /dev/null +++ b/experimental/generated/elasticsearch/component/tls.json @@ -0,0 +1,342 @@ +{ + "template": { + "mappings": { + "properties": { + "tls": { + "properties": { + "cipher": { + "ignore_above": 1024, + "type": "keyword" + }, + "client": { + "properties": { + "certificate": { + "ignore_above": 1024, + "type": "keyword" + }, + "certificate_chain": { + "ignore_above": 1024, + "type": "keyword" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "issuer": { + "type": "wildcard" + }, + "ja3": { + "ignore_above": 1024, + "type": "keyword" + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "server_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "type": "wildcard" + }, + "supported_ciphers": { + "ignore_above": 1024, + "type": "keyword" + }, + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "established": { + "type": "boolean" + }, + "next_protocol": { + "ignore_above": 1024, + "type": "keyword" + }, + "resumed": { + "type": "boolean" + }, + "server": { + "properties": { + "certificate": { + "ignore_above": 1024, + "type": "keyword" + }, + "certificate_chain": { + "ignore_above": 1024, + "type": "keyword" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "issuer": { + "type": "wildcard" + }, + "ja3s": { + "ignore_above": 1024, + "type": "keyword" + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "subject": { + "type": "wildcard" + }, + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + }, + "version_protocol": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/tracing.json b/experimental/generated/elasticsearch/component/tracing.json new file mode 100644 index 0000000000..9d9555d9fa --- /dev/null +++ b/experimental/generated/elasticsearch/component/tracing.json @@ -0,0 +1,32 @@ +{ + "template": { + "mappings": { + "properties": { + "span": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "trace": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "transaction": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/url.json b/experimental/generated/elasticsearch/component/url.json new file mode 100644 index 0000000000..567c86f3e8 --- /dev/null +++ b/experimental/generated/elasticsearch/component/url.json @@ -0,0 +1,74 @@ +{ + "template": { + "mappings": { + "properties": { + "url": { + "properties": { + "domain": { + "type": "wildcard" + }, + "extension": { + "ignore_above": 1024, + "type": "keyword" + }, + "fragment": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "password": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "type": "wildcard" + }, + "port": { + "type": "long" + }, + "query": { + "ignore_above": 1024, + "type": "keyword" + }, + "registered_domain": { + "type": "wildcard" + }, + "scheme": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "username": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/user.json b/experimental/generated/elasticsearch/component/user.json new file mode 100644 index 0000000000..ff5bbdac72 --- /dev/null +++ b/experimental/generated/elasticsearch/component/user.json @@ -0,0 +1,236 @@ +{ + "template": { + "mappings": { + "properties": { + "user": { + "properties": { + "changes": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "effective": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + }, + "target": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "type": "wildcard" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/user_agent.json b/experimental/generated/elasticsearch/component/user_agent.json new file mode 100644 index 0000000000..85613440be --- /dev/null +++ b/experimental/generated/elasticsearch/component/user_agent.json @@ -0,0 +1,79 @@ +{ + "template": { + "mappings": { + "properties": { + "user_agent": { + "properties": { + "device": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "type": "wildcard" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/vlan.json b/experimental/generated/elasticsearch/component/vlan.json new file mode 100644 index 0000000000..3cddf5221a --- /dev/null +++ b/experimental/generated/elasticsearch/component/vlan.json @@ -0,0 +1,20 @@ +{ + "template": { + "mappings": { + "properties": { + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/vulnerability.json b/experimental/generated/elasticsearch/component/vulnerability.json new file mode 100644 index 0000000000..a4e37d4b77 --- /dev/null +++ b/experimental/generated/elasticsearch/component/vulnerability.json @@ -0,0 +1,75 @@ +{ + "template": { + "mappings": { + "properties": { + "vulnerability": { + "properties": { + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "classification": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "enumeration": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "report_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "scanner": { + "properties": { + "vendor": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "score": { + "properties": { + "base": { + "type": "float" + }, + "environmental": { + "type": "float" + }, + "temporal": { + "type": "float" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "severity": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/x509.json b/experimental/generated/elasticsearch/component/x509.json new file mode 100644 index 0000000000..d6ea1c8df7 --- /dev/null +++ b/experimental/generated/elasticsearch/component/x509.json @@ -0,0 +1,112 @@ +{ + "template": { + "mappings": { + "properties": { + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "type": "wildcard" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/agent.json b/generated/elasticsearch/component/agent.json new file mode 100644 index 0000000000..78158bbe9c --- /dev/null +++ b/generated/elasticsearch/component/agent.json @@ -0,0 +1,40 @@ +{ + "template": { + "mappings": { + "properties": { + "agent": { + "properties": { + "build": { + "properties": { + "original": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ephemeral_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/as.json b/generated/elasticsearch/component/as.json new file mode 100644 index 0000000000..1f8f48b729 --- /dev/null +++ b/generated/elasticsearch/component/as.json @@ -0,0 +1,29 @@ +{ + "template": { + "mappings": { + "properties": { + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/base.json b/generated/elasticsearch/component/base.json new file mode 100644 index 0000000000..d1818f4faa --- /dev/null +++ b/generated/elasticsearch/component/base.json @@ -0,0 +1,22 @@ +{ + "template": { + "mappings": { + "properties": { + "@timestamp": { + "type": "date" + }, + "labels": { + "type": "object" + }, + "message": { + "norms": false, + "type": "text" + }, + "tags": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/client.json b/generated/elasticsearch/component/client.json new file mode 100644 index 0000000000..75edcb94a3 --- /dev/null +++ b/generated/elasticsearch/component/client.json @@ -0,0 +1,174 @@ +{ + "template": { + "mappings": { + "properties": { + "client": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/cloud.json b/generated/elasticsearch/component/cloud.json new file mode 100644 index 0000000000..feb7e24db8 --- /dev/null +++ b/generated/elasticsearch/component/cloud.json @@ -0,0 +1,68 @@ +{ + "template": { + "mappings": { + "properties": { + "cloud": { + "properties": { + "account": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "availability_zone": { + "ignore_above": 1024, + "type": "keyword" + }, + "instance": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "machine": { + "properties": { + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "project": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "provider": { + "ignore_above": 1024, + "type": "keyword" + }, + "region": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/code_signature.json b/generated/elasticsearch/component/code_signature.json new file mode 100644 index 0000000000..66c183f3f7 --- /dev/null +++ b/generated/elasticsearch/component/code_signature.json @@ -0,0 +1,29 @@ +{ + "template": { + "mappings": { + "properties": { + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/container.json b/generated/elasticsearch/component/container.json new file mode 100644 index 0000000000..c9db580555 --- /dev/null +++ b/generated/elasticsearch/component/container.json @@ -0,0 +1,39 @@ +{ + "template": { + "mappings": { + "properties": { + "container": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "image": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "tag": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "labels": { + "type": "object" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "runtime": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/destination.json b/generated/elasticsearch/component/destination.json new file mode 100644 index 0000000000..31237474f4 --- /dev/null +++ b/generated/elasticsearch/component/destination.json @@ -0,0 +1,174 @@ +{ + "template": { + "mappings": { + "properties": { + "destination": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/dll.json b/generated/elasticsearch/component/dll.json new file mode 100644 index 0000000000..9bbc771143 --- /dev/null +++ b/generated/elasticsearch/component/dll.json @@ -0,0 +1,93 @@ +{ + "template": { + "mappings": { + "properties": { + "dll": { + "properties": { + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/dns.json b/generated/elasticsearch/component/dns.json new file mode 100644 index 0000000000..1814577b10 --- /dev/null +++ b/generated/elasticsearch/component/dns.json @@ -0,0 +1,87 @@ +{ + "template": { + "mappings": { + "properties": { + "dns": { + "properties": { + "answers": { + "properties": { + "class": { + "ignore_above": 1024, + "type": "keyword" + }, + "data": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "ttl": { + "type": "long" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + }, + "type": "object" + }, + "header_flags": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "op_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "question": { + "properties": { + "class": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "resolved_ip": { + "type": "ip" + }, + "response_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/ecs.json b/generated/elasticsearch/component/ecs.json new file mode 100644 index 0000000000..df4b5d56e4 --- /dev/null +++ b/generated/elasticsearch/component/ecs.json @@ -0,0 +1,16 @@ +{ + "template": { + "mappings": { + "properties": { + "ecs": { + "properties": { + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/error.json b/generated/elasticsearch/component/error.json new file mode 100644 index 0000000000..0f2b5e12f3 --- /dev/null +++ b/generated/elasticsearch/component/error.json @@ -0,0 +1,40 @@ +{ + "template": { + "mappings": { + "properties": { + "error": { + "properties": { + "code": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "message": { + "norms": false, + "type": "text" + }, + "stack_trace": { + "doc_values": false, + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "index": false, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/event.json b/generated/elasticsearch/component/event.json new file mode 100644 index 0000000000..a8a6eb1f55 --- /dev/null +++ b/generated/elasticsearch/component/event.json @@ -0,0 +1,105 @@ +{ + "template": { + "mappings": { + "properties": { + "event": { + "properties": { + "action": { + "ignore_above": 1024, + "type": "keyword" + }, + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "code": { + "ignore_above": 1024, + "type": "keyword" + }, + "created": { + "type": "date" + }, + "dataset": { + "ignore_above": 1024, + "type": "keyword" + }, + "duration": { + "type": "long" + }, + "end": { + "type": "date" + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "ingested": { + "type": "date" + }, + "kind": { + "ignore_above": 1024, + "type": "keyword" + }, + "module": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "doc_values": false, + "ignore_above": 1024, + "index": false, + "type": "keyword" + }, + "outcome": { + "ignore_above": 1024, + "type": "keyword" + }, + "provider": { + "ignore_above": 1024, + "type": "keyword" + }, + "reason": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "risk_score": { + "type": "float" + }, + "risk_score_norm": { + "type": "float" + }, + "sequence": { + "type": "long" + }, + "severity": { + "type": "long" + }, + "start": { + "type": "date" + }, + "timezone": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "url": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/file.json b/generated/elasticsearch/component/file.json new file mode 100644 index 0000000000..ca5a80a6cf --- /dev/null +++ b/generated/elasticsearch/component/file.json @@ -0,0 +1,282 @@ +{ + "template": { + "mappings": { + "properties": { + "file": { + "properties": { + "accessed": { + "type": "date" + }, + "attributes": { + "ignore_above": 1024, + "type": "keyword" + }, + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "created": { + "type": "date" + }, + "ctime": { + "type": "date" + }, + "device": { + "ignore_above": 1024, + "type": "keyword" + }, + "directory": { + "ignore_above": 1024, + "type": "keyword" + }, + "drive_letter": { + "ignore_above": 1, + "type": "keyword" + }, + "extension": { + "ignore_above": 1024, + "type": "keyword" + }, + "gid": { + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "ignore_above": 1024, + "type": "keyword" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "inode": { + "ignore_above": 1024, + "type": "keyword" + }, + "mime_type": { + "ignore_above": 1024, + "type": "keyword" + }, + "mode": { + "ignore_above": 1024, + "type": "keyword" + }, + "mtime": { + "type": "date" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "owner": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "size": { + "type": "long" + }, + "target_path": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "uid": { + "ignore_above": 1024, + "type": "keyword" + }, + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/geo.json b/generated/elasticsearch/component/geo.json new file mode 100644 index 0000000000..55cdb3be35 --- /dev/null +++ b/generated/elasticsearch/component/geo.json @@ -0,0 +1,43 @@ +{ + "template": { + "mappings": { + "properties": { + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/group.json b/generated/elasticsearch/component/group.json new file mode 100644 index 0000000000..7500ad89c0 --- /dev/null +++ b/generated/elasticsearch/component/group.json @@ -0,0 +1,24 @@ +{ + "template": { + "mappings": { + "properties": { + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/hash.json b/generated/elasticsearch/component/hash.json new file mode 100644 index 0000000000..d7776dcf12 --- /dev/null +++ b/generated/elasticsearch/component/hash.json @@ -0,0 +1,28 @@ +{ + "template": { + "mappings": { + "properties": { + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/host.json b/generated/elasticsearch/component/host.json new file mode 100644 index 0000000000..de7d5d6536 --- /dev/null +++ b/generated/elasticsearch/component/host.json @@ -0,0 +1,185 @@ +{ + "template": { + "mappings": { + "properties": { + "host": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hostname": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "uptime": { + "type": "long" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/http.json b/generated/elasticsearch/component/http.json new file mode 100644 index 0000000000..5a52dd9e9c --- /dev/null +++ b/generated/elasticsearch/component/http.json @@ -0,0 +1,83 @@ +{ + "template": { + "mappings": { + "properties": { + "http": { + "properties": { + "request": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "bytes": { + "type": "long" + }, + "method": { + "ignore_above": 1024, + "type": "keyword" + }, + "mime_type": { + "ignore_above": 1024, + "type": "keyword" + }, + "referrer": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "response": { + "properties": { + "body": { + "properties": { + "bytes": { + "type": "long" + }, + "content": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "bytes": { + "type": "long" + }, + "mime_type": { + "ignore_above": 1024, + "type": "keyword" + }, + "status_code": { + "type": "long" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/interface.json b/generated/elasticsearch/component/interface.json new file mode 100644 index 0000000000..67b95e8dc9 --- /dev/null +++ b/generated/elasticsearch/component/interface.json @@ -0,0 +1,24 @@ +{ + "template": { + "mappings": { + "properties": { + "interface": { + "properties": { + "alias": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/log.json b/generated/elasticsearch/component/log.json new file mode 100644 index 0000000000..fe0261dc18 --- /dev/null +++ b/generated/elasticsearch/component/log.json @@ -0,0 +1,83 @@ +{ + "template": { + "mappings": { + "properties": { + "log": { + "properties": { + "file": { + "properties": { + "path": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "level": { + "ignore_above": 1024, + "type": "keyword" + }, + "logger": { + "ignore_above": 1024, + "type": "keyword" + }, + "origin": { + "properties": { + "file": { + "properties": { + "line": { + "type": "integer" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "function": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "original": { + "doc_values": false, + "ignore_above": 1024, + "index": false, + "type": "keyword" + }, + "syslog": { + "properties": { + "facility": { + "properties": { + "code": { + "type": "long" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "priority": { + "type": "long" + }, + "severity": { + "properties": { + "code": { + "type": "long" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + }, + "type": "object" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/network.json b/generated/elasticsearch/component/network.json new file mode 100644 index 0000000000..74a7b796e9 --- /dev/null +++ b/generated/elasticsearch/component/network.json @@ -0,0 +1,82 @@ +{ + "template": { + "mappings": { + "properties": { + "network": { + "properties": { + "application": { + "ignore_above": 1024, + "type": "keyword" + }, + "bytes": { + "type": "long" + }, + "community_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "direction": { + "ignore_above": 1024, + "type": "keyword" + }, + "forwarded_ip": { + "type": "ip" + }, + "iana_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "inner": { + "properties": { + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + }, + "type": "object" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "packets": { + "type": "long" + }, + "protocol": { + "ignore_above": 1024, + "type": "keyword" + }, + "transport": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/observer.json b/generated/elasticsearch/component/observer.json new file mode 100644 index 0000000000..8c5b989556 --- /dev/null +++ b/generated/elasticsearch/component/observer.json @@ -0,0 +1,200 @@ +{ + "template": { + "mappings": { + "properties": { + "observer": { + "properties": { + "egress": { + "properties": { + "interface": { + "properties": { + "alias": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "zone": { + "ignore_above": 1024, + "type": "keyword" + } + }, + "type": "object" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hostname": { + "ignore_above": 1024, + "type": "keyword" + }, + "ingress": { + "properties": { + "interface": { + "properties": { + "alias": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "zone": { + "ignore_above": 1024, + "type": "keyword" + } + }, + "type": "object" + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "vendor": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/organization.json b/generated/elasticsearch/component/organization.json new file mode 100644 index 0000000000..befa6f313c --- /dev/null +++ b/generated/elasticsearch/component/organization.json @@ -0,0 +1,26 @@ +{ + "template": { + "mappings": { + "properties": { + "organization": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/os.json b/generated/elasticsearch/component/os.json new file mode 100644 index 0000000000..4d23c26134 --- /dev/null +++ b/generated/elasticsearch/component/os.json @@ -0,0 +1,52 @@ +{ + "template": { + "mappings": { + "properties": { + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/package.json b/generated/elasticsearch/component/package.json new file mode 100644 index 0000000000..bc7324b6ba --- /dev/null +++ b/generated/elasticsearch/component/package.json @@ -0,0 +1,62 @@ +{ + "template": { + "mappings": { + "properties": { + "package": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "build_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "checksum": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "install_scope": { + "ignore_above": 1024, + "type": "keyword" + }, + "installed": { + "type": "date" + }, + "license": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "size": { + "type": "long" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/pe.json b/generated/elasticsearch/component/pe.json new file mode 100644 index 0000000000..bbdae948d1 --- /dev/null +++ b/generated/elasticsearch/component/pe.json @@ -0,0 +1,40 @@ +{ + "template": { + "mappings": { + "properties": { + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/process.json b/generated/elasticsearch/component/process.json new file mode 100644 index 0000000000..91b4620486 --- /dev/null +++ b/generated/elasticsearch/component/process.json @@ -0,0 +1,342 @@ +{ + "template": { + "mappings": { + "properties": { + "process": { + "properties": { + "args": { + "ignore_above": 1024, + "type": "keyword" + }, + "args_count": { + "type": "long" + }, + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "command_line": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "entity_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "executable": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "exit_code": { + "type": "long" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "parent": { + "properties": { + "args": { + "ignore_above": 1024, + "type": "keyword" + }, + "args_count": { + "type": "long" + }, + "code_signature": { + "properties": { + "exists": { + "type": "boolean" + }, + "status": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "trusted": { + "type": "boolean" + }, + "valid": { + "type": "boolean" + } + } + }, + "command_line": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "entity_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "executable": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "exit_code": { + "type": "long" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha512": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "pgid": { + "type": "long" + }, + "pid": { + "type": "long" + }, + "ppid": { + "type": "long" + }, + "start": { + "type": "date" + }, + "thread": { + "properties": { + "id": { + "type": "long" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "title": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "uptime": { + "type": "long" + }, + "working_directory": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "pe": { + "properties": { + "architecture": { + "ignore_above": 1024, + "type": "keyword" + }, + "company": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "file_version": { + "ignore_above": 1024, + "type": "keyword" + }, + "imphash": { + "ignore_above": 1024, + "type": "keyword" + }, + "original_file_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "product": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "pgid": { + "type": "long" + }, + "pid": { + "type": "long" + }, + "ppid": { + "type": "long" + }, + "start": { + "type": "date" + }, + "thread": { + "properties": { + "id": { + "type": "long" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "title": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "uptime": { + "type": "long" + }, + "working_directory": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/registry.json b/generated/elasticsearch/component/registry.json new file mode 100644 index 0000000000..fd43b911a7 --- /dev/null +++ b/generated/elasticsearch/component/registry.json @@ -0,0 +1,44 @@ +{ + "template": { + "mappings": { + "properties": { + "registry": { + "properties": { + "data": { + "properties": { + "bytes": { + "ignore_above": 1024, + "type": "keyword" + }, + "strings": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hive": { + "ignore_above": 1024, + "type": "keyword" + }, + "key": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "value": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/related.json b/generated/elasticsearch/component/related.json new file mode 100644 index 0000000000..0d5227f3c1 --- /dev/null +++ b/generated/elasticsearch/component/related.json @@ -0,0 +1,27 @@ +{ + "template": { + "mappings": { + "properties": { + "related": { + "properties": { + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "hosts": { + "ignore_above": 1024, + "type": "keyword" + }, + "ip": { + "type": "ip" + }, + "user": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/rule.json b/generated/elasticsearch/component/rule.json new file mode 100644 index 0000000000..43de55f11e --- /dev/null +++ b/generated/elasticsearch/component/rule.json @@ -0,0 +1,52 @@ +{ + "template": { + "mappings": { + "properties": { + "rule": { + "properties": { + "author": { + "ignore_above": 1024, + "type": "keyword" + }, + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "license": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "ruleset": { + "ignore_above": 1024, + "type": "keyword" + }, + "uuid": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/server.json b/generated/elasticsearch/component/server.json new file mode 100644 index 0000000000..9e4c219fda --- /dev/null +++ b/generated/elasticsearch/component/server.json @@ -0,0 +1,174 @@ +{ + "template": { + "mappings": { + "properties": { + "server": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/service.json b/generated/elasticsearch/component/service.json new file mode 100644 index 0000000000..c36de81125 --- /dev/null +++ b/generated/elasticsearch/component/service.json @@ -0,0 +1,44 @@ +{ + "template": { + "mappings": { + "properties": { + "service": { + "properties": { + "ephemeral_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "node": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "state": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/source.json b/generated/elasticsearch/component/source.json new file mode 100644 index 0000000000..9193ba6fd6 --- /dev/null +++ b/generated/elasticsearch/component/source.json @@ -0,0 +1,174 @@ +{ + "template": { + "mappings": { + "properties": { + "source": { + "properties": { + "address": { + "ignore_above": 1024, + "type": "keyword" + }, + "as": { + "properties": { + "number": { + "type": "long" + }, + "organization": { + "properties": { + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "bytes": { + "type": "long" + }, + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "geo": { + "properties": { + "city_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "continent_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "country_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "location": { + "type": "geo_point" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_iso_code": { + "ignore_above": 1024, + "type": "keyword" + }, + "region_name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "ip": { + "type": "ip" + }, + "mac": { + "ignore_above": 1024, + "type": "keyword" + }, + "nat": { + "properties": { + "ip": { + "type": "ip" + }, + "port": { + "type": "long" + } + } + }, + "packets": { + "type": "long" + }, + "port": { + "type": "long" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/threat.json b/generated/elasticsearch/component/threat.json new file mode 100644 index 0000000000..6d7662b039 --- /dev/null +++ b/generated/elasticsearch/component/threat.json @@ -0,0 +1,76 @@ +{ + "template": { + "mappings": { + "properties": { + "threat": { + "properties": { + "framework": { + "ignore_above": 1024, + "type": "keyword" + }, + "tactic": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "technique": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "subtechnique": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/tls.json b/generated/elasticsearch/component/tls.json new file mode 100644 index 0000000000..255ea45e15 --- /dev/null +++ b/generated/elasticsearch/component/tls.json @@ -0,0 +1,350 @@ +{ + "template": { + "mappings": { + "properties": { + "tls": { + "properties": { + "cipher": { + "ignore_above": 1024, + "type": "keyword" + }, + "client": { + "properties": { + "certificate": { + "ignore_above": 1024, + "type": "keyword" + }, + "certificate_chain": { + "ignore_above": 1024, + "type": "keyword" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "issuer": { + "ignore_above": 1024, + "type": "keyword" + }, + "ja3": { + "ignore_above": 1024, + "type": "keyword" + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "server_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "ignore_above": 1024, + "type": "keyword" + }, + "supported_ciphers": { + "ignore_above": 1024, + "type": "keyword" + }, + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "established": { + "type": "boolean" + }, + "next_protocol": { + "ignore_above": 1024, + "type": "keyword" + }, + "resumed": { + "type": "boolean" + }, + "server": { + "properties": { + "certificate": { + "ignore_above": 1024, + "type": "keyword" + }, + "certificate_chain": { + "ignore_above": 1024, + "type": "keyword" + }, + "hash": { + "properties": { + "md5": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha1": { + "ignore_above": 1024, + "type": "keyword" + }, + "sha256": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "issuer": { + "ignore_above": 1024, + "type": "keyword" + }, + "ja3s": { + "ignore_above": 1024, + "type": "keyword" + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "subject": { + "ignore_above": 1024, + "type": "keyword" + }, + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + }, + "version_protocol": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/tracing.json b/generated/elasticsearch/component/tracing.json new file mode 100644 index 0000000000..9d9555d9fa --- /dev/null +++ b/generated/elasticsearch/component/tracing.json @@ -0,0 +1,32 @@ +{ + "template": { + "mappings": { + "properties": { + "span": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "trace": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "transaction": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/url.json b/generated/elasticsearch/component/url.json new file mode 100644 index 0000000000..e4dfeaf5b8 --- /dev/null +++ b/generated/elasticsearch/component/url.json @@ -0,0 +1,79 @@ +{ + "template": { + "mappings": { + "properties": { + "url": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "extension": { + "ignore_above": 1024, + "type": "keyword" + }, + "fragment": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "password": { + "ignore_above": 1024, + "type": "keyword" + }, + "path": { + "ignore_above": 1024, + "type": "keyword" + }, + "port": { + "type": "long" + }, + "query": { + "ignore_above": 1024, + "type": "keyword" + }, + "registered_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "scheme": { + "ignore_above": 1024, + "type": "keyword" + }, + "subdomain": { + "ignore_above": 1024, + "type": "keyword" + }, + "top_level_domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "username": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/user.json b/generated/elasticsearch/component/user.json new file mode 100644 index 0000000000..60d82d6987 --- /dev/null +++ b/generated/elasticsearch/component/user.json @@ -0,0 +1,68 @@ +{ + "template": { + "mappings": { + "properties": { + "user": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/user_agent.json b/generated/elasticsearch/component/user_agent.json new file mode 100644 index 0000000000..2a9f1e830d --- /dev/null +++ b/generated/elasticsearch/component/user_agent.json @@ -0,0 +1,82 @@ +{ + "template": { + "mappings": { + "properties": { + "user_agent": { + "properties": { + "device": { + "properties": { + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + }, + "original": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "os": { + "properties": { + "family": { + "ignore_above": 1024, + "type": "keyword" + }, + "full": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "kernel": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "platform": { + "ignore_above": 1024, + "type": "keyword" + }, + "type": { + "ignore_above": 1024, + "type": "keyword" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/vlan.json b/generated/elasticsearch/component/vlan.json new file mode 100644 index 0000000000..3cddf5221a --- /dev/null +++ b/generated/elasticsearch/component/vlan.json @@ -0,0 +1,20 @@ +{ + "template": { + "mappings": { + "properties": { + "vlan": { + "properties": { + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/vulnerability.json b/generated/elasticsearch/component/vulnerability.json new file mode 100644 index 0000000000..a4e37d4b77 --- /dev/null +++ b/generated/elasticsearch/component/vulnerability.json @@ -0,0 +1,75 @@ +{ + "template": { + "mappings": { + "properties": { + "vulnerability": { + "properties": { + "category": { + "ignore_above": 1024, + "type": "keyword" + }, + "classification": { + "ignore_above": 1024, + "type": "keyword" + }, + "description": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "enumeration": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "reference": { + "ignore_above": 1024, + "type": "keyword" + }, + "report_id": { + "ignore_above": 1024, + "type": "keyword" + }, + "scanner": { + "properties": { + "vendor": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "score": { + "properties": { + "base": { + "type": "float" + }, + "environmental": { + "type": "float" + }, + "temporal": { + "type": "float" + }, + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "severity": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/generated/elasticsearch/component/x509.json b/generated/elasticsearch/component/x509.json new file mode 100644 index 0000000000..874b47ffea --- /dev/null +++ b/generated/elasticsearch/component/x509.json @@ -0,0 +1,114 @@ +{ + "template": { + "mappings": { + "properties": { + "x509": { + "properties": { + "alternative_names": { + "ignore_above": 1024, + "type": "keyword" + }, + "issuer": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "not_after": { + "type": "date" + }, + "not_before": { + "type": "date" + }, + "public_key_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_curve": { + "ignore_above": 1024, + "type": "keyword" + }, + "public_key_exponent": { + "doc_values": false, + "index": false, + "type": "long" + }, + "public_key_size": { + "type": "long" + }, + "serial_number": { + "ignore_above": 1024, + "type": "keyword" + }, + "signature_algorithm": { + "ignore_above": 1024, + "type": "keyword" + }, + "subject": { + "properties": { + "common_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "country": { + "ignore_above": 1024, + "type": "keyword" + }, + "distinguished_name": { + "ignore_above": 1024, + "type": "keyword" + }, + "locality": { + "ignore_above": 1024, + "type": "keyword" + }, + "organization": { + "ignore_above": 1024, + "type": "keyword" + }, + "organizational_unit": { + "ignore_above": 1024, + "type": "keyword" + }, + "state_or_province": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "version_number": { + "ignore_above": 1024, + "type": "keyword" + } + } + } + } + } + } +} \ No newline at end of file diff --git a/scripts/generator.py b/scripts/generator.py index 4e9e4181be..47f94c4a81 100644 --- a/scripts/generator.py +++ b/scripts/generator.py @@ -56,7 +56,8 @@ def main(): exit() csv_generator.generate(flat, ecs_version, out_dir) - es_template.generate(flat, ecs_version, out_dir, args.template_settings, args.mapping_settings) + es_template.generate(nested, ecs_version, out_dir, args.template_settings, args.mapping_settings) + es_template.generate_legacy(flat, ecs_version, out_dir, args.template_settings, args.mapping_settings) beats.generate(nested, ecs_version, out_dir) if args.include or args.subset: exit() diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 724e925646..4bf8ddb47d 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -7,12 +7,43 @@ from generators import ecs_helpers -def generate(ecs_flat, ecs_version, out_dir, template_settings_file, mapping_settings_file): +### Composable Template + +def generate(ecs_nested, ecs_version, out_dir, template_settings_file, mapping_settings_file): + all_component_templates(ecs_nested, ecs_version, out_dir) + +# Main template + +# Component templates + +def all_component_templates(ecs_nested, ecs_version, out_dir): + component_dir = join(out_dir, 'elasticsearch/component') + ecs_helpers.make_dirs(component_dir) + + for (fieldset_name, fieldset) in ecs_nested.items(): + field_mappings = {} + for (flat_name, field) in fieldset['fields'].items(): + name_parts = flat_name.split('.') + dict_add_nested(field_mappings, name_parts, entry_for(field)) + + component_template(fieldset_name, ecs_version, component_dir, field_mappings) + + +def component_template(template_name, ecs_version, out_dir, field_mappings): + filename = join(out_dir, template_name) + ".json" + + template = { 'template': { 'mappings': { 'properties': field_mappings }}} + save_json(filename, template) + +### Legacy template + + +def generate_legacy(ecs_flat, ecs_version, out_dir, template_settings_file, mapping_settings_file): field_mappings = {} for flat_name in sorted(ecs_flat): field = ecs_flat[flat_name] - nestings = flat_name.split('.') - dict_add_nested(field_mappings, nestings, entry_for(field)) + name_parts = flat_name.split('.') + dict_add_nested(field_mappings, name_parts, entry_for(field)) if mapping_settings_file: with open(mapping_settings_file) as f: @@ -25,19 +56,19 @@ def generate(ecs_flat, ecs_version, out_dir, template_settings_file, mapping_set generate_template_version(6, mappings_section, out_dir, template_settings_file) generate_template_version(7, mappings_section, out_dir, template_settings_file) -# Field mappings +### Field mappings -def dict_add_nested(dct, nestings, value): - current_nesting = nestings[0] - rest_nestings = nestings[1:] - if len(rest_nestings) > 0: +def dict_add_nested(dct, name_parts, value): + current_nesting = name_parts[0] + rest_name_parts = name_parts[1:] + if len(rest_name_parts) > 0: dct.setdefault(current_nesting, {}) dct[current_nesting].setdefault('properties', {}) dict_add_nested( dct[current_nesting]['properties'], - rest_nestings, + rest_name_parts, value) else: From 9ca0276bc295ec1a9404c3407cd4ff2d584cea24 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 10:22:37 -0500 Subject: [PATCH 04/27] Reorganize the code specific to each approach... And also fix those unacceptable '###' comments :eyeroll: --- scripts/generators/es_template.py | 53 +++++++++++++++++-------------- 1 file changed, 29 insertions(+), 24 deletions(-) diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 4bf8ddb47d..d327f0a020 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -7,16 +7,19 @@ from generators import ecs_helpers -### Composable Template +# Composable Template def generate(ecs_nested, ecs_version, out_dir, template_settings_file, mapping_settings_file): + """This generates all artifacts for the composable template approach""" all_component_templates(ecs_nested, ecs_version, out_dir) -# Main template -# Component templates +def composable_template(ecs_version, out_dir, template_settings_file, mapping_settings_file): + """Generate the master sample composable template""" + def all_component_templates(ecs_nested, ecs_version, out_dir): + """Generate one component template per field set""" component_dir = join(out_dir, 'elasticsearch/component') ecs_helpers.make_dirs(component_dir) @@ -32,13 +35,14 @@ def all_component_templates(ecs_nested, ecs_version, out_dir): def component_template(template_name, ecs_version, out_dir, field_mappings): filename = join(out_dir, template_name) + ".json" - template = { 'template': { 'mappings': { 'properties': field_mappings }}} + template = {'template': {'mappings': {'properties': field_mappings}}} save_json(filename, template) -### Legacy template +# Legacy template def generate_legacy(ecs_flat, ecs_version, out_dir, template_settings_file, mapping_settings_file): + """Generate the legacy index template""" field_mappings = {} for flat_name in sorted(ecs_flat): field = ecs_flat[flat_name] @@ -53,10 +57,27 @@ def generate_legacy(ecs_flat, ecs_version, out_dir, template_settings_file, mapp mappings_section['properties'] = field_mappings - generate_template_version(6, mappings_section, out_dir, template_settings_file) - generate_template_version(7, mappings_section, out_dir, template_settings_file) + generate_legacy_template_version(6, mappings_section, out_dir, template_settings_file) + generate_legacy_template_version(7, mappings_section, out_dir, template_settings_file) + + +def generate_legacy_template_version(elasticsearch_version, mappings_section, out_dir, template_settings_file): + ecs_helpers.make_dirs(join(out_dir, 'elasticsearch', str(elasticsearch_version))) + if template_settings_file: + with open(template_settings_file) as f: + template = json.load(f) + else: + template = default_template_settings() + if elasticsearch_version == 6: + template['mappings'] = {'_doc': mappings_section} + else: + template['mappings'] = mappings_section + + filename = join(out_dir, "elasticsearch/{}/template.json".format(elasticsearch_version)) + save_json(filename, template) + -### Field mappings +# Common helpers def dict_add_nested(dct, name_parts, value): @@ -117,22 +138,6 @@ def entry_for(field): # Generated files -def generate_template_version(elasticsearch_version, mappings_section, out_dir, template_settings_file): - ecs_helpers.make_dirs(join(out_dir, 'elasticsearch', str(elasticsearch_version))) - if template_settings_file: - with open(template_settings_file) as f: - template = json.load(f) - else: - template = default_template_settings() - if elasticsearch_version == 6: - template['mappings'] = {'_doc': mappings_section} - else: - template['mappings'] = mappings_section - - filename = join(out_dir, "elasticsearch/{}/template.json".format(elasticsearch_version)) - save_json(filename, template) - - def save_json(file, data): open_mode = "wb" if sys.version_info >= (3, 0): From 8210eb71f139d0a2477f39254af35a4b090ecacd Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 10:39:07 -0500 Subject: [PATCH 05/27] Extract mapping_settings and template_settings to reusable functions --- scripts/generators/es_template.py | 52 +++++++++++++++++-------------- 1 file changed, 29 insertions(+), 23 deletions(-) diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index d327f0a020..9c5c37e33e 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -18,6 +18,7 @@ def composable_template(ecs_version, out_dir, template_settings_file, mapping_se """Generate the master sample composable template""" + def all_component_templates(ecs_nested, ecs_version, out_dir): """Generate one component template per field set""" component_dir = join(out_dir, 'elasticsearch/component') @@ -49,31 +50,18 @@ def generate_legacy(ecs_flat, ecs_version, out_dir, template_settings_file, mapp name_parts = flat_name.split('.') dict_add_nested(field_mappings, name_parts, entry_for(field)) - if mapping_settings_file: - with open(mapping_settings_file) as f: - mappings_section = json.load(f) - else: - mappings_section = default_mapping_settings(ecs_version) - + mappings_section = mapping_settings(ecs_version, mapping_settings_file) mappings_section['properties'] = field_mappings generate_legacy_template_version(6, mappings_section, out_dir, template_settings_file) generate_legacy_template_version(7, mappings_section, out_dir, template_settings_file) -def generate_legacy_template_version(elasticsearch_version, mappings_section, out_dir, template_settings_file): - ecs_helpers.make_dirs(join(out_dir, 'elasticsearch', str(elasticsearch_version))) - if template_settings_file: - with open(template_settings_file) as f: - template = json.load(f) - else: - template = default_template_settings() - if elasticsearch_version == 6: - template['mappings'] = {'_doc': mappings_section} - else: - template['mappings'] = mappings_section +def generate_legacy_template_version(es_version, mappings_section, out_dir, template_settings_file): + ecs_helpers.make_dirs(join(out_dir, 'elasticsearch', str(es_version))) + template = template_settings(es_version, mappings_section, template_settings_file) - filename = join(out_dir, "elasticsearch/{}/template.json".format(elasticsearch_version)) + filename = join(out_dir, "elasticsearch/{}/template.json".format(es_version)) save_json(filename, template) @@ -135,7 +123,27 @@ def entry_for(field): raise ex return field_entry -# Generated files + +def mapping_settings(ecs_version, mapping_settings_file): + if mapping_settings_file: + with open(mapping_settings_file) as f: + mappings = json.load(f) + else: + mappings = default_mapping_settings(ecs_version) + return mappings + + +def template_settings(es_version, mappings_section, template_settings_file): + if template_settings_file: + with open(template_settings_file) as f: + template = json.load(f) + else: + template = default_template_settings() + if es_version == 6: + template['mappings'] = {'_doc': mappings_section} + else: + template['mappings'] = mappings_section + return template def save_json(file, data): @@ -159,8 +167,7 @@ def default_template_settings(): }, "refresh_interval": "5s" } - }, - "mappings": {} + } } @@ -178,6 +185,5 @@ def default_mapping_settings(ecs_version): "match_mapping_type": "string" } } - ], - "properties": {} + ] } From 871b9c41327e2413413c189d6ca4f4994b8d0497 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 11:23:29 -0500 Subject: [PATCH 06/27] Move the _meta version to the template level. Why did I put this in the mappings o.O? --- .../generated/elasticsearch/7/template.json | 6 ++--- generated/elasticsearch/6/template.json | 6 ++--- generated/elasticsearch/7/template.json | 6 ++--- scripts/generators/es_template.py | 24 +++++++++---------- 4 files changed, 21 insertions(+), 21 deletions(-) diff --git a/experimental/generated/elasticsearch/7/template.json b/experimental/generated/elasticsearch/7/template.json index 0bfd44d084..acbeab62e8 100644 --- a/experimental/generated/elasticsearch/7/template.json +++ b/experimental/generated/elasticsearch/7/template.json @@ -1,11 +1,11 @@ { + "_meta": { + "version": "2.0.0-dev+exp" + }, "index_patterns": [ "try-ecs-*" ], "mappings": { - "_meta": { - "version": "2.0.0-dev+exp" - }, "date_detection": false, "dynamic_templates": [ { diff --git a/generated/elasticsearch/6/template.json b/generated/elasticsearch/6/template.json index c80ed9eab5..82dda7b788 100644 --- a/generated/elasticsearch/6/template.json +++ b/generated/elasticsearch/6/template.json @@ -1,12 +1,12 @@ { + "_meta": { + "version": "2.0.0-dev" + }, "index_patterns": [ "try-ecs-*" ], "mappings": { "_doc": { - "_meta": { - "version": "2.0.0-dev" - }, "date_detection": false, "dynamic_templates": [ { diff --git a/generated/elasticsearch/7/template.json b/generated/elasticsearch/7/template.json index 2065369a1c..d0deb8d94e 100644 --- a/generated/elasticsearch/7/template.json +++ b/generated/elasticsearch/7/template.json @@ -1,11 +1,11 @@ { + "_meta": { + "version": "2.0.0-dev" + }, "index_patterns": [ "try-ecs-*" ], "mappings": { - "_meta": { - "version": "2.0.0-dev" - }, "date_detection": false, "dynamic_templates": [ { diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 9c5c37e33e..64c994b0f7 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -50,16 +50,16 @@ def generate_legacy(ecs_flat, ecs_version, out_dir, template_settings_file, mapp name_parts = flat_name.split('.') dict_add_nested(field_mappings, name_parts, entry_for(field)) - mappings_section = mapping_settings(ecs_version, mapping_settings_file) + mappings_section = mapping_settings(mapping_settings_file) mappings_section['properties'] = field_mappings - generate_legacy_template_version(6, mappings_section, out_dir, template_settings_file) - generate_legacy_template_version(7, mappings_section, out_dir, template_settings_file) + generate_legacy_template_version(6, ecs_version, mappings_section, out_dir, template_settings_file) + generate_legacy_template_version(7, ecs_version, mappings_section, out_dir, template_settings_file) -def generate_legacy_template_version(es_version, mappings_section, out_dir, template_settings_file): +def generate_legacy_template_version(es_version, ecs_version, mappings_section, out_dir, template_settings_file): ecs_helpers.make_dirs(join(out_dir, 'elasticsearch', str(es_version))) - template = template_settings(es_version, mappings_section, template_settings_file) + template = template_settings(es_version, ecs_version, mappings_section, template_settings_file) filename = join(out_dir, "elasticsearch/{}/template.json".format(es_version)) save_json(filename, template) @@ -124,21 +124,21 @@ def entry_for(field): return field_entry -def mapping_settings(ecs_version, mapping_settings_file): +def mapping_settings(mapping_settings_file): if mapping_settings_file: with open(mapping_settings_file) as f: mappings = json.load(f) else: - mappings = default_mapping_settings(ecs_version) + mappings = default_mapping_settings() return mappings -def template_settings(es_version, mappings_section, template_settings_file): +def template_settings(es_version, ecs_version, mappings_section, template_settings_file): if template_settings_file: with open(template_settings_file) as f: template = json.load(f) else: - template = default_template_settings() + template = default_template_settings(ecs_version) if es_version == 6: template['mappings'] = {'_doc': mappings_section} else: @@ -154,9 +154,10 @@ def save_json(file, data): jsonfile.write(json.dumps(data, indent=2, sort_keys=True)) -def default_template_settings(): +def default_template_settings(ecs_version): return { "index_patterns": ["try-ecs-*"], + "_meta": {"version": ecs_version}, "order": 1, "settings": { "index": { @@ -171,9 +172,8 @@ def default_template_settings(): } -def default_mapping_settings(ecs_version): +def default_mapping_settings(): return { - "_meta": {"version": ecs_version}, "date_detection": False, "dynamic_templates": [ { From 2e2c8a9632dbf6dd6256d3bc02b3c438c3d93ca0 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 11:33:22 -0500 Subject: [PATCH 07/27] Generate sample composable template that doesn't pull in anything yet --- generated/elasticsearch/template.json | 34 +++++++++++++++++++++++++++ scripts/generator.py | 2 +- scripts/generators/es_template.py | 27 ++++++++++++++++++--- 3 files changed, 59 insertions(+), 4 deletions(-) create mode 100644 generated/elasticsearch/template.json diff --git a/generated/elasticsearch/template.json b/generated/elasticsearch/template.json new file mode 100644 index 0000000000..59169ba75f --- /dev/null +++ b/generated/elasticsearch/template.json @@ -0,0 +1,34 @@ +{ + "_meta": { + "description": "Sample composable template that includes all ECS fields", + "ecs_version": "2.0.0-dev" + }, + "composed_of": [], + "index_patterns": [ + "try-ecs-*" + ], + "mappings": { + "date_detection": false, + "dynamic_templates": [ + { + "strings_as_keyword": { + "mapping": { + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } + } + ] + }, + "priority": 1, + "settings": { + "index": { + "mapping": { + "total_fields": { + "limit": 10000 + } + } + } + } +} \ No newline at end of file diff --git a/scripts/generator.py b/scripts/generator.py index 47f94c4a81..b6d55abb8f 100644 --- a/scripts/generator.py +++ b/scripts/generator.py @@ -56,7 +56,7 @@ def main(): exit() csv_generator.generate(flat, ecs_version, out_dir) - es_template.generate(nested, ecs_version, out_dir, args.template_settings, args.mapping_settings) + es_template.generate(nested, ecs_version, out_dir, args.mapping_settings) es_template.generate_legacy(flat, ecs_version, out_dir, args.template_settings, args.mapping_settings) beats.generate(nested, ecs_version, out_dir) if args.include or args.subset: diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 64c994b0f7..9763778dc8 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -9,14 +9,35 @@ # Composable Template -def generate(ecs_nested, ecs_version, out_dir, template_settings_file, mapping_settings_file): +def generate(ecs_nested, ecs_version, out_dir, mapping_settings_file): """This generates all artifacts for the composable template approach""" all_component_templates(ecs_nested, ecs_version, out_dir) + composable_template(ecs_version, out_dir, mapping_settings_file) -def composable_template(ecs_version, out_dir, template_settings_file, mapping_settings_file): +def composable_template(ecs_version, out_dir, mapping_settings_file): """Generate the master sample composable template""" - + template = { + "index_patterns": ["try-ecs-*"], + "composed_of": [], + "priority": 1, # Very low, as this is a sample template + "_meta": { + "ecs_version": ecs_version, + "description": "Sample composable template that includes all ECS fields" + }, + "settings": { + "index": { + "mapping": { + "total_fields": { + "limit": 10000 + } + } + } + }, + "mappings": mapping_settings(mapping_settings_file) + } + filename = join(out_dir, "elasticsearch/template.json") + save_json(filename, template) def all_component_templates(ecs_nested, ecs_version, out_dir): From cd5de713b11714938ffdfb1ea821e8462231fa3a Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 13:06:37 -0500 Subject: [PATCH 08/27] Fill in the component names the sample template is composed of --- generated/elasticsearch/template.json | 46 ++++++++++++++++++++++++++- scripts/generators/es_template.py | 15 +++++++-- 2 files changed, 57 insertions(+), 4 deletions(-) diff --git a/generated/elasticsearch/template.json b/generated/elasticsearch/template.json index 59169ba75f..0c9f97759f 100644 --- a/generated/elasticsearch/template.json +++ b/generated/elasticsearch/template.json @@ -3,7 +3,51 @@ "description": "Sample composable template that includes all ECS fields", "ecs_version": "2.0.0-dev" }, - "composed_of": [], + "composed_of": [ + "ecs_2.0.0-dev_agent", + "ecs_2.0.0-dev_as", + "ecs_2.0.0-dev_base", + "ecs_2.0.0-dev_client", + "ecs_2.0.0-dev_cloud", + "ecs_2.0.0-dev_code_signature", + "ecs_2.0.0-dev_container", + "ecs_2.0.0-dev_destination", + "ecs_2.0.0-dev_dll", + "ecs_2.0.0-dev_dns", + "ecs_2.0.0-dev_ecs", + "ecs_2.0.0-dev_error", + "ecs_2.0.0-dev_event", + "ecs_2.0.0-dev_file", + "ecs_2.0.0-dev_geo", + "ecs_2.0.0-dev_group", + "ecs_2.0.0-dev_hash", + "ecs_2.0.0-dev_host", + "ecs_2.0.0-dev_http", + "ecs_2.0.0-dev_interface", + "ecs_2.0.0-dev_log", + "ecs_2.0.0-dev_network", + "ecs_2.0.0-dev_observer", + "ecs_2.0.0-dev_organization", + "ecs_2.0.0-dev_os", + "ecs_2.0.0-dev_package", + "ecs_2.0.0-dev_pe", + "ecs_2.0.0-dev_process", + "ecs_2.0.0-dev_registry", + "ecs_2.0.0-dev_related", + "ecs_2.0.0-dev_rule", + "ecs_2.0.0-dev_server", + "ecs_2.0.0-dev_service", + "ecs_2.0.0-dev_source", + "ecs_2.0.0-dev_threat", + "ecs_2.0.0-dev_tls", + "ecs_2.0.0-dev_tracing", + "ecs_2.0.0-dev_url", + "ecs_2.0.0-dev_user", + "ecs_2.0.0-dev_user_agent", + "ecs_2.0.0-dev_vlan", + "ecs_2.0.0-dev_vulnerability", + "ecs_2.0.0-dev_x509" + ], "index_patterns": [ "try-ecs-*" ], diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 9763778dc8..17b3d5c5b6 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -12,14 +12,15 @@ def generate(ecs_nested, ecs_version, out_dir, mapping_settings_file): """This generates all artifacts for the composable template approach""" all_component_templates(ecs_nested, ecs_version, out_dir) - composable_template(ecs_version, out_dir, mapping_settings_file) + component_names = component_name_convention(ecs_version, ecs_nested) + composable_template(ecs_version, component_names, out_dir, mapping_settings_file) -def composable_template(ecs_version, out_dir, mapping_settings_file): +def composable_template(ecs_version, component_names, out_dir, mapping_settings_file): """Generate the master sample composable template""" template = { "index_patterns": ["try-ecs-*"], - "composed_of": [], + "composed_of": component_names, "priority": 1, # Very low, as this is a sample template "_meta": { "ecs_version": ecs_version, @@ -60,6 +61,14 @@ def component_template(template_name, ecs_version, out_dir, field_mappings): template = {'template': {'mappings': {'properties': field_mappings}}} save_json(filename, template) + +def component_name_convention(ecs_version, ecs_nested): + names = [] + for (fieldset_name, fieldset) in ecs_nested.items(): + names.append("ecs_{}_{}".format(ecs_version, fieldset_name)) + return names + + # Legacy template From 5f22b96790ca8fe531605f9d265b26dcc99deaa6 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 13:16:41 -0500 Subject: [PATCH 09/27] Adjust the version for experimental artifacts --- .../generated/elasticsearch/template.json | 78 +++++++++++++++++++ scripts/generators/es_template.py | 3 +- 2 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 experimental/generated/elasticsearch/template.json diff --git a/experimental/generated/elasticsearch/template.json b/experimental/generated/elasticsearch/template.json new file mode 100644 index 0000000000..8eae35c44c --- /dev/null +++ b/experimental/generated/elasticsearch/template.json @@ -0,0 +1,78 @@ +{ + "_meta": { + "description": "Sample composable template that includes all ECS fields", + "ecs_version": "2.0.0-dev+exp" + }, + "composed_of": [ + "ecs_2.0.0-dev-exp_agent", + "ecs_2.0.0-dev-exp_as", + "ecs_2.0.0-dev-exp_base", + "ecs_2.0.0-dev-exp_client", + "ecs_2.0.0-dev-exp_cloud", + "ecs_2.0.0-dev-exp_code_signature", + "ecs_2.0.0-dev-exp_container", + "ecs_2.0.0-dev-exp_destination", + "ecs_2.0.0-dev-exp_dll", + "ecs_2.0.0-dev-exp_dns", + "ecs_2.0.0-dev-exp_ecs", + "ecs_2.0.0-dev-exp_error", + "ecs_2.0.0-dev-exp_event", + "ecs_2.0.0-dev-exp_file", + "ecs_2.0.0-dev-exp_geo", + "ecs_2.0.0-dev-exp_group", + "ecs_2.0.0-dev-exp_hash", + "ecs_2.0.0-dev-exp_host", + "ecs_2.0.0-dev-exp_http", + "ecs_2.0.0-dev-exp_interface", + "ecs_2.0.0-dev-exp_log", + "ecs_2.0.0-dev-exp_network", + "ecs_2.0.0-dev-exp_observer", + "ecs_2.0.0-dev-exp_organization", + "ecs_2.0.0-dev-exp_os", + "ecs_2.0.0-dev-exp_package", + "ecs_2.0.0-dev-exp_pe", + "ecs_2.0.0-dev-exp_process", + "ecs_2.0.0-dev-exp_registry", + "ecs_2.0.0-dev-exp_related", + "ecs_2.0.0-dev-exp_rule", + "ecs_2.0.0-dev-exp_server", + "ecs_2.0.0-dev-exp_service", + "ecs_2.0.0-dev-exp_source", + "ecs_2.0.0-dev-exp_threat", + "ecs_2.0.0-dev-exp_tls", + "ecs_2.0.0-dev-exp_tracing", + "ecs_2.0.0-dev-exp_url", + "ecs_2.0.0-dev-exp_user", + "ecs_2.0.0-dev-exp_user_agent", + "ecs_2.0.0-dev-exp_vlan", + "ecs_2.0.0-dev-exp_vulnerability", + "ecs_2.0.0-dev-exp_x509" + ], + "index_patterns": [ + "try-ecs-*" + ], + "mappings": { + "date_detection": false, + "dynamic_templates": [ + { + "strings_as_keyword": { + "mapping": { + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } + } + ] + }, + "priority": 1, + "settings": { + "index": { + "mapping": { + "total_fields": { + "limit": 10000 + } + } + } + } +} \ No newline at end of file diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 17b3d5c5b6..c798e8edef 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -63,9 +63,10 @@ def component_template(template_name, ecs_version, out_dir, field_mappings): def component_name_convention(ecs_version, ecs_nested): + version = ecs_version.replace('+', '-') names = [] for (fieldset_name, fieldset) in ecs_nested.items(): - names.append("ecs_{}_{}".format(ecs_version, fieldset_name)) + names.append("ecs_{}_{}".format(version, fieldset_name)) return names From 996fad9736750acc43044caef1db81176e655dcf Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 13:18:26 -0500 Subject: [PATCH 10/27] code format --- scripts/generators/es_template.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index c798e8edef..27a3ac4528 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -21,7 +21,7 @@ def composable_template(ecs_version, component_names, out_dir, mapping_settings_ template = { "index_patterns": ["try-ecs-*"], "composed_of": component_names, - "priority": 1, # Very low, as this is a sample template + "priority": 1, # Very low, as this is a sample template "_meta": { "ecs_version": ecs_version, "description": "Sample composable template that includes all ECS fields" From e58ad8a6c40ebd09aec75f5e3e411a9ed60b52fc Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 13:41:25 -0500 Subject: [PATCH 11/27] Drop that field limit --- scripts/generators/es_template.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 27a3ac4528..9d6e2defc2 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -30,7 +30,7 @@ def composable_template(ecs_version, component_names, out_dir, mapping_settings_ "index": { "mapping": { "total_fields": { - "limit": 10000 + "limit": 2000 } } } From 44bac6c269077de4e825471f2eff5cd5673f103f Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 15:13:10 -0500 Subject: [PATCH 12/27] Fix nesting of the settings and mappings section in the composable template --- .../generated/elasticsearch/template.json | 40 ++++++++++--------- generated/elasticsearch/template.json | 40 ++++++++++--------- scripts/generators/es_template.py | 18 +++++---- 3 files changed, 52 insertions(+), 46 deletions(-) diff --git a/experimental/generated/elasticsearch/template.json b/experimental/generated/elasticsearch/template.json index 8eae35c44c..ba5614931b 100644 --- a/experimental/generated/elasticsearch/template.json +++ b/experimental/generated/elasticsearch/template.json @@ -51,26 +51,28 @@ "index_patterns": [ "try-ecs-*" ], - "mappings": { - "date_detection": false, - "dynamic_templates": [ - { - "strings_as_keyword": { - "mapping": { - "ignore_above": 1024, - "type": "keyword" - }, - "match_mapping_type": "string" - } - } - ] - }, "priority": 1, - "settings": { - "index": { - "mapping": { - "total_fields": { - "limit": 10000 + "template": { + "mappings": { + "date_detection": false, + "dynamic_templates": [ + { + "strings_as_keyword": { + "mapping": { + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } + } + ] + }, + "settings": { + "index": { + "mapping": { + "total_fields": { + "limit": 2000 + } } } } diff --git a/generated/elasticsearch/template.json b/generated/elasticsearch/template.json index 0c9f97759f..4c51d85b5e 100644 --- a/generated/elasticsearch/template.json +++ b/generated/elasticsearch/template.json @@ -51,26 +51,28 @@ "index_patterns": [ "try-ecs-*" ], - "mappings": { - "date_detection": false, - "dynamic_templates": [ - { - "strings_as_keyword": { - "mapping": { - "ignore_above": 1024, - "type": "keyword" - }, - "match_mapping_type": "string" - } - } - ] - }, "priority": 1, - "settings": { - "index": { - "mapping": { - "total_fields": { - "limit": 10000 + "template": { + "mappings": { + "date_detection": false, + "dynamic_templates": [ + { + "strings_as_keyword": { + "mapping": { + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } + } + ] + }, + "settings": { + "index": { + "mapping": { + "total_fields": { + "limit": 2000 + } } } } diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 9d6e2defc2..4022e666e5 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -26,16 +26,18 @@ def composable_template(ecs_version, component_names, out_dir, mapping_settings_ "ecs_version": ecs_version, "description": "Sample composable template that includes all ECS fields" }, - "settings": { - "index": { - "mapping": { - "total_fields": { - "limit": 2000 + "template": { + "settings": { + "index": { + "mapping": { + "total_fields": { + "limit": 2000 + } } } - } - }, - "mappings": mapping_settings(mapping_settings_file) + }, + "mappings": mapping_settings(mapping_settings_file) + } } filename = join(out_dir, "elasticsearch/template.json") save_json(filename, template) From 64aff3f23e9bad35e5bcc476f269d5ac63ba1de7 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 15:13:46 -0500 Subject: [PATCH 13/27] Bash instructions to load the component templates and optionally the composable template --- generated/elasticsearch/README.md | 87 +++++++++++++++++++++++++++++-- 1 file changed, 83 insertions(+), 4 deletions(-) diff --git a/generated/elasticsearch/README.md b/generated/elasticsearch/README.md index 40579d141c..c74789f138 100644 --- a/generated/elasticsearch/README.md +++ b/generated/elasticsearch/README.md @@ -8,7 +8,7 @@ please check out [USAGE.md](../../USAGE.md). ## Notes on index naming -This sample Elasticsearch template will apply to any index named `try-ecs-*`. +These sample Elasticsearch templates will apply to any index named `try-ecs-*`. This is good for experimentation. Note that an index following ECS can be named however you need. There's no requirement @@ -16,27 +16,106 @@ to have "ecs" in the index name. ## Instructions +Elasticsearch 7.8 introduced +[composable index templates](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-templates.html) +as the new default way to craft index templates. + +The following instructions let you use either approach. + +### Composable index templates + +Beta | These artifacts are newly introduced in the ECS repository. Please try them out and give us feedback if you encounter any issues. + +If you want to play with a specific version of ECS, check out the proper branch first. + +``` +git checkout 1.7 +``` + +First load all component templates in Elasticsearch. The following script creates +one reusable component template per ECS field set (one for "event" fields, one for "base" fields, etc.) + +They will be named according to the following naming convention: `_component_template/ecs_{ecs version}_{field set name}`. + +Authenticate your API calls appropriately by adjusting the username:password in this variable. + +```bash +auth="elastic:elastic" +``` + +```bash +version="$(cat version)" +for file in `ls generated/elasticsearch/component/*.json` +do + fieldset=`echo $file | cut -d/ -f4 | cut -d. -f1` + component_name="ecs_${version}_${fieldset}" + api="_component_template/${component_name}" + + # echo "$file => $api" + curl --user "$auth" -XPUT "localhost:9200/$api" --header "Content-Type: application/json" -d @"$file" +done +``` + +A component template for each ECS field set is now loaded. You could stop here and +craft a composable template with the settings you need, that loads only the ECS +fields your index needs via `composed_of`. You can look at [template.json](template.json) for an example. + +If you'd like to load this sample composable template for experimentation: + +```bash +api="_index_template/try-ecs" +file="generated/elasticsearch/template.json" +curl --user "$auth" -XPUT "localhost:9200/$api" --header "Content-Type: application/json" -d @"$file" +``` + +#### Play from Kibana Dev Tools + +``` +# Look at the ECS component templates 👀 +GET _component_template/ecs_* +# And if you created the sample index template +GET _index_template/try-ecs + +# index a document +PUT try-ecs-test +GET try-ecs-test +POST try-ecs-test/_doc +{ "@timestamp": "2020-10-26T22:38:39.000Z", "message": "Hello ECS World", "host": { "ip": "10.42.42.42"} } + +# enjoy +GET try-ecs-test/_search +{ "query": { "term": { "host.ip": "10.0.0.0/8" } } } +``` + +### Legacy index templates + If you want to play with a specific version of ECS, check out the proper branch first. ``` git checkout 1.6 ``` +Authenticate your API calls appropriately by adjusting the username:password in this variable. + +```bash +auth="elastic:elastic" +``` + Load the template in Elasticsearch from your shell. ```bash # Elasticsearch 7 -curl -XPOST 'localhost:9200/_template/try-ecs' \ +curl --user $"$auth" -XPOST 'localhost:9200/_template/try-ecs' \ --header "Content-Type: application/json" \ -d @'generated/elasticsearch/7/template.json' # or Elasticsearch 6 -curl -XPOST 'localhost:9200/_template/try-ecs' \ +curl --user $"$auth" -XPOST 'localhost:9200/_template/try-ecs' \ --header "Content-Type: application/json" \ -d @'generated/elasticsearch/6/template.json' ``` -Play from Kibana Dev Tools +#### Play from Kibana Dev Tools ``` # Look at the template you just uploaded 👀 From 6d34541d015169c5e5867d19273d8ee96c442bc4 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 15:32:54 -0500 Subject: [PATCH 14/27] How to compose templates --- generated/elasticsearch/README.md | 46 +++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/generated/elasticsearch/README.md b/generated/elasticsearch/README.md index c74789f138..527801faea 100644 --- a/generated/elasticsearch/README.md +++ b/generated/elasticsearch/README.md @@ -87,6 +87,52 @@ GET try-ecs-test/_search { "query": { "term": { "host.ip": "10.0.0.0/8" } } } ``` +#### How to compose templates + +Most event sources should include the ECS basics: + +- base +- ecs +- event +- log + +Most event sources should also include fields that capture "where it's happening", +but depending on whether you use containers or the cloud, you may want to omit some in this list: + +- host (actually don't omit this one) +- container +- cloud + +Depending on whether the index contains events captured by an agent or an observer, include one or both of: + +- agent +- observer + +Most of the other field sets will depend on which kind of documents will be in your index. + +If the documents refer to network-related events, you'll likely want to pick among: + +- client & server +- source & destination +- network +- dns, http, tls + +If users are involved in the events: + +- user +- group + +And so on. + +For a concrete example, an index containing your web server logs, should contain at least: + +- base, ecs, event, log +- host, cloud and/or container as needed +- agent +- source, destination, client, server, network, http, tls +- user +- url, user\_agent + ### Legacy index templates If you want to play with a specific version of ECS, check out the proper branch first. From 49a56c0ca568eba25f37609825b731d7961787e0 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 15:35:39 -0500 Subject: [PATCH 15/27] Adjust the newness warning --- generated/elasticsearch/README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/generated/elasticsearch/README.md b/generated/elasticsearch/README.md index 527801faea..7bb21a43d5 100644 --- a/generated/elasticsearch/README.md +++ b/generated/elasticsearch/README.md @@ -24,7 +24,8 @@ The following instructions let you use either approach. ### Composable index templates -Beta | These artifacts are newly introduced in the ECS repository. Please try them out and give us feedback if you encounter any issues. +**Warning**: The artifacts based on coposable templates are newly introduced in the ECS repository. +Please try them out and give us feedback if you encounter any issues. If you want to play with a specific version of ECS, check out the proper branch first. From 93720787bbb77041e3d3e989fae3463216dbe21e Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 15:41:40 -0500 Subject: [PATCH 16/27] Note: Available for ECS 1.7 or newer only --- generated/elasticsearch/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/generated/elasticsearch/README.md b/generated/elasticsearch/README.md index 7bb21a43d5..d79b783cde 100644 --- a/generated/elasticsearch/README.md +++ b/generated/elasticsearch/README.md @@ -28,6 +28,7 @@ The following instructions let you use either approach. Please try them out and give us feedback if you encounter any issues. If you want to play with a specific version of ECS, check out the proper branch first. +Note that the composable index templates are available in the ECS 1.7 branch or newer. ``` git checkout 1.7 From ec3bf509139040d051f4cd04d4ce1eeedca60342 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 15:56:22 -0500 Subject: [PATCH 17/27] Don't generate component templates for field sets only meant to nest elsewhere --- Makefile | 2 +- .../generated/elasticsearch/component/as.json | 28 ----- .../component/code_signature.json | 29 ----- .../elasticsearch/component/geo.json | 42 ------- .../elasticsearch/component/hash.json | 28 ----- .../elasticsearch/component/interface.json | 24 ---- .../generated/elasticsearch/component/os.json | 50 -------- .../generated/elasticsearch/component/pe.json | 39 ------ .../elasticsearch/component/vlan.json | 20 --- .../elasticsearch/component/x509.json | 112 ----------------- .../generated/elasticsearch/template.json | 11 +- generated/elasticsearch/component/as.json | 29 ----- .../component/code_signature.json | 29 ----- generated/elasticsearch/component/geo.json | 43 ------- generated/elasticsearch/component/hash.json | 28 ----- .../elasticsearch/component/interface.json | 24 ---- generated/elasticsearch/component/os.json | 52 -------- generated/elasticsearch/component/pe.json | 40 ------ generated/elasticsearch/component/vlan.json | 20 --- generated/elasticsearch/component/x509.json | 114 ------------------ generated/elasticsearch/template.json | 11 +- scripts/generators/es_template.py | 23 +++- 22 files changed, 20 insertions(+), 778 deletions(-) delete mode 100644 experimental/generated/elasticsearch/component/as.json delete mode 100644 experimental/generated/elasticsearch/component/code_signature.json delete mode 100644 experimental/generated/elasticsearch/component/geo.json delete mode 100644 experimental/generated/elasticsearch/component/hash.json delete mode 100644 experimental/generated/elasticsearch/component/interface.json delete mode 100644 experimental/generated/elasticsearch/component/os.json delete mode 100644 experimental/generated/elasticsearch/component/pe.json delete mode 100644 experimental/generated/elasticsearch/component/vlan.json delete mode 100644 experimental/generated/elasticsearch/component/x509.json delete mode 100644 generated/elasticsearch/component/as.json delete mode 100644 generated/elasticsearch/component/code_signature.json delete mode 100644 generated/elasticsearch/component/geo.json delete mode 100644 generated/elasticsearch/component/hash.json delete mode 100644 generated/elasticsearch/component/interface.json delete mode 100644 generated/elasticsearch/component/os.json delete mode 100644 generated/elasticsearch/component/pe.json delete mode 100644 generated/elasticsearch/component/vlan.json delete mode 100644 generated/elasticsearch/component/x509.json diff --git a/Makefile b/Makefile index 67ee219d8a..327f64b49f 100644 --- a/Makefile +++ b/Makefile @@ -34,7 +34,7 @@ check-license-headers: # Clean deletes all temporary and generated content. .PHONY: clean clean: - rm -rf build + rm -rf build generated/elasticsearch/component experimental/generated/elasticsearch/component # Clean all markdown files for use-cases find ./use-cases -type f -name '*.md' -not -name 'README.md' -print0 | xargs -0 rm -- diff --git a/experimental/generated/elasticsearch/component/as.json b/experimental/generated/elasticsearch/component/as.json deleted file mode 100644 index 85b465e03e..0000000000 --- a/experimental/generated/elasticsearch/component/as.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "as": { - "properties": { - "number": { - "type": "long" - }, - "organization": { - "properties": { - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "type": "wildcard" - } - } - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/code_signature.json b/experimental/generated/elasticsearch/component/code_signature.json deleted file mode 100644 index 66c183f3f7..0000000000 --- a/experimental/generated/elasticsearch/component/code_signature.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "code_signature": { - "properties": { - "exists": { - "type": "boolean" - }, - "status": { - "ignore_above": 1024, - "type": "keyword" - }, - "subject_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "trusted": { - "type": "boolean" - }, - "valid": { - "type": "boolean" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/geo.json b/experimental/generated/elasticsearch/component/geo.json deleted file mode 100644 index 81dc5defcb..0000000000 --- a/experimental/generated/elasticsearch/component/geo.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "type": "wildcard" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/hash.json b/experimental/generated/elasticsearch/component/hash.json deleted file mode 100644 index d7776dcf12..0000000000 --- a/experimental/generated/elasticsearch/component/hash.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "hash": { - "properties": { - "md5": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha1": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha256": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha512": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/interface.json b/experimental/generated/elasticsearch/component/interface.json deleted file mode 100644 index 67b95e8dc9..0000000000 --- a/experimental/generated/elasticsearch/component/interface.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "interface": { - "properties": { - "alias": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/os.json b/experimental/generated/elasticsearch/component/os.json deleted file mode 100644 index db3eca753d..0000000000 --- a/experimental/generated/elasticsearch/component/os.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "os": { - "properties": { - "family": { - "ignore_above": 1024, - "type": "keyword" - }, - "full": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "type": "wildcard" - }, - "kernel": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "type": "wildcard" - }, - "platform": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/pe.json b/experimental/generated/elasticsearch/component/pe.json deleted file mode 100644 index b5ca655c97..0000000000 --- a/experimental/generated/elasticsearch/component/pe.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "pe": { - "properties": { - "architecture": { - "ignore_above": 1024, - "type": "keyword" - }, - "company": { - "ignore_above": 1024, - "type": "keyword" - }, - "description": { - "ignore_above": 1024, - "type": "keyword" - }, - "file_version": { - "ignore_above": 1024, - "type": "keyword" - }, - "imphash": { - "ignore_above": 1024, - "type": "keyword" - }, - "original_file_name": { - "type": "wildcard" - }, - "product": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/vlan.json b/experimental/generated/elasticsearch/component/vlan.json deleted file mode 100644 index 3cddf5221a..0000000000 --- a/experimental/generated/elasticsearch/component/vlan.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "vlan": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/component/x509.json b/experimental/generated/elasticsearch/component/x509.json deleted file mode 100644 index d6ea1c8df7..0000000000 --- a/experimental/generated/elasticsearch/component/x509.json +++ /dev/null @@ -1,112 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "x509": { - "properties": { - "alternative_names": { - "ignore_above": 1024, - "type": "keyword" - }, - "issuer": { - "properties": { - "common_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country": { - "ignore_above": 1024, - "type": "keyword" - }, - "distinguished_name": { - "type": "wildcard" - }, - "locality": { - "ignore_above": 1024, - "type": "keyword" - }, - "organization": { - "ignore_above": 1024, - "type": "keyword" - }, - "organizational_unit": { - "ignore_above": 1024, - "type": "keyword" - }, - "state_or_province": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "not_after": { - "type": "date" - }, - "not_before": { - "type": "date" - }, - "public_key_algorithm": { - "ignore_above": 1024, - "type": "keyword" - }, - "public_key_curve": { - "ignore_above": 1024, - "type": "keyword" - }, - "public_key_exponent": { - "doc_values": false, - "index": false, - "type": "long" - }, - "public_key_size": { - "type": "long" - }, - "serial_number": { - "ignore_above": 1024, - "type": "keyword" - }, - "signature_algorithm": { - "ignore_above": 1024, - "type": "keyword" - }, - "subject": { - "properties": { - "common_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country": { - "ignore_above": 1024, - "type": "keyword" - }, - "distinguished_name": { - "type": "wildcard" - }, - "locality": { - "ignore_above": 1024, - "type": "keyword" - }, - "organization": { - "ignore_above": 1024, - "type": "keyword" - }, - "organizational_unit": { - "ignore_above": 1024, - "type": "keyword" - }, - "state_or_province": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "version_number": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/experimental/generated/elasticsearch/template.json b/experimental/generated/elasticsearch/template.json index ba5614931b..41ebc2ac37 100644 --- a/experimental/generated/elasticsearch/template.json +++ b/experimental/generated/elasticsearch/template.json @@ -5,11 +5,9 @@ }, "composed_of": [ "ecs_2.0.0-dev-exp_agent", - "ecs_2.0.0-dev-exp_as", "ecs_2.0.0-dev-exp_base", "ecs_2.0.0-dev-exp_client", "ecs_2.0.0-dev-exp_cloud", - "ecs_2.0.0-dev-exp_code_signature", "ecs_2.0.0-dev-exp_container", "ecs_2.0.0-dev-exp_destination", "ecs_2.0.0-dev-exp_dll", @@ -18,19 +16,14 @@ "ecs_2.0.0-dev-exp_error", "ecs_2.0.0-dev-exp_event", "ecs_2.0.0-dev-exp_file", - "ecs_2.0.0-dev-exp_geo", "ecs_2.0.0-dev-exp_group", - "ecs_2.0.0-dev-exp_hash", "ecs_2.0.0-dev-exp_host", "ecs_2.0.0-dev-exp_http", - "ecs_2.0.0-dev-exp_interface", "ecs_2.0.0-dev-exp_log", "ecs_2.0.0-dev-exp_network", "ecs_2.0.0-dev-exp_observer", "ecs_2.0.0-dev-exp_organization", - "ecs_2.0.0-dev-exp_os", "ecs_2.0.0-dev-exp_package", - "ecs_2.0.0-dev-exp_pe", "ecs_2.0.0-dev-exp_process", "ecs_2.0.0-dev-exp_registry", "ecs_2.0.0-dev-exp_related", @@ -44,9 +37,7 @@ "ecs_2.0.0-dev-exp_url", "ecs_2.0.0-dev-exp_user", "ecs_2.0.0-dev-exp_user_agent", - "ecs_2.0.0-dev-exp_vlan", - "ecs_2.0.0-dev-exp_vulnerability", - "ecs_2.0.0-dev-exp_x509" + "ecs_2.0.0-dev-exp_vulnerability" ], "index_patterns": [ "try-ecs-*" diff --git a/generated/elasticsearch/component/as.json b/generated/elasticsearch/component/as.json deleted file mode 100644 index 1f8f48b729..0000000000 --- a/generated/elasticsearch/component/as.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "as": { - "properties": { - "number": { - "type": "long" - }, - "organization": { - "properties": { - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/code_signature.json b/generated/elasticsearch/component/code_signature.json deleted file mode 100644 index 66c183f3f7..0000000000 --- a/generated/elasticsearch/component/code_signature.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "code_signature": { - "properties": { - "exists": { - "type": "boolean" - }, - "status": { - "ignore_above": 1024, - "type": "keyword" - }, - "subject_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "trusted": { - "type": "boolean" - }, - "valid": { - "type": "boolean" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/geo.json b/generated/elasticsearch/component/geo.json deleted file mode 100644 index 55cdb3be35..0000000000 --- a/generated/elasticsearch/component/geo.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "geo": { - "properties": { - "city_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "continent_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "country_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "location": { - "type": "geo_point" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_iso_code": { - "ignore_above": 1024, - "type": "keyword" - }, - "region_name": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/hash.json b/generated/elasticsearch/component/hash.json deleted file mode 100644 index d7776dcf12..0000000000 --- a/generated/elasticsearch/component/hash.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "hash": { - "properties": { - "md5": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha1": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha256": { - "ignore_above": 1024, - "type": "keyword" - }, - "sha512": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/interface.json b/generated/elasticsearch/component/interface.json deleted file mode 100644 index 67b95e8dc9..0000000000 --- a/generated/elasticsearch/component/interface.json +++ /dev/null @@ -1,24 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "interface": { - "properties": { - "alias": { - "ignore_above": 1024, - "type": "keyword" - }, - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/os.json b/generated/elasticsearch/component/os.json deleted file mode 100644 index 4d23c26134..0000000000 --- a/generated/elasticsearch/component/os.json +++ /dev/null @@ -1,52 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "os": { - "properties": { - "family": { - "ignore_above": 1024, - "type": "keyword" - }, - "full": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "kernel": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "fields": { - "text": { - "norms": false, - "type": "text" - } - }, - "ignore_above": 1024, - "type": "keyword" - }, - "platform": { - "ignore_above": 1024, - "type": "keyword" - }, - "type": { - "ignore_above": 1024, - "type": "keyword" - }, - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/pe.json b/generated/elasticsearch/component/pe.json deleted file mode 100644 index bbdae948d1..0000000000 --- a/generated/elasticsearch/component/pe.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "pe": { - "properties": { - "architecture": { - "ignore_above": 1024, - "type": "keyword" - }, - "company": { - "ignore_above": 1024, - "type": "keyword" - }, - "description": { - "ignore_above": 1024, - "type": "keyword" - }, - "file_version": { - "ignore_above": 1024, - "type": "keyword" - }, - "imphash": { - "ignore_above": 1024, - "type": "keyword" - }, - "original_file_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "product": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/vlan.json b/generated/elasticsearch/component/vlan.json deleted file mode 100644 index 3cddf5221a..0000000000 --- a/generated/elasticsearch/component/vlan.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "vlan": { - "properties": { - "id": { - "ignore_above": 1024, - "type": "keyword" - }, - "name": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/component/x509.json b/generated/elasticsearch/component/x509.json deleted file mode 100644 index 874b47ffea..0000000000 --- a/generated/elasticsearch/component/x509.json +++ /dev/null @@ -1,114 +0,0 @@ -{ - "template": { - "mappings": { - "properties": { - "x509": { - "properties": { - "alternative_names": { - "ignore_above": 1024, - "type": "keyword" - }, - "issuer": { - "properties": { - "common_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country": { - "ignore_above": 1024, - "type": "keyword" - }, - "distinguished_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "locality": { - "ignore_above": 1024, - "type": "keyword" - }, - "organization": { - "ignore_above": 1024, - "type": "keyword" - }, - "organizational_unit": { - "ignore_above": 1024, - "type": "keyword" - }, - "state_or_province": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "not_after": { - "type": "date" - }, - "not_before": { - "type": "date" - }, - "public_key_algorithm": { - "ignore_above": 1024, - "type": "keyword" - }, - "public_key_curve": { - "ignore_above": 1024, - "type": "keyword" - }, - "public_key_exponent": { - "doc_values": false, - "index": false, - "type": "long" - }, - "public_key_size": { - "type": "long" - }, - "serial_number": { - "ignore_above": 1024, - "type": "keyword" - }, - "signature_algorithm": { - "ignore_above": 1024, - "type": "keyword" - }, - "subject": { - "properties": { - "common_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "country": { - "ignore_above": 1024, - "type": "keyword" - }, - "distinguished_name": { - "ignore_above": 1024, - "type": "keyword" - }, - "locality": { - "ignore_above": 1024, - "type": "keyword" - }, - "organization": { - "ignore_above": 1024, - "type": "keyword" - }, - "organizational_unit": { - "ignore_above": 1024, - "type": "keyword" - }, - "state_or_province": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "version_number": { - "ignore_above": 1024, - "type": "keyword" - } - } - } - } - } - } -} \ No newline at end of file diff --git a/generated/elasticsearch/template.json b/generated/elasticsearch/template.json index 4c51d85b5e..f8e8a919f2 100644 --- a/generated/elasticsearch/template.json +++ b/generated/elasticsearch/template.json @@ -5,11 +5,9 @@ }, "composed_of": [ "ecs_2.0.0-dev_agent", - "ecs_2.0.0-dev_as", "ecs_2.0.0-dev_base", "ecs_2.0.0-dev_client", "ecs_2.0.0-dev_cloud", - "ecs_2.0.0-dev_code_signature", "ecs_2.0.0-dev_container", "ecs_2.0.0-dev_destination", "ecs_2.0.0-dev_dll", @@ -18,19 +16,14 @@ "ecs_2.0.0-dev_error", "ecs_2.0.0-dev_event", "ecs_2.0.0-dev_file", - "ecs_2.0.0-dev_geo", "ecs_2.0.0-dev_group", - "ecs_2.0.0-dev_hash", "ecs_2.0.0-dev_host", "ecs_2.0.0-dev_http", - "ecs_2.0.0-dev_interface", "ecs_2.0.0-dev_log", "ecs_2.0.0-dev_network", "ecs_2.0.0-dev_observer", "ecs_2.0.0-dev_organization", - "ecs_2.0.0-dev_os", "ecs_2.0.0-dev_package", - "ecs_2.0.0-dev_pe", "ecs_2.0.0-dev_process", "ecs_2.0.0-dev_registry", "ecs_2.0.0-dev_related", @@ -44,9 +37,7 @@ "ecs_2.0.0-dev_url", "ecs_2.0.0-dev_user", "ecs_2.0.0-dev_user_agent", - "ecs_2.0.0-dev_vlan", - "ecs_2.0.0-dev_vulnerability", - "ecs_2.0.0-dev_x509" + "ecs_2.0.0-dev_vulnerability" ], "index_patterns": [ "try-ecs-*" diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index 4022e666e5..e3e218acc9 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -13,10 +13,10 @@ def generate(ecs_nested, ecs_version, out_dir, mapping_settings_file): """This generates all artifacts for the composable template approach""" all_component_templates(ecs_nested, ecs_version, out_dir) component_names = component_name_convention(ecs_version, ecs_nested) - composable_template(ecs_version, component_names, out_dir, mapping_settings_file) + save_composable_template(ecs_version, component_names, out_dir, mapping_settings_file) -def composable_template(ecs_version, component_names, out_dir, mapping_settings_file): +def save_composable_template(ecs_version, component_names, out_dir, mapping_settings_file): """Generate the master sample composable template""" template = { "index_patterns": ["try-ecs-*"], @@ -48,16 +48,16 @@ def all_component_templates(ecs_nested, ecs_version, out_dir): component_dir = join(out_dir, 'elasticsearch/component') ecs_helpers.make_dirs(component_dir) - for (fieldset_name, fieldset) in ecs_nested.items(): + for (fieldset_name, fieldset) in candidate_components(ecs_nested).items(): field_mappings = {} for (flat_name, field) in fieldset['fields'].items(): name_parts = flat_name.split('.') dict_add_nested(field_mappings, name_parts, entry_for(field)) - component_template(fieldset_name, ecs_version, component_dir, field_mappings) + save_component_template(fieldset_name, ecs_version, component_dir, field_mappings) -def component_template(template_name, ecs_version, out_dir, field_mappings): +def save_component_template(template_name, ecs_version, out_dir, field_mappings): filename = join(out_dir, template_name) + ".json" template = {'template': {'mappings': {'properties': field_mappings}}} @@ -67,11 +67,22 @@ def component_template(template_name, ecs_version, out_dir, field_mappings): def component_name_convention(ecs_version, ecs_nested): version = ecs_version.replace('+', '-') names = [] - for (fieldset_name, fieldset) in ecs_nested.items(): + for (fieldset_name, fieldset) in candidate_components(ecs_nested).items(): names.append("ecs_{}_{}".format(version, fieldset_name)) return names +def candidate_components(ecs_nested): + """Returns same structure as ecs_nested, but skips all field sets with reusable.top_level: False""" + components = {} + for (fieldset_name, fieldset) in ecs_nested.items(): + if fieldset.get('reusable', None): + if not fieldset['reusable']['top_level']: + continue + components[fieldset_name] = fieldset + return components + + # Legacy template From 0e1d75de15b14fc9f44927b1a3ef49627c5539d5 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 16:17:01 -0500 Subject: [PATCH 18/27] Add reference URL to the component templates. This one's for @a03nikki --- .../generated/elasticsearch/component/agent.json | 4 ++++ experimental/generated/elasticsearch/component/base.json | 4 ++++ .../generated/elasticsearch/component/client.json | 4 ++++ .../generated/elasticsearch/component/cloud.json | 4 ++++ .../generated/elasticsearch/component/container.json | 4 ++++ .../generated/elasticsearch/component/destination.json | 4 ++++ experimental/generated/elasticsearch/component/dll.json | 4 ++++ experimental/generated/elasticsearch/component/dns.json | 4 ++++ experimental/generated/elasticsearch/component/ecs.json | 4 ++++ .../generated/elasticsearch/component/error.json | 4 ++++ .../generated/elasticsearch/component/event.json | 4 ++++ experimental/generated/elasticsearch/component/file.json | 4 ++++ .../generated/elasticsearch/component/group.json | 4 ++++ experimental/generated/elasticsearch/component/host.json | 4 ++++ experimental/generated/elasticsearch/component/http.json | 4 ++++ experimental/generated/elasticsearch/component/log.json | 4 ++++ .../generated/elasticsearch/component/network.json | 4 ++++ .../generated/elasticsearch/component/observer.json | 4 ++++ .../generated/elasticsearch/component/organization.json | 4 ++++ .../generated/elasticsearch/component/package.json | 4 ++++ .../generated/elasticsearch/component/process.json | 4 ++++ .../generated/elasticsearch/component/registry.json | 4 ++++ .../generated/elasticsearch/component/related.json | 4 ++++ experimental/generated/elasticsearch/component/rule.json | 4 ++++ .../generated/elasticsearch/component/server.json | 4 ++++ .../generated/elasticsearch/component/service.json | 4 ++++ .../generated/elasticsearch/component/source.json | 4 ++++ .../generated/elasticsearch/component/threat.json | 4 ++++ experimental/generated/elasticsearch/component/tls.json | 4 ++++ .../generated/elasticsearch/component/tracing.json | 4 ++++ experimental/generated/elasticsearch/component/url.json | 4 ++++ experimental/generated/elasticsearch/component/user.json | 4 ++++ .../generated/elasticsearch/component/user_agent.json | 4 ++++ .../generated/elasticsearch/component/vulnerability.json | 4 ++++ generated/elasticsearch/component/agent.json | 4 ++++ generated/elasticsearch/component/base.json | 4 ++++ generated/elasticsearch/component/client.json | 4 ++++ generated/elasticsearch/component/cloud.json | 4 ++++ generated/elasticsearch/component/container.json | 4 ++++ generated/elasticsearch/component/destination.json | 4 ++++ generated/elasticsearch/component/dll.json | 4 ++++ generated/elasticsearch/component/dns.json | 4 ++++ generated/elasticsearch/component/ecs.json | 4 ++++ generated/elasticsearch/component/error.json | 4 ++++ generated/elasticsearch/component/event.json | 4 ++++ generated/elasticsearch/component/file.json | 4 ++++ generated/elasticsearch/component/group.json | 4 ++++ generated/elasticsearch/component/host.json | 4 ++++ generated/elasticsearch/component/http.json | 4 ++++ generated/elasticsearch/component/log.json | 4 ++++ generated/elasticsearch/component/network.json | 4 ++++ generated/elasticsearch/component/observer.json | 4 ++++ generated/elasticsearch/component/organization.json | 4 ++++ generated/elasticsearch/component/package.json | 4 ++++ generated/elasticsearch/component/process.json | 4 ++++ generated/elasticsearch/component/registry.json | 4 ++++ generated/elasticsearch/component/related.json | 4 ++++ generated/elasticsearch/component/rule.json | 4 ++++ generated/elasticsearch/component/server.json | 4 ++++ generated/elasticsearch/component/service.json | 4 ++++ generated/elasticsearch/component/source.json | 4 ++++ generated/elasticsearch/component/threat.json | 4 ++++ generated/elasticsearch/component/tls.json | 4 ++++ generated/elasticsearch/component/tracing.json | 4 ++++ generated/elasticsearch/component/url.json | 4 ++++ generated/elasticsearch/component/user.json | 4 ++++ generated/elasticsearch/component/user_agent.json | 4 ++++ generated/elasticsearch/component/vulnerability.json | 4 ++++ scripts/generators/es_template.py | 9 ++++++++- 69 files changed, 280 insertions(+), 1 deletion(-) diff --git a/experimental/generated/elasticsearch/component/agent.json b/experimental/generated/elasticsearch/component/agent.json index 66fe0572a2..6a3e69283f 100644 --- a/experimental/generated/elasticsearch/component/agent.json +++ b/experimental/generated/elasticsearch/component/agent.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-agent.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/base.json b/experimental/generated/elasticsearch/component/base.json index d1818f4faa..13714edaf2 100644 --- a/experimental/generated/elasticsearch/component/base.json +++ b/experimental/generated/elasticsearch/component/base.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/client.json b/experimental/generated/elasticsearch/component/client.json index 5e628839f5..e3d5e454ac 100644 --- a/experimental/generated/elasticsearch/component/client.json +++ b/experimental/generated/elasticsearch/component/client.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-client.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/cloud.json b/experimental/generated/elasticsearch/component/cloud.json index feb7e24db8..85554bc397 100644 --- a/experimental/generated/elasticsearch/component/cloud.json +++ b/experimental/generated/elasticsearch/component/cloud.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-cloud.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/container.json b/experimental/generated/elasticsearch/component/container.json index c9db580555..a2acf36a8c 100644 --- a/experimental/generated/elasticsearch/component/container.json +++ b/experimental/generated/elasticsearch/component/container.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-container.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/destination.json b/experimental/generated/elasticsearch/component/destination.json index d6b0c73c14..ce1277f976 100644 --- a/experimental/generated/elasticsearch/component/destination.json +++ b/experimental/generated/elasticsearch/component/destination.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-destination.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/dll.json b/experimental/generated/elasticsearch/component/dll.json index c42dd2ae07..22dfccff97 100644 --- a/experimental/generated/elasticsearch/component/dll.json +++ b/experimental/generated/elasticsearch/component/dll.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-dll.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/dns.json b/experimental/generated/elasticsearch/component/dns.json index c40e9ff2ab..60e9350d22 100644 --- a/experimental/generated/elasticsearch/component/dns.json +++ b/experimental/generated/elasticsearch/component/dns.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-dns.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/ecs.json b/experimental/generated/elasticsearch/component/ecs.json index df4b5d56e4..0fe13f6d9b 100644 --- a/experimental/generated/elasticsearch/component/ecs.json +++ b/experimental/generated/elasticsearch/component/ecs.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-ecs.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/error.json b/experimental/generated/elasticsearch/component/error.json index 6726920778..b75a45a70b 100644 --- a/experimental/generated/elasticsearch/component/error.json +++ b/experimental/generated/elasticsearch/component/error.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/event.json b/experimental/generated/elasticsearch/component/event.json index a8a6eb1f55..e7ed82555d 100644 --- a/experimental/generated/elasticsearch/component/event.json +++ b/experimental/generated/elasticsearch/component/event.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/file.json b/experimental/generated/elasticsearch/component/file.json index 67890178e2..a51b7b2a82 100644 --- a/experimental/generated/elasticsearch/component/file.json +++ b/experimental/generated/elasticsearch/component/file.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-file.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/group.json b/experimental/generated/elasticsearch/component/group.json index 7500ad89c0..4d5b215456 100644 --- a/experimental/generated/elasticsearch/component/group.json +++ b/experimental/generated/elasticsearch/component/group.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-group.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/host.json b/experimental/generated/elasticsearch/component/host.json index c77aaf43e2..bcead9fd7a 100644 --- a/experimental/generated/elasticsearch/component/host.json +++ b/experimental/generated/elasticsearch/component/host.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-host.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/http.json b/experimental/generated/elasticsearch/component/http.json index 78885efcea..15b72d0d8a 100644 --- a/experimental/generated/elasticsearch/component/http.json +++ b/experimental/generated/elasticsearch/component/http.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-http.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/log.json b/experimental/generated/elasticsearch/component/log.json index 05477692cd..7b191fdd80 100644 --- a/experimental/generated/elasticsearch/component/log.json +++ b/experimental/generated/elasticsearch/component/log.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/network.json b/experimental/generated/elasticsearch/component/network.json index 74a7b796e9..d93ecbdbc2 100644 --- a/experimental/generated/elasticsearch/component/network.json +++ b/experimental/generated/elasticsearch/component/network.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-network.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/observer.json b/experimental/generated/elasticsearch/component/observer.json index 3e58dabf8a..8019c93dd8 100644 --- a/experimental/generated/elasticsearch/component/observer.json +++ b/experimental/generated/elasticsearch/component/observer.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-observer.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/organization.json b/experimental/generated/elasticsearch/component/organization.json index 32cf3ab4f5..f8159fb08a 100644 --- a/experimental/generated/elasticsearch/component/organization.json +++ b/experimental/generated/elasticsearch/component/organization.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-organization.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/package.json b/experimental/generated/elasticsearch/component/package.json index bc7324b6ba..4346eed621 100644 --- a/experimental/generated/elasticsearch/component/package.json +++ b/experimental/generated/elasticsearch/component/package.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-package.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/process.json b/experimental/generated/elasticsearch/component/process.json index d87851392b..747affbff6 100644 --- a/experimental/generated/elasticsearch/component/process.json +++ b/experimental/generated/elasticsearch/component/process.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-process.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/registry.json b/experimental/generated/elasticsearch/component/registry.json index 315490a950..bc2fbef93c 100644 --- a/experimental/generated/elasticsearch/component/registry.json +++ b/experimental/generated/elasticsearch/component/registry.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-registry.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/related.json b/experimental/generated/elasticsearch/component/related.json index 0d5227f3c1..53efeb86ae 100644 --- a/experimental/generated/elasticsearch/component/related.json +++ b/experimental/generated/elasticsearch/component/related.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-related.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/rule.json b/experimental/generated/elasticsearch/component/rule.json index 43de55f11e..7994dd391e 100644 --- a/experimental/generated/elasticsearch/component/rule.json +++ b/experimental/generated/elasticsearch/component/rule.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-rule.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/server.json b/experimental/generated/elasticsearch/component/server.json index fcdbaaa7ad..ad7f2be732 100644 --- a/experimental/generated/elasticsearch/component/server.json +++ b/experimental/generated/elasticsearch/component/server.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-server.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/service.json b/experimental/generated/elasticsearch/component/service.json index c36de81125..210633e03d 100644 --- a/experimental/generated/elasticsearch/component/service.json +++ b/experimental/generated/elasticsearch/component/service.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-service.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/source.json b/experimental/generated/elasticsearch/component/source.json index 9fb01d3652..f0215a838d 100644 --- a/experimental/generated/elasticsearch/component/source.json +++ b/experimental/generated/elasticsearch/component/source.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-source.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/threat.json b/experimental/generated/elasticsearch/component/threat.json index 6d7662b039..9d7cd6d7fe 100644 --- a/experimental/generated/elasticsearch/component/threat.json +++ b/experimental/generated/elasticsearch/component/threat.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-threat.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/tls.json b/experimental/generated/elasticsearch/component/tls.json index b4d7d730d1..af20141c8c 100644 --- a/experimental/generated/elasticsearch/component/tls.json +++ b/experimental/generated/elasticsearch/component/tls.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-tls.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/tracing.json b/experimental/generated/elasticsearch/component/tracing.json index 9d9555d9fa..66f39688d1 100644 --- a/experimental/generated/elasticsearch/component/tracing.json +++ b/experimental/generated/elasticsearch/component/tracing.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/url.json b/experimental/generated/elasticsearch/component/url.json index 567c86f3e8..a2005b45d9 100644 --- a/experimental/generated/elasticsearch/component/url.json +++ b/experimental/generated/elasticsearch/component/url.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-url.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/user.json b/experimental/generated/elasticsearch/component/user.json index ff5bbdac72..55eeb53d1f 100644 --- a/experimental/generated/elasticsearch/component/user.json +++ b/experimental/generated/elasticsearch/component/user.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-user.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/user_agent.json b/experimental/generated/elasticsearch/component/user_agent.json index 85613440be..a3c27f923c 100644 --- a/experimental/generated/elasticsearch/component/user_agent.json +++ b/experimental/generated/elasticsearch/component/user_agent.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-user_agent.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/experimental/generated/elasticsearch/component/vulnerability.json b/experimental/generated/elasticsearch/component/vulnerability.json index a4e37d4b77..ce4746933b 100644 --- a/experimental/generated/elasticsearch/component/vulnerability.json +++ b/experimental/generated/elasticsearch/component/vulnerability.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-vulnerability.html", + "ecs_version": "2.0.0-dev+exp" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/agent.json b/generated/elasticsearch/component/agent.json index 78158bbe9c..5c52341b38 100644 --- a/generated/elasticsearch/component/agent.json +++ b/generated/elasticsearch/component/agent.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-agent.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/base.json b/generated/elasticsearch/component/base.json index d1818f4faa..5c7819710a 100644 --- a/generated/elasticsearch/component/base.json +++ b/generated/elasticsearch/component/base.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-base.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/client.json b/generated/elasticsearch/component/client.json index 75edcb94a3..4986a862f0 100644 --- a/generated/elasticsearch/component/client.json +++ b/generated/elasticsearch/component/client.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-client.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/cloud.json b/generated/elasticsearch/component/cloud.json index feb7e24db8..aa85904257 100644 --- a/generated/elasticsearch/component/cloud.json +++ b/generated/elasticsearch/component/cloud.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-cloud.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/container.json b/generated/elasticsearch/component/container.json index c9db580555..c9e2adfbec 100644 --- a/generated/elasticsearch/component/container.json +++ b/generated/elasticsearch/component/container.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-container.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/destination.json b/generated/elasticsearch/component/destination.json index 31237474f4..48beef4e76 100644 --- a/generated/elasticsearch/component/destination.json +++ b/generated/elasticsearch/component/destination.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-destination.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/dll.json b/generated/elasticsearch/component/dll.json index 9bbc771143..b13e8cbcb2 100644 --- a/generated/elasticsearch/component/dll.json +++ b/generated/elasticsearch/component/dll.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-dll.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/dns.json b/generated/elasticsearch/component/dns.json index 1814577b10..0544bfe1e0 100644 --- a/generated/elasticsearch/component/dns.json +++ b/generated/elasticsearch/component/dns.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-dns.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/ecs.json b/generated/elasticsearch/component/ecs.json index df4b5d56e4..220db8c246 100644 --- a/generated/elasticsearch/component/ecs.json +++ b/generated/elasticsearch/component/ecs.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-ecs.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/error.json b/generated/elasticsearch/component/error.json index 0f2b5e12f3..edf50187ef 100644 --- a/generated/elasticsearch/component/error.json +++ b/generated/elasticsearch/component/error.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-error.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/event.json b/generated/elasticsearch/component/event.json index a8a6eb1f55..180c1117d5 100644 --- a/generated/elasticsearch/component/event.json +++ b/generated/elasticsearch/component/event.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/file.json b/generated/elasticsearch/component/file.json index ca5a80a6cf..9959b20f6f 100644 --- a/generated/elasticsearch/component/file.json +++ b/generated/elasticsearch/component/file.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-file.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/group.json b/generated/elasticsearch/component/group.json index 7500ad89c0..d707637a78 100644 --- a/generated/elasticsearch/component/group.json +++ b/generated/elasticsearch/component/group.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-group.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/host.json b/generated/elasticsearch/component/host.json index de7d5d6536..c9be5fc226 100644 --- a/generated/elasticsearch/component/host.json +++ b/generated/elasticsearch/component/host.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-host.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/http.json b/generated/elasticsearch/component/http.json index 5a52dd9e9c..0e9794b9ec 100644 --- a/generated/elasticsearch/component/http.json +++ b/generated/elasticsearch/component/http.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-http.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/log.json b/generated/elasticsearch/component/log.json index fe0261dc18..adfb238775 100644 --- a/generated/elasticsearch/component/log.json +++ b/generated/elasticsearch/component/log.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-log.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/network.json b/generated/elasticsearch/component/network.json index 74a7b796e9..43aadbde0b 100644 --- a/generated/elasticsearch/component/network.json +++ b/generated/elasticsearch/component/network.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-network.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/observer.json b/generated/elasticsearch/component/observer.json index 8c5b989556..23f5042f7b 100644 --- a/generated/elasticsearch/component/observer.json +++ b/generated/elasticsearch/component/observer.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-observer.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/organization.json b/generated/elasticsearch/component/organization.json index befa6f313c..51e911c117 100644 --- a/generated/elasticsearch/component/organization.json +++ b/generated/elasticsearch/component/organization.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-organization.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/package.json b/generated/elasticsearch/component/package.json index bc7324b6ba..a3b1505571 100644 --- a/generated/elasticsearch/component/package.json +++ b/generated/elasticsearch/component/package.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-package.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/process.json b/generated/elasticsearch/component/process.json index 91b4620486..389fa91f6b 100644 --- a/generated/elasticsearch/component/process.json +++ b/generated/elasticsearch/component/process.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-process.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/registry.json b/generated/elasticsearch/component/registry.json index fd43b911a7..599d017e8d 100644 --- a/generated/elasticsearch/component/registry.json +++ b/generated/elasticsearch/component/registry.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-registry.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/related.json b/generated/elasticsearch/component/related.json index 0d5227f3c1..1a2aac11aa 100644 --- a/generated/elasticsearch/component/related.json +++ b/generated/elasticsearch/component/related.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-related.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/rule.json b/generated/elasticsearch/component/rule.json index 43de55f11e..d4b26ced47 100644 --- a/generated/elasticsearch/component/rule.json +++ b/generated/elasticsearch/component/rule.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-rule.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/server.json b/generated/elasticsearch/component/server.json index 9e4c219fda..54a110e69c 100644 --- a/generated/elasticsearch/component/server.json +++ b/generated/elasticsearch/component/server.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-server.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/service.json b/generated/elasticsearch/component/service.json index c36de81125..1d107d634e 100644 --- a/generated/elasticsearch/component/service.json +++ b/generated/elasticsearch/component/service.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-service.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/source.json b/generated/elasticsearch/component/source.json index 9193ba6fd6..79969ec8fd 100644 --- a/generated/elasticsearch/component/source.json +++ b/generated/elasticsearch/component/source.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-source.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/threat.json b/generated/elasticsearch/component/threat.json index 6d7662b039..4f3a4a36c8 100644 --- a/generated/elasticsearch/component/threat.json +++ b/generated/elasticsearch/component/threat.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-threat.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/tls.json b/generated/elasticsearch/component/tls.json index 255ea45e15..0ae903236a 100644 --- a/generated/elasticsearch/component/tls.json +++ b/generated/elasticsearch/component/tls.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-tls.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/tracing.json b/generated/elasticsearch/component/tracing.json index 9d9555d9fa..d994e194c7 100644 --- a/generated/elasticsearch/component/tracing.json +++ b/generated/elasticsearch/component/tracing.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-tracing.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/url.json b/generated/elasticsearch/component/url.json index e4dfeaf5b8..4aa0820efc 100644 --- a/generated/elasticsearch/component/url.json +++ b/generated/elasticsearch/component/url.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-url.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/user.json b/generated/elasticsearch/component/user.json index 60d82d6987..ebcc649763 100644 --- a/generated/elasticsearch/component/user.json +++ b/generated/elasticsearch/component/user.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-user.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/user_agent.json b/generated/elasticsearch/component/user_agent.json index 2a9f1e830d..84e2b6ef9b 100644 --- a/generated/elasticsearch/component/user_agent.json +++ b/generated/elasticsearch/component/user_agent.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-user_agent.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/generated/elasticsearch/component/vulnerability.json b/generated/elasticsearch/component/vulnerability.json index a4e37d4b77..3820fb35ef 100644 --- a/generated/elasticsearch/component/vulnerability.json +++ b/generated/elasticsearch/component/vulnerability.json @@ -1,4 +1,8 @@ { + "_meta": { + "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-vulnerability.html", + "ecs_version": "2.0.0-dev" + }, "template": { "mappings": { "properties": { diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py index e3e218acc9..58a4141f6b 100644 --- a/scripts/generators/es_template.py +++ b/scripts/generators/es_template.py @@ -59,8 +59,15 @@ def all_component_templates(ecs_nested, ecs_version, out_dir): def save_component_template(template_name, ecs_version, out_dir, field_mappings): filename = join(out_dir, template_name) + ".json" + reference_url = "https://www.elastic.co/guide/en/ecs/current/ecs-{}.html".format(template_name) - template = {'template': {'mappings': {'properties': field_mappings}}} + template = { + 'template': {'mappings': {'properties': field_mappings}}, + '_meta': { + 'ecs_version': ecs_version, + 'documentation': reference_url + } + } save_json(filename, template) From 5d37d9969872d3561d8461af43ba428efeb8acf1 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Thu, 26 Nov 2020 16:22:51 -0500 Subject: [PATCH 19/27] Changelog --- CHANGELOG.next.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md index a6b982ad00..30af368e3c 100644 --- a/CHANGELOG.next.md +++ b/CHANGELOG.next.md @@ -39,6 +39,7 @@ Thanks, you're awesome :-) --> * Added support in the generated Go source go for `wildcard`, `version`, and `constant_keyword` data types. #1050 * Added support for marking fields, field sets, or field reuse as beta in the documentation. #1051 * Added support for `constant_keyword`'s optional parameter `value`. #1112 +* Added component templates for ECS field sets. #1156 #### Improvements From 85a825c865f288a435a42005f764713ab37922b7 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 12:59:13 -0500 Subject: [PATCH 20/27] Rebuild artifacts for newly merged host metrics & multi-user --- .../elasticsearch/component/host.json | 50 +++++ generated/elasticsearch/component/user.json | 180 ++++++++++++++++++ 2 files changed, 230 insertions(+) diff --git a/experimental/generated/elasticsearch/component/host.json b/experimental/generated/elasticsearch/component/host.json index bcead9fd7a..e5bf20b97d 100644 --- a/experimental/generated/elasticsearch/component/host.json +++ b/experimental/generated/elasticsearch/component/host.json @@ -12,6 +12,32 @@ "ignore_above": 1024, "type": "keyword" }, + "cpu": { + "properties": { + "usage": { + "scaling_factor": 1000, + "type": "scaled_float" + } + } + }, + "disk": { + "properties": { + "read": { + "properties": { + "bytes": { + "type": "long" + } + } + }, + "write": { + "properties": { + "bytes": { + "type": "long" + } + } + } + } + }, "domain": { "ignore_above": 1024, "type": "keyword" @@ -68,6 +94,30 @@ "ignore_above": 1024, "type": "keyword" }, + "network": { + "properties": { + "egress": { + "properties": { + "bytes": { + "type": "long" + }, + "packets": { + "type": "long" + } + } + }, + "ingress": { + "properties": { + "bytes": { + "type": "long" + }, + "packets": { + "type": "long" + } + } + } + } + }, "os": { "properties": { "family": { diff --git a/generated/elasticsearch/component/user.json b/generated/elasticsearch/component/user.json index ebcc649763..f078962974 100644 --- a/generated/elasticsearch/component/user.json +++ b/generated/elasticsearch/component/user.json @@ -8,10 +8,130 @@ "properties": { "user": { "properties": { + "changes": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, "domain": { "ignore_above": 1024, "type": "keyword" }, + "effective": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, "email": { "ignore_above": 1024, "type": "keyword" @@ -63,6 +183,66 @@ "roles": { "ignore_above": 1024, "type": "keyword" + }, + "target": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "email": { + "ignore_above": 1024, + "type": "keyword" + }, + "full_name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "group": { + "properties": { + "domain": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "hash": { + "ignore_above": 1024, + "type": "keyword" + }, + "id": { + "ignore_above": 1024, + "type": "keyword" + }, + "name": { + "fields": { + "text": { + "norms": false, + "type": "text" + } + }, + "ignore_above": 1024, + "type": "keyword" + }, + "roles": { + "ignore_above": 1024, + "type": "keyword" + } + } } } } From 4407565d2f10b97307bec18e910002fd3d8f6dc8 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 10:37:36 -0500 Subject: [PATCH 21/27] Fix typo Co-authored-by: Eric Beahan --- generated/elasticsearch/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/elasticsearch/README.md b/generated/elasticsearch/README.md index d79b783cde..269c47fee7 100644 --- a/generated/elasticsearch/README.md +++ b/generated/elasticsearch/README.md @@ -24,7 +24,7 @@ The following instructions let you use either approach. ### Composable index templates -**Warning**: The artifacts based on coposable templates are newly introduced in the ECS repository. +**Warning**: The artifacts based on composable templates are newly introduced in the ECS repository. Please try them out and give us feedback if you encounter any issues. If you want to play with a specific version of ECS, check out the proper branch first. From 6f47df1ff8f4d7c87f55d4491ef2824135d0dd59 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 14:31:54 -0500 Subject: [PATCH 22/27] Rewrite the pointer to the ES templates in generated/README --- generated/README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/generated/README.md b/generated/README.md index 3972963bae..646b1adb63 100644 --- a/generated/README.md +++ b/generated/README.md @@ -18,9 +18,11 @@ in a spreadsheet. default values are filled in, all fields being reused elsewhere are made explicit, additional attributes are computed. -* `elasticsearch/{6,7}/template.json`: Sample Elasticsearch templates to get - started using ECS. Check out how to use them in - [generated/elasticsearch/README.md](elasticsearch). +* `elasticsearch/`: Reference Elasticsearch component templates and a sample legacy + all-in-one template to get started using ECS. Check out how to use them in + [generated/elasticsearch/README.md](elasticsearch). Note that you can adjust + the fields included in these templates by following instructions in + [USAGE.md](/USAGE.md) If you'd like to share your own generator with the ECS community, you're welcome to look at our [contribution guidelines](/CONTRIBUTING.md), and then at the From b0cd15a90ffd8cfdbff7e6701278c117f6c9a1cb Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 14:41:19 -0500 Subject: [PATCH 23/27] Rewrite bullet points: - to start with a link instead of monospace file globs - add a bit of context to some of the artifacts --- generated/README.md | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/generated/README.md b/generated/README.md index 646b1adb63..abe1168320 100644 --- a/generated/README.md +++ b/generated/README.md @@ -4,25 +4,26 @@ Various kinds of files or programs can be generated directly based on ECS. In this directory, you'll find the following: -* `beats/fields.ecs.yml`: The YAML field definition file used by Beats to import ECS in it's broader - field schema. +* [beats/fields.ecs.yml](beats/fields.ecs.yml): The YAML field definition file + used by Beats to import ECS in it's broader field schema. This might be useful + to community Beats maintainers. -* `csv/fields.csv`: A csv file you can use to import ECS field definitions -in a spreadsheet. +* [csv/fields.csv](csv/fields.csv): A csv file you can use to import ECS field + definitions in a spreadsheet. GitHub's csv rendering also lets you filter + the fields, too. -* `ecs/*.yml`: These are the files you should use, if you need to consume ECS - programmatically. This repo's artifact generators all operate based off of one - of these two representations (documentation, csv, Elasticsearch - template, etc). +* [ecs/\*.yml](ecs/*.yml): These are the files to use when you need to consume ECS + programmatically. The code generating the other ECS artifacts all operate on one + of these two representations (documentation, csv, Elasticsearch template, etc). The two files are the fully fleshed out representation of ECS: default values are filled in, all fields being reused elsewhere are made explicit, additional attributes are computed. -* `elasticsearch/`: Reference Elasticsearch component templates and a sample legacy - all-in-one template to get started using ECS. Check out how to use them in - [generated/elasticsearch/README.md](elasticsearch). Note that you can adjust - the fields included in these templates by following instructions in - [USAGE.md](/USAGE.md) +* [elasticsearch/](elasticsearch/): Reference Elasticsearch component templates + and a sample legacy all-in-one template to get started using ECS. + Check out how to use them in [elasticsearch/README.md](elasticsearch#readme). + Note that you can customize the content of these templates by following the + instructions in [USAGE.md](/USAGE.md) If you'd like to share your own generator with the ECS community, you're welcome to look at our [contribution guidelines](/CONTRIBUTING.md), and then at the From 511413f63ac123c5686a3f4f07b482994583d194 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 14:47:23 -0500 Subject: [PATCH 24/27] Adjust links a tad --- generated/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/generated/README.md b/generated/README.md index abe1168320..80c7e7d657 100644 --- a/generated/README.md +++ b/generated/README.md @@ -12,14 +12,14 @@ In this directory, you'll find the following: definitions in a spreadsheet. GitHub's csv rendering also lets you filter the fields, too. -* [ecs/\*.yml](ecs/*.yml): These are the files to use when you need to consume ECS +* [ecs/\*.yml](ecs/): These are the files to use when you need to consume ECS programmatically. The code generating the other ECS artifacts all operate on one of these two representations (documentation, csv, Elasticsearch template, etc). The two files are the fully fleshed out representation of ECS: default values are filled in, all fields being reused elsewhere are made explicit, additional attributes are computed. -* [elasticsearch/](elasticsearch/): Reference Elasticsearch component templates +* [elasticsearch/](elasticsearch#readme): Reference Elasticsearch component templates and a sample legacy all-in-one template to get started using ECS. Check out how to use them in [elasticsearch/README.md](elasticsearch#readme). Note that you can customize the content of these templates by following the From 1297cd4716f0991ebed8bf8b8da1c15060981357 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 14:48:59 -0500 Subject: [PATCH 25/27] =?UTF-8?q?Emphasis=20mine=20=E2=9B=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/generated/README.md b/generated/README.md index 80c7e7d657..6fe651efc4 100644 --- a/generated/README.md +++ b/generated/README.md @@ -5,21 +5,21 @@ Various kinds of files or programs can be generated directly based on ECS. In this directory, you'll find the following: * [beats/fields.ecs.yml](beats/fields.ecs.yml): The YAML field definition file - used by Beats to import ECS in it's broader field schema. This might be useful - to community Beats maintainers. + used by **Beats to import ECS** in it's broader field schema. This might also + be useful to community Beats maintainers. * [csv/fields.csv](csv/fields.csv): A csv file you can use to import ECS field - definitions in a spreadsheet. GitHub's csv rendering also lets you filter + definitions in a **spreadsheet**. GitHub's csv rendering also lets you filter the fields, too. -* [ecs/\*.yml](ecs/): These are the files to use when you need to consume ECS - programmatically. The code generating the other ECS artifacts all operate on one +* [ecs/\*.yml](ecs/): These are the files to use when you need to **consume ECS + programmatically**. The code generating the other ECS artifacts all operate on one of these two representations (documentation, csv, Elasticsearch template, etc). The two files are the fully fleshed out representation of ECS: default values are filled in, all fields being reused elsewhere are made explicit, additional attributes are computed. -* [elasticsearch/](elasticsearch#readme): Reference Elasticsearch component templates +* [elasticsearch/](elasticsearch#readme): Reference Elasticsearch **component templates** and a sample legacy all-in-one template to get started using ECS. Check out how to use them in [elasticsearch/README.md](elasticsearch#readme). Note that you can customize the content of these templates by following the From 41551a6ca202de9710d6e121ae3c04d93bd37777 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 14:56:41 -0500 Subject: [PATCH 26/27] Better explain how to interpret the templates - component = reference - all-in-ones (legacy and composable) = sample templates --- generated/elasticsearch/README.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/generated/elasticsearch/README.md b/generated/elasticsearch/README.md index 269c47fee7..4ad26d45dd 100644 --- a/generated/elasticsearch/README.md +++ b/generated/elasticsearch/README.md @@ -6,7 +6,14 @@ point for experimentation. When you're ready to customize this template to the precise needs of your use case, please check out [USAGE.md](../../USAGE.md). -## Notes on index naming +The component index templates described below should be considered reference templates for ECS. + +The composable template that brings them together, and the legacy all-in-one index +template should be considered sample templates. Both of them include all ECS fields, +which is great for experimentation, but is not actually recommended. The best practice +is to craft your index templates to contain only the field you needs. + +## Index naming These sample Elasticsearch templates will apply to any index named `try-ecs-*`. This is good for experimentation. @@ -22,7 +29,7 @@ as the new default way to craft index templates. The following instructions let you use either approach. -### Composable index templates +### Composable and component index templates **Warning**: The artifacts based on composable templates are newly introduced in the ECS repository. Please try them out and give us feedback if you encounter any issues. @@ -59,10 +66,11 @@ done ``` A component template for each ECS field set is now loaded. You could stop here and -craft a composable template with the settings you need, that loads only the ECS +craft a composable template with the settings you need, which loads only the ECS fields your index needs via `composed_of`. You can look at [template.json](template.json) for an example. -If you'd like to load this sample composable template for experimentation: +If you'd like, you can load a sample composable template that contains all ECS fields, +for experimentation: ```bash api="_index_template/try-ecs" From fa0fc7619ff1838455caca432bbe1db078e07f4f Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Tue, 8 Dec 2020 15:59:09 -0500 Subject: [PATCH 27/27] Remove one of the two ways of saying 'also' --- generated/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/README.md b/generated/README.md index 6fe651efc4..89b5f34a98 100644 --- a/generated/README.md +++ b/generated/README.md @@ -9,7 +9,7 @@ In this directory, you'll find the following: be useful to community Beats maintainers. * [csv/fields.csv](csv/fields.csv): A csv file you can use to import ECS field - definitions in a **spreadsheet**. GitHub's csv rendering also lets you filter + definitions in a **spreadsheet**. GitHub's csv rendering lets you filter the fields, too. * [ecs/\*.yml](ecs/): These are the files to use when you need to **consume ECS