Add domain field to Group Schema

docs/field-details.asciidoc

@@ -1681,6 +1681,17 @@ The group fields are meant to represent groups that are relevant to the event.
 
 // ===============================================================
 
+| group.domain
+| Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.
+
+type: keyword
+
+
+
+| extended
+
+// ===============================================================
+
 | group.id
 | Unique identifier for the group on the system/platform.
 

generated/beats/fields.ecs.yml

@@ -303,6 +303,12 @@
       ignore_above: 1024
       description: User's full name, if available.
       example: Albert Einstein
+    - name: user.group.domain
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Name of the directory the group is a member of. For example, an
+        LDAP or Active Directory domain name.
     - name: user.group.id
       level: extended
       type: keyword
@@ -589,6 +595,12 @@
       ignore_above: 1024
       description: User's full name, if available.
       example: Albert Einstein
+    - name: user.group.domain
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Name of the directory the group is a member of. For example, an
+        LDAP or Active Directory domain name.
     - name: user.group.id
       level: extended
       type: keyword
@@ -1230,6 +1242,12 @@
       to the event.
     type: group
     fields:
+    - name: domain
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Name of the directory the group is a member of. For example, an
+        LDAP or Active Directory domain name.
     - name: id
       level: extended
       type: keyword
@@ -1441,6 +1459,12 @@
       ignore_above: 1024
       description: User's full name, if available.
       example: Albert Einstein
+    - name: user.group.domain
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Name of the directory the group is a member of. For example, an
+        LDAP or Active Directory domain name.
     - name: user.group.id
       level: extended
       type: keyword
@@ -2193,6 +2217,12 @@
       ignore_above: 1024
       description: User's full name, if available.
       example: Albert Einstein
+    - name: user.group.domain
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Name of the directory the group is a member of. For example, an
+        LDAP or Active Directory domain name.
     - name: user.group.id
       level: extended
       type: keyword
@@ -2456,6 +2486,12 @@
       ignore_above: 1024
       description: User's full name, if available.
       example: Albert Einstein
+    - name: user.group.domain
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Name of the directory the group is a member of. For example, an
+        LDAP or Active Directory domain name.
     - name: user.group.id
       level: extended
       type: keyword
@@ -2635,6 +2671,12 @@
       ignore_above: 1024
       description: User's full name, if available.
       example: Albert Einstein
+    - name: group.domain
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Name of the directory the group is a member of. For example, an
+        LDAP or Active Directory domain name.
     - name: group.id
       level: extended
       type: keyword

generated/csv/fields.csv

@@ -33,6 +33,7 @@ client.registered_domain,keyword,extended,google.com,1.2.0-dev
 client.user.domain,keyword,extended,,1.2.0-dev
 client.user.email,keyword,extended,,1.2.0-dev
 client.user.full_name,keyword,extended,Albert Einstein,1.2.0-dev
+client.user.group.domain,keyword,extended,,1.2.0-dev
 client.user.group.id,keyword,extended,,1.2.0-dev
 client.user.group.name,keyword,extended,,1.2.0-dev
 client.user.hash,keyword,extended,,1.2.0-dev
@@ -74,6 +75,7 @@ destination.registered_domain,keyword,extended,google.com,1.2.0-dev
 destination.user.domain,keyword,extended,,1.2.0-dev
 destination.user.email,keyword,extended,,1.2.0-dev
 destination.user.full_name,keyword,extended,Albert Einstein,1.2.0-dev
+destination.user.group.domain,keyword,extended,,1.2.0-dev
 destination.user.group.id,keyword,extended,,1.2.0-dev
 destination.user.group.name,keyword,extended,,1.2.0-dev
 destination.user.hash,keyword,extended,,1.2.0-dev
@@ -150,6 +152,7 @@ geo.location,geo_point,core,"{ ""lon"": -73.614830, ""lat"": 45.505918 }",1.2.0-
 geo.name,keyword,extended,boston-dc,1.2.0-dev
 geo.region_iso_code,keyword,core,CA-QC,1.2.0-dev
 geo.region_name,keyword,core,Quebec,1.2.0-dev
+group.domain,keyword,extended,,1.2.0-dev
 group.id,keyword,extended,,1.2.0-dev
 group.name,keyword,extended,,1.2.0-dev
 hash.md5,keyword,extended,,1.2.0-dev
@@ -181,6 +184,7 @@ host.uptime,long,extended,1325,1.2.0-dev
 host.user.domain,keyword,extended,,1.2.0-dev
 host.user.email,keyword,extended,,1.2.0-dev
 host.user.full_name,keyword,extended,Albert Einstein,1.2.0-dev
+host.user.group.domain,keyword,extended,,1.2.0-dev
 host.user.group.id,keyword,extended,,1.2.0-dev
 host.user.group.name,keyword,extended,,1.2.0-dev
 host.user.hash,keyword,extended,,1.2.0-dev
@@ -279,6 +283,7 @@ server.registered_domain,keyword,extended,google.com,1.2.0-dev
 server.user.domain,keyword,extended,,1.2.0-dev
 server.user.email,keyword,extended,,1.2.0-dev
 server.user.full_name,keyword,extended,Albert Einstein,1.2.0-dev
+server.user.group.domain,keyword,extended,,1.2.0-dev
 server.user.group.id,keyword,extended,,1.2.0-dev
 server.user.group.name,keyword,extended,,1.2.0-dev
 server.user.hash,keyword,extended,,1.2.0-dev
@@ -313,6 +318,7 @@ source.registered_domain,keyword,extended,google.com,1.2.0-dev
 source.user.domain,keyword,extended,,1.2.0-dev
 source.user.email,keyword,extended,,1.2.0-dev
 source.user.full_name,keyword,extended,Albert Einstein,1.2.0-dev
+source.user.group.domain,keyword,extended,,1.2.0-dev
 source.user.group.id,keyword,extended,,1.2.0-dev
 source.user.group.name,keyword,extended,,1.2.0-dev
 source.user.hash,keyword,extended,,1.2.0-dev
@@ -334,6 +340,7 @@ url.username,keyword,extended,,1.2.0-dev
 user.domain,keyword,extended,,1.2.0-dev
 user.email,keyword,extended,,1.2.0-dev
 user.full_name,keyword,extended,Albert Einstein,1.2.0-dev
+user.group.domain,keyword,extended,,1.2.0-dev
 user.group.id,keyword,extended,,1.2.0-dev
 user.group.name,keyword,extended,,1.2.0-dev
 user.hash,keyword,extended,,1.2.0-dev

generated/ecs/ecs_flat.yml

@@ -359,6 +359,18 @@ client.user.full_name:
   original_fieldset: user
   short: User's full name, if available.
   type: keyword
+client.user.group.domain:
+  description: Name of the directory the group is a member of. For example, an LDAP
+    or Active Directory domain name.
+  flat_name: client.user.group.domain
+  ignore_above: 1024
+  level: extended
+  name: domain
+  order: 2
+  original_fieldset: user
+  short: Name of the directory the group is a member of. For example, an LDAP or Active
+    Directory domain name.
+  type: keyword
 client.user.group.id:
   description: Unique identifier for the group on the system/platform.
   flat_name: client.user.group.id
@@ -799,6 +811,18 @@ destination.user.full_name:
   original_fieldset: user
   short: User's full name, if available.
   type: keyword
+destination.user.group.domain:
+  description: Name of the directory the group is a member of. For example, an LDAP
+    or Active Directory domain name.
+  flat_name: destination.user.group.domain
+  ignore_above: 1024
+  level: extended
+  name: domain
+  order: 2
+  original_fieldset: user
+  short: Name of the directory the group is a member of. For example, an LDAP or Active
+    Directory domain name.
+  type: keyword
 destination.user.group.id:
   description: Unique identifier for the group on the system/platform.
   flat_name: destination.user.group.id
@@ -1688,6 +1712,17 @@ geo.region_name:
   order: 3
   short: Region name.
   type: keyword
+group.domain:
+  description: Name of the directory the group is a member of. For example, an LDAP
+    or Active Directory domain name.
+  flat_name: group.domain
+  ignore_above: 1024
+  level: extended
+  name: domain
+  order: 2
+  short: Name of the directory the group is a member of. For example, an LDAP or Active
+    Directory domain name.
+  type: keyword
 group.id:
   description: Unique identifier for the group on the system/platform.
   flat_name: group.id
@@ -2018,6 +2053,18 @@ host.user.full_name:
   original_fieldset: user
   short: User's full name, if available.
   type: keyword
+host.user.group.domain:
+  description: Name of the directory the group is a member of. For example, an LDAP
+    or Active Directory domain name.
+  flat_name: host.user.group.domain
+  ignore_above: 1024
+  level: extended
+  name: domain
+  order: 2
+  original_fieldset: user
+  short: Name of the directory the group is a member of. For example, an LDAP or Active
+    Directory domain name.
+  type: keyword
 host.user.group.id:
   description: Unique identifier for the group on the system/platform.
   flat_name: host.user.group.id
@@ -3130,6 +3177,18 @@ server.user.full_name:
   original_fieldset: user
   short: User's full name, if available.
   type: keyword
+server.user.group.domain:
+  description: Name of the directory the group is a member of. For example, an LDAP
+    or Active Directory domain name.
+  flat_name: server.user.group.domain
+  ignore_above: 1024
+  level: extended
+  name: domain
+  order: 2
+  original_fieldset: user
+  short: Name of the directory the group is a member of. For example, an LDAP or Active
+    Directory domain name.
+  type: keyword
 server.user.group.id:
   description: Unique identifier for the group on the system/platform.
   flat_name: server.user.group.id
@@ -3531,6 +3590,18 @@ source.user.full_name:
   original_fieldset: user
   short: User's full name, if available.
   type: keyword
+source.user.group.domain:
+  description: Name of the directory the group is a member of. For example, an LDAP
+    or Active Directory domain name.
+  flat_name: source.user.group.domain
+  ignore_above: 1024
+  level: extended
+  name: domain
+  order: 2
+  original_fieldset: user
+  short: Name of the directory the group is a member of. For example, an LDAP or Active
+    Directory domain name.
+  type: keyword
 source.user.group.id:
   description: Unique identifier for the group on the system/platform.
   flat_name: source.user.group.id
@@ -3782,6 +3853,18 @@ user.full_name:
   order: 2
   short: User's full name, if available.
   type: keyword
+user.group.domain:
+  description: Name of the directory the group is a member of. For example, an LDAP
+    or Active Directory domain name.
+  flat_name: user.group.domain
+  ignore_above: 1024
+  level: extended
+  name: domain
+  order: 2
+  original_fieldset: group
+  short: Name of the directory the group is a member of. For example, an LDAP or Active
+    Directory domain name.
+  type: keyword
 user.group.id:
   description: Unique identifier for the group on the system/platform.
   flat_name: user.group.id