Skip to content

Commit 5b737ea

Browse files
nicholasberlinnicholasberlin
committed
Add diag_documents_volume
1 parent 88c609b commit 5b737ea

File tree

6 files changed

+416
-5
lines changed

6 files changed

+416
-5
lines changed

‎custom_documentation/doc/endpoint/metrics/metrics.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,23 @@ This is an internal state management document that includes metrics on Endpoint'
2626
| Endpoint.metrics.cpu.endpoint.histogram.values |
2727
| Endpoint.metrics.cpu.endpoint.latest |
2828
| Endpoint.metrics.cpu.endpoint.mean |
29+
| Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes |
30+
| Endpoint.metrics.diag_documents_volume.dns_events.sent_count |
31+
| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes |
32+
| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count |
33+
| Endpoint.metrics.diag_documents_volume.overall.sent_bytes |
34+
| Endpoint.metrics.diag_documents_volume.overall.sent_count |
35+
| Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes |
36+
| Endpoint.metrics.diag_documents_volume.overall.suppressed_count |
37+
| Endpoint.metrics.diag_documents_volume.process_events.sent_bytes |
38+
| Endpoint.metrics.diag_documents_volume.process_events.sent_count |
39+
| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes |
40+
| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count |
41+
| Endpoint.metrics.diag_documents_volume.process_events.sources.source |
42+
| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes |
43+
| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count |
44+
| Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes |
45+
| Endpoint.metrics.diag_documents_volume.process_events.suppressed_count |
2946
| Endpoint.metrics.disks.device |
3047
| Endpoint.metrics.disks.endpoint_drive |
3148
| Endpoint.metrics.disks.free |

‎custom_documentation/src/endpoint/data_stream/metrics/metrics.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,23 @@ fields:
3333
- Endpoint.metrics.cpu.endpoint.histogram.values
3434
- Endpoint.metrics.cpu.endpoint.latest
3535
- Endpoint.metrics.cpu.endpoint.mean
36+
- Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes
37+
- Endpoint.metrics.diag_documents_volume.dns_events.sent_count
38+
- Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes
39+
- Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count
40+
- Endpoint.metrics.diag_documents_volume.overall.sent_bytes
41+
- Endpoint.metrics.diag_documents_volume.overall.sent_count
42+
- Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes
43+
- Endpoint.metrics.diag_documents_volume.overall.suppressed_count
44+
- Endpoint.metrics.diag_documents_volume.process_events.sent_bytes
45+
- Endpoint.metrics.diag_documents_volume.process_events.sent_count
46+
- Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes
47+
- Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count
48+
- Endpoint.metrics.diag_documents_volume.process_events.sources.source
49+
- Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes
50+
- Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count
51+
- Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes
52+
- Endpoint.metrics.diag_documents_volume.process_events.suppressed_count
3653
- Endpoint.metrics.disks.device
3754
- Endpoint.metrics.disks.endpoint_drive
3855
- Endpoint.metrics.disks.free

‎custom_schemas/custom_endpoint.yml‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,101 @@
460460
type: object
461461
description: Metrics fields hold the endpoint and system's performance metrics
462462

463+
- name: metrics.diag_documents_volume
464+
level: custom
465+
type: object
466+
description: Statistics about diagnostic documents
467+
468+
- name: metrics.diag_documents_volume.dns_events.sent_bytes
469+
level: custom
470+
description: Total size of documents that would be sent
471+
type: long
472+
473+
- name: metrics.diag_documents_volume.dns_events.sent_count
474+
level: custom
475+
description: Number of documents that would be sent
476+
type: long
477+
478+
- name: metrics.diag_documents_volume.dns_events.suppressed_bytes
479+
level: custom
480+
description: Total size of suppressed documents
481+
type: long
482+
483+
- name: metrics.diag_documents_volume.dns_events.suppressed_count
484+
level: custom
485+
description: Number of suppressed documents
486+
type: long
487+
488+
- name: metrics.diag_documents_volume.overall.sent_bytes
489+
level: custom
490+
description: Total size of documents that would be sent
491+
type: long
492+
493+
- name: metrics.diag_documents_volume.overall.sent_count
494+
level: custom
495+
description: Number of documents that would be sent
496+
type: long
497+
498+
- name: metrics.diag_documents_volume.overall.suppressed_bytes
499+
level: custom
500+
description: Total size of suppressed documents
501+
type: long
502+
503+
- name: metrics.diag_documents_volume.overall.suppressed_count
504+
level: custom
505+
description: Number of suppressed documents
506+
type: long
507+
508+
- name: metrics.diag_documents_volume.process_events.sent_bytes
509+
level: custom
510+
description: Total size of documents that would be sent
511+
type: long
512+
513+
- name: metrics.diag_documents_volume.process_events.sent_count
514+
level: custom
515+
description: Number of documents that would be sent
516+
type: long
517+
518+
- name: metrics.diag_documents_volume.process_events.suppressed_bytes
519+
level: custom
520+
description: Total size of suppressed documents
521+
type: long
522+
523+
- name: metrics.diag_documents_volume.process_events.suppressed_count
524+
level: custom
525+
description: Number of suppressed documents
526+
type: long
527+
528+
- name: metrics.diag_documents_volume.process_events.sources
529+
level: custom
530+
type: object
531+
description: An array of Process Event document statistics per source
532+
533+
- name: metrics.diag_documents_volume.process_events.sources.source
534+
level: custom
535+
type: keyword
536+
description: Process Event document source name
537+
538+
- name: metrics.diag_documents_volume.process_events.sources.sent_count
539+
level: custom
540+
type: long
541+
description: Number of Process Event documents from source that would be sent
542+
543+
- name: metrics.diag_documents_volume.process_events.sources.sent_bytes
544+
level: custom
545+
type: long
546+
description: Total size of Process Event documents from source that would be sent
547+
548+
- name: metrics.diag_documents_volume.process_events.sources.suppressed_count
549+
level: custom
550+
type: long
551+
description: Number of suppressed Process Event documents from source
552+
553+
- name: metrics.diag_documents_volume.process_events.sources.suppressed_bytes
554+
level: custom
555+
type: long
556+
description: Total size of suppressed Process Event documents from source
557+
463558
- name: metrics.documents_volume
464559
level: custom
465560
type: object

‎package/endpoint/data_stream/metrics/fields/fields.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,102 @@
5858
type: half_float
5959
description: Average CPU load used by the endpoint
6060
default_field: false
61+
- name: metrics.diag_documents_volume
62+
level: custom
63+
type: object
64+
description: Statistics about diagnostic documents
65+
default_field: false
66+
- name: metrics.diag_documents_volume.dns_events.sent_bytes
67+
level: custom
68+
type: long
69+
description: Total size of documents that would be sent
70+
default_field: false
71+
- name: metrics.diag_documents_volume.dns_events.sent_count
72+
level: custom
73+
type: long
74+
description: Number of documents that would be sent
75+
default_field: false
76+
- name: metrics.diag_documents_volume.dns_events.suppressed_bytes
77+
level: custom
78+
type: long
79+
description: Total size of suppressed documents
80+
default_field: false
81+
- name: metrics.diag_documents_volume.dns_events.suppressed_count
82+
level: custom
83+
type: long
84+
description: Number of suppressed documents
85+
default_field: false
86+
- name: metrics.diag_documents_volume.overall.sent_bytes
87+
level: custom
88+
type: long
89+
description: Total size of documents that would be sent
90+
default_field: false
91+
- name: metrics.diag_documents_volume.overall.sent_count
92+
level: custom
93+
type: long
94+
description: Number of documents that would be sent
95+
default_field: false
96+
- name: metrics.diag_documents_volume.overall.suppressed_bytes
97+
level: custom
98+
type: long
99+
description: Total size of suppressed documents
100+
default_field: false
101+
- name: metrics.diag_documents_volume.overall.suppressed_count
102+
level: custom
103+
type: long
104+
description: Number of suppressed documents
105+
default_field: false
106+
- name: metrics.diag_documents_volume.process_events.sent_bytes
107+
level: custom
108+
type: long
109+
description: Total size of documents that would be sent
110+
default_field: false
111+
- name: metrics.diag_documents_volume.process_events.sent_count
112+
level: custom
113+
type: long
114+
description: Number of documents that would be sent
115+
default_field: false
116+
- name: metrics.diag_documents_volume.process_events.sources
117+
level: custom
118+
type: object
119+
description: An array of Process Event document statistics per source
120+
default_field: false
121+
- name: metrics.diag_documents_volume.process_events.sources.sent_bytes
122+
level: custom
123+
type: long
124+
description: Total size of Process Event documents from source that would be sent
125+
default_field: false
126+
- name: metrics.diag_documents_volume.process_events.sources.sent_count
127+
level: custom
128+
type: long
129+
description: Number of Process Event documents from source that would be sent
130+
default_field: false
131+
- name: metrics.diag_documents_volume.process_events.sources.source
132+
level: custom
133+
type: keyword
134+
ignore_above: 1024
135+
description: Process Event document source name
136+
default_field: false
137+
- name: metrics.diag_documents_volume.process_events.sources.suppressed_bytes
138+
level: custom
139+
type: long
140+
description: Total size of suppressed Process Event documents from source
141+
default_field: false
142+
- name: metrics.diag_documents_volume.process_events.sources.suppressed_count
143+
level: custom
144+
type: long
145+
description: Number of suppressed Process Event documents from source
146+
default_field: false
147+
- name: metrics.diag_documents_volume.process_events.suppressed_bytes
148+
level: custom
149+
type: long
150+
description: Total size of suppressed documents
151+
default_field: false
152+
- name: metrics.diag_documents_volume.process_events.suppressed_count
153+
level: custom
154+
type: long
155+
description: Number of suppressed documents
156+
default_field: false
61157
- name: metrics.disks
62158
level: custom
63159
type: object

‎package/endpoint/docs/README.md‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,3 @@
1-
> ## Elastic Defend Detection and Response Dashboard
2-
>
3-
> Instantly investigate, triage, and respond to threats on the new, centralized Detection and Response dashboard for Elastic Defend alerts.
4-
5-
61
# Elastic Defend Integration
72

83
Elastic Defend provides organizations with prevention, detection, and response capabilities with deep visibility for EPP, EDR, SIEM, and Security Analytics use cases across Windows, macOS, and Linux operating systems running on both traditional endpoints and public cloud environments. ​​Use Elastic Defend to:
@@ -3004,6 +2999,25 @@ Metrics documents contain performance information about the endpoint executable
30042999
| Endpoint.metrics.cpu.endpoint.histogram | This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket | histogram |
30053000
| Endpoint.metrics.cpu.endpoint.latest | Average CPU over the last sample interval | half_float |
30063001
| Endpoint.metrics.cpu.endpoint.mean | Average CPU load used by the endpoint | half_float |
3002+
| Endpoint.metrics.diag_documents_volume | Statistics about diagnostic documents | object |
3003+
| Endpoint.metrics.diag_documents_volume.dns_events.sent_bytes | Total size of documents that would be sent | long |
3004+
| Endpoint.metrics.diag_documents_volume.dns_events.sent_count | Number of documents that would be sent | long |
3005+
| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_bytes | Total size of suppressed documents | long |
3006+
| Endpoint.metrics.diag_documents_volume.dns_events.suppressed_count | Number of suppressed documents | long |
3007+
| Endpoint.metrics.diag_documents_volume.overall.sent_bytes | Total size of documents that would be sent | long |
3008+
| Endpoint.metrics.diag_documents_volume.overall.sent_count | Number of documents that would be sent | long |
3009+
| Endpoint.metrics.diag_documents_volume.overall.suppressed_bytes | Total size of suppressed documents | long |
3010+
| Endpoint.metrics.diag_documents_volume.overall.suppressed_count | Number of suppressed documents | long |
3011+
| Endpoint.metrics.diag_documents_volume.process_events.sent_bytes | Total size of documents that would be sent | long |
3012+
| Endpoint.metrics.diag_documents_volume.process_events.sent_count | Number of documents that would be sent | long |
3013+
| Endpoint.metrics.diag_documents_volume.process_events.sources | An array of Process Event document statistics per source | object |
3014+
| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_bytes | Total size of Process Event documents from source that would be sent | long |
3015+
| Endpoint.metrics.diag_documents_volume.process_events.sources.sent_count | Number of Process Event documents from source that would be sent | long |
3016+
| Endpoint.metrics.diag_documents_volume.process_events.sources.source | Process Event document source name | keyword |
3017+
| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_bytes | Total size of suppressed Process Event documents from source | long |
3018+
| Endpoint.metrics.diag_documents_volume.process_events.sources.suppressed_count | Number of suppressed Process Event documents from source | long |
3019+
| Endpoint.metrics.diag_documents_volume.process_events.suppressed_bytes | Total size of suppressed documents | long |
3020+
| Endpoint.metrics.diag_documents_volume.process_events.suppressed_count | Number of suppressed documents | long |
30073021
| Endpoint.metrics.documents_volume | Statistics about sent documents | object |
30083022
| Endpoint.metrics.documents_volume.alerts.sent_bytes | Total size of sent documents | long |
30093023
| Endpoint.metrics.documents_volume.alerts.sent_count | Number of sent documents | long |

0 commit comments

Comments
 (0)