Remove ECS field definitions from CDR transform destinations

packages/aws/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "6.3.0"
+  changes:
+    - description: Removed ECS field definitions from CDR transform destinations, now covered by ecs@mappings component template. Renamed overridden ECS fields files to ecs-overridden.yml for awsconfig and awsinspector transforms.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/17552
 - version: "6.2.0"
   changes:
     - description: |

packages/aws/elasticsearch/transform/latest_cdr_misconfigurations/fields/ecs-overridden.yml

@@ -0,0 +1,7 @@
+# Define ECS constant fields as constant_keyword
+- name: cloud.provider
+  type: constant_keyword
+- name: event.kind
+  type: constant_keyword
+- name: observer.vendor
+  type: constant_keyword

packages/aws/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/ecs.yml → packages/aws/elasticsearch/transform/latest_cdr_misconfigurations_awsconfig/fields/ecs-overridden.yml

@@ -1,6 +1,5 @@
+# Define ECS constant fields as constant_keyword
 - name: cloud.provider
   type: constant_keyword
-  external: ecs
 - name: observer.vendor
   type: constant_keyword
-  external: ecs

packages/aws_securityhub/elasticsearch/transform/latest_findings/fields/ecs.yml → packages/aws/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/ecs-overridden.yml

@@ -1,7 +1,5 @@
 # Define ECS constant fields as constant_keyword
 - name: observer.vendor
   type: constant_keyword
-  external: ecs
 - name: vulnerability.scanner.vendor
   type: constant_keyword
-  external: ecs

packages/aws/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: aws
 title: AWS
-version: 6.2.0
+version: 6.3.0
 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
 type: integration
 categories:

packages/aws_securityhub/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.2.0"
+  changes:
+    - description: Removed ECS field definitions from CDR transform destinations, now covered by ecs@mappings component template. Renamed overridden ECS fields files to ecs-overridden.yml.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/17552
 - version: "0.1.0"
   changes:
     - description: Initial release.

packages/google_scc/elasticsearch/transform/latest_cdr_vulnerabilities/fields/ecs.yml → packages/aws_securityhub/elasticsearch/transform/latest_cdr_vulnerabilities/fields/ecs-overridden.yml

@@ -1,7 +1,5 @@
 # Define ECS constant fields as constant_keyword
 - name: observer.vendor
   type: constant_keyword
-  external: ecs
 - name: vulnerability.scanner.vendor
   type: constant_keyword
-  external: ecs

packages/aws/elasticsearch/transform/latest_cdr_vulnerabilities_awsinspector/fields/ecs.yml → packages/aws_securityhub/elasticsearch/transform/latest_findings/fields/ecs-overridden.yml

@@ -1,7 +1,5 @@
 # Define ECS constant fields as constant_keyword
 - name: observer.vendor
   type: constant_keyword
-  external: ecs
 - name: vulnerability.scanner.vendor
   type: constant_keyword
-  external: ecs

packages/aws_securityhub/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.5.0
 name: aws_securityhub
 title: "AWS Security Hub"
-version: 0.1.0
+version: 0.2.0
 source:
   license: "Elastic-2.0"
 description: Collect logs from AWS Security Hub with Elastic Agent.

packages/cloud_security_posture/changelog.yml

@@ -18,6 +18,11 @@
 # 1.4.x - 8.9.x
 # 1.3.x - 8.8.x
 # 1.2.x - 8.7.x
+- version: "3.3.0-preview07"
+  changes:
+    - description: Removed ECS field definitions from misconfiguration transform, now covered by ecs@mappings component template on transform destination index templates.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/17552
 - version: "3.3.0-preview06"
   changes:
     - description: Add gcp_credentials_cloud_connector_id to GCP stream template and mark as secret