Update ECS to 8.4.0 part 2

packages/carbon_black_cloud/_dev/build/build.yml

@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@v8.3.0
+    reference: git@v8.4.0-rc1

packages/carbon_black_cloud/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.2.0"
+  changes:
+    - description: Update package to ECS 8.4.0
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3842
 - version: "1.1.1"
   changes:
     - description: Fix proxy URL documentation rendering.

packages/carbon_black_cloud/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json

@@ -63,7 +63,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "end": "2021-01-04T23:25:58Z",
@@ -158,7 +158,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "end": "2020-11-17T22:02:16Z",
@@ -295,7 +295,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "end": "2021-01-04T22:22:42Z",

packages/carbon_black_cloud/data_stream/alert/elasticsearch/ingest_pipeline/default.yml

@@ -3,7 +3,7 @@ description: Pipeline for parsing Carbon Black Cloud alerts.
 processors:
   - set:
       field: ecs.version
-      value: "8.3.0"
+      value: '8.4.0'
   - rename:
       field: message
       target_field: event.original

packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/_dev/test/pipeline/test-asset-vulnerability-summary.log-expected.json

@@ -18,7 +18,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":1,\"highest_risk_score\":5.3,\"host_name\":\"DESKTOP-001\",\"last_sync_ts\":\"2022-02-14T08:32:37.105065Z\",\"name\":\"DESKTOP-001KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows Server 2019 Datacenter\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.17763\"},\"severity\":\"MODERATE\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"SCHEDULED\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":137}"
@@ -66,7 +66,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":2,\"highest_risk_score\":8.4,\"host_name\":\"DESKTOP-002\",\"last_sync_ts\":\"2021-12-31T22:16:06.970164Z\",\"name\":\"DESKTOP-002KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Pro\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.19044\"},\"severity\":\"IMPORTANT\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"MANUAL\",\"type\":\"WORKLOAD\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":342}"
@@ -114,7 +114,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":3,\"highest_risk_score\":8.4,\"host_name\":\"DESKTOP-003\",\"last_sync_ts\":\"2022-02-03T15:27:28.681106Z\",\"name\":\"DESKTOP-003KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Enterprise\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.18363\"},\"severity\":\"IMPORTANT\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"SCHEDULED\",\"type\":\"WORKLOAD\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":499}"
@@ -162,7 +162,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":4,\"highest_risk_score\":10,\"host_name\":\"DESKTOP-004\",\"last_sync_ts\":\"2022-01-06T03:51:45.460029Z\",\"name\":\"DESKTOP-004KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Pro\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.18362\"},\"severity\":\"CRITICAL\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"MANUAL\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":885}"
@@ -210,7 +210,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":5,\"highest_risk_score\":10,\"host_name\":\"DESKTOP-005\",\"last_sync_ts\":\"2022-01-10T02:46:08.236117Z\",\"name\":\"DESKTOP-005KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Education\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.18362\"},\"severity\":\"CRITICAL\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"SCHEDULED\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":893}"
@@ -258,7 +258,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":6,\"highest_risk_score\":6,\"host_name\":\"DESKTOP-006\",\"last_sync_ts\":\"2022-01-10T03:11:44.097219Z\",\"name\":\"DESKTOP-006KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Pro\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.17763\"},\"severity\":\"MODERATE\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"MANUAL\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":276}"
@@ -306,7 +306,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":7,\"highest_risk_score\":10,\"host_name\":\"DESKTOP-007\",\"last_sync_ts\":\"2022-01-11T08:41:31.573863Z\",\"name\":\"DESKTOP-007KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Pro\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.19043\"},\"severity\":\"CRITICAL\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"MANUAL\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":542}"
@@ -354,7 +354,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "original": "{\"cve_ids\":null,\"device_id\":8,\"highest_risk_score\":10,\"host_name\":\"DESKTOP-008\",\"last_sync_ts\":\"2022-01-17T08:33:37.384932Z\",\"name\":\"DESKTOP-008KK\",\"os_info\":{\"os_arch\":\"64-bit\",\"os_name\":\"Microsoft Windows 10 Education\",\"os_type\":\"WINDOWS\",\"os_version\":\"10.0.17763\"},\"severity\":\"CRITICAL\",\"sync_status\":\"COMPLETED\",\"sync_type\":\"SCHEDULED\",\"type\":\"ENDPOINT\",\"vm_id\":\"\",\"vm_name\":\"\",\"vuln_count\":1770}"

packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml

@@ -7,7 +7,7 @@ processors:
     ignore_missing: true
 - set:
     field: ecs.version
-    value: '8.3.0'
+    value: '8.4.0'
 - json:
     field: event.original
     target_field: json

packages/carbon_black_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json

@@ -15,7 +15,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "id": "16xxxxxxxxxx8ac7bd",
@@ -51,7 +51,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "id": "21xxxxxxxxxx93ff7c",
@@ -87,7 +87,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "id": "28xxxxxxxxxx8ac7bd",
@@ -123,7 +123,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "id": "34xxxxxxxxxxd9ccf9",
@@ -159,7 +159,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "id": "3axxxxxxxxxx2e5035",
@@ -195,7 +195,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "id": "32xxxxxxxxxx189c6d",
@@ -231,7 +231,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "id": "a9xxxxxxxxxx4b3d2c",

packages/carbon_black_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml

@@ -3,7 +3,7 @@ description: Pipeline for parsing Carbon Black Cloud audit logs
 processors:
   - set:
       field: ecs.version
-      value: '8.3.0'
+      value: '8.4.0'
   - rename:
       field: message
       target_field: event.original

packages/carbon_black_cloud/data_stream/endpoint_event/_dev/test/pipeline/test-endpoint-event.log-expected.json

@@ -37,7 +37,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_CREATE_KEY",
@@ -139,7 +139,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_WRITE_VALUE",
@@ -262,7 +262,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_OPEN_PROCESS_HANDLE",
@@ -385,7 +385,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_OPEN_PROCESS_HANDLE",
@@ -504,7 +504,7 @@
                 "path": "c:\\windows\\system32\\fltlib.dll"
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_LOAD_MODULE",
@@ -625,7 +625,7 @@
                 "path": "c:\\windows\\system32\\dnsapi.dll"
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_LOAD_MODULE",
@@ -746,7 +746,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_CREATE_PROCESS",
@@ -867,7 +867,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_CREATE_PROCESS",
@@ -968,7 +968,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_PROCESS_TERMINATE",
@@ -1067,7 +1067,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_PROCESS_TERMINATE",
@@ -1162,7 +1162,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_FILE_MOD_OPEN | ACTION_FILE_OPEN_DELETE",
@@ -1260,7 +1260,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_FILE_MOD_OPEN | ACTION_FILE_OPEN_READ | ACTION_FILE_OPEN_WRITE",
@@ -1362,7 +1362,7 @@
                 "port": 62909
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_CONNECTION_CREATE",
@@ -1470,7 +1470,7 @@
                 "port": 9716
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_CONNECTION_LISTEN",
@@ -1587,7 +1587,7 @@
                 }
             },
             "ecs": {
-                "version": "8.3.0"
+                "version": "8.4.0"
             },
             "event": {
                 "action": "ACTION_LOAD_SCRIPT",

packages/carbon_black_cloud/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml

@@ -3,7 +3,7 @@ description: Pipeline for parsing Carbon Black Cloud Endpoint Events.
 processors:
   - set:
       field: ecs.version
-      value: '8.3.0'
+      value: '8.4.0'
   - rename:
       field: message
       target_field: event.original