citrix_waf,cloudflare,cyberark_pta,cylance,darktrace: remove duplicated fields

packages/citrix_waf/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.1.2"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4401
 - version: "1.1.1"
   changes:
     - description: Use ECS geo.location definition.

packages/citrix_waf/data_stream/log/fields/base-fields.yml

@@ -15,6 +15,3 @@
   type: constant_keyword
   description: Event dataset
   value: citrix_waf.log
-- name: "@timestamp"
-  type: date
-  description: Event timestamp.

packages/citrix_waf/data_stream/log/fields/ecs.yml

@@ -30,8 +30,6 @@
   name: event.code
 - external: ecs
   name: event.created
-- external: ecs
-  name: event.created
 - external: ecs
   name: event.duration
 - external: ecs
@@ -116,8 +114,6 @@
   name: related.ip
 - external: ecs
   name: related.user
-- external: ecs
-  name: server.domain
 - external: ecs
   name: source.address
 - external: ecs

packages/citrix_waf/docs/README.md

@@ -163,7 +163,7 @@ An example event for `log` looks as following:
 
 | Field | Description | Type |
 |---|---|---|
-| @timestamp | Event timestamp. | date |
+| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date |
 | citrix.cef_format | Whether the logging is in Citrix CEF format. | boolean |
 | citrix.cef_version | The CEF format version used in the logs. | keyword |
 | citrix.default_class | Whether the event class was the default. | boolean |

packages/citrix_waf/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: citrix_waf
 title: "Citrix Web App Firewall"
-version: 1.1.1
+version: 1.1.2
 license: basic
 description: Ingest events from Citrix Systems Web App Firewall.
 type: integration

packages/cloudflare/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.2.4"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4401
 - version: "2.2.3"
   changes:
     - description: Use ECS geo.location definition.

packages/cloudflare/data_stream/logpull/fields/ecs.yml

@@ -12,8 +12,6 @@
   external: ecs
 - name: client.geo.continent_name
   external: ecs
-- name: client.geo.country_iso_code
-  external: ecs
 - name: client.geo.region_iso_code
   external: ecs
 - name: client.geo.location

packages/cloudflare/manifest.yml

@@ -1,6 +1,6 @@
 name: cloudflare
 title: Cloudflare
-version: 2.2.3
+version: 2.2.4
 release: ga
 description: Collect logs from Cloudflare with Elastic Agent.
 type: integration

packages/cyberark_pta/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.1.2"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4401
 - version: "0.1.1"
   changes:
     - description: Remove duplicate field.

packages/cyberark_pta/data_stream/events/fields/cef.yml

@@ -212,18 +212,6 @@
     - name: deviceCustomDate2Label
       type: keyword
       description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
-    - name: deviceCustomIPv6Address2
-      type: ip
-      description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.
-    - name: deviceCustomIPv6Address2Label
-      type: keyword
-      description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
-    - name: deviceCustomIPv6Address3
-      type: ip
-      description: One of four IPv6 address fields available to map fields that do not apply to any other in this dictionary.
-    - name: deviceCustomIPv6Address3Label
-      type: keyword
-      description: All custom fields have a corresponding label field. Each of these fields is a string and describes the purpose of the custom field.
     - name: deviceCustomNumber1
       type: long
       description: One of three number fields available to map fields that do not apply to any other in this dictionary. Use sparingly and seek a more specific, dictionary supplied field when possible.

packages/cyberark_pta/manifest.yml

@@ -1,6 +1,6 @@
 name: cyberark_pta
 title: Cyberark Privileged Threat Analytics
-version: 0.1.1
+version: 0.1.2
 release: beta
 license: basic
 description: Collect security logs from Cyberark PTA integration.

packages/cylance/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.10.2"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4401
 - version: "0.10.1"
   changes:
     - description: Use ECS geo.location definition.

packages/cylance/data_stream/protect/fields/base-fields.yml

@@ -15,9 +15,6 @@
   type: constant_keyword
   description: Event dataset
   value: cylance.protect
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
 - name: container.id
   description: Unique container id.
   ignore_above: 1024

packages/cylance/data_stream/protect/fields/ecs.yml

@@ -202,8 +202,6 @@
   name: source.subdomain
 - external: ecs
   name: source.top_level_domain
-- external: ecs
-  name: tags
 - external: ecs
   name: url.domain
 - external: ecs

packages/cylance/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: cylance
 title: CylanceProtect Logs
-version: "0.10.1"
+version: "0.10.2"
 description: Collect logs from CylanceProtect devices with Elastic Agent.
 categories: ["security"]
 release: experimental

packages/darktrace/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: '0.1.2'
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4401
 - version: '0.1.1'
   changes:
     - description: Fix documentation

packages/darktrace/data_stream/ai_analyst_alert/fields/agent.yml

@@ -97,30 +97,11 @@
       description: 'Name of the domain of which the host is a member. For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.'
       example: CONTOSO
       default_field: false
-    - name: hostname
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.'
-    - name: id
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`.'
-    - name: ip
-      level: core
-      type: ip
-      description: Host ip addresses.
     - name: mac
       level: core
       type: keyword
       ignore_above: 1024
       description: Host mac addresses.
-    - name: name
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.'
     - name: os.family
       level: extended
       type: keyword

packages/darktrace/data_stream/model_breach_alert/fields/agent.yml

@@ -97,20 +97,6 @@
       description: 'Name of the domain of which the host is a member. For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.'
       example: CONTOSO
       default_field: false
-    - name: hostname
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.'
-    - name: id
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`.'
-    - name: ip
-      level: core
-      type: ip
-      description: Host ip addresses.
     - name: mac
       level: core
       type: keyword
@@ -156,11 +142,6 @@
       ignore_above: 1024
       description: Operating system version as a raw string.
       example: 10.14.1
-    - name: type
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.'
     - name: containerized
       type: boolean
       description: >-

packages/darktrace/data_stream/system_status_alert/fields/agent.yml

@@ -97,20 +97,11 @@
       description: 'Name of the domain of which the host is a member. For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.'
       example: CONTOSO
       default_field: false
-    - name: hostname
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.'
     - name: id
       level: core
       type: keyword
       ignore_above: 1024
       description: 'Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`.'
-    - name: ip
-      level: core
-      type: ip
-      description: Host ip addresses.
     - name: mac
       level: core
       type: keyword

packages/darktrace/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: darktrace
 title: Darktrace
-version: 0.1.1
+version: 0.1.2
 license: basic
 description: Collect logs from Darktrace with Elastic Agent.
 type: integration