[cloud_security_posture] Adding vulnerability fields

packages/cloud_security_posture/changelog.yml

@@ -11,6 +11,9 @@
       link: https://github.com/elastic/integrations/pull/7379
 - version: "1.5.0-preview31"
   changes:
+    - description: Add vulnerability mappings
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1176
     - description: Ensure event.kind is correctly set for pipeline errors.
       type: enhancement
       link: https://github.com/elastic/integrations/pull/7048

packages/cloud_security_posture/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml

@@ -1,13 +1,18 @@
 ---
 description: Pipeline for cloudbeat vulnerabilities
 processors:
-- set:
-    field: ecs.version
-    value: '8.6.0'
+  - set:
+      field: ecs.version
+      value: "8.6.0"
+  - set:
+      field: cloud.service.name
+      value: "AWS EC2"
+      description: "Adding vulnerability type for cloudbeat version < 8.10"
+      if: ctx.cloud?.service?.name == null
 on_failure:
   - set:
       field: event.kind
       value: pipeline_error
   - append:
       field: error.message
-      value: '{{{ _ingest.on_failure_message }}}'
+      value: "{{{ _ingest.on_failure_message }}}"

packages/cloud_security_posture/data_stream/vulnerabilities/fields/cloud.yml

@@ -0,0 +1,19 @@
+- name: cloud
+  type: group
+  fields:
+    - name: service.name
+      type: keyword
+    - name: machine.type
+      type: keyword
+    - name: machine.Authentication.key
+      type: keyword
+    - name: machine.Launch_time
+      type: keyword
+    - name: machine.Image
+      type: keyword
+    - name: Tags
+      type: keyword
+    - name: availability_zone
+      type: keyword
+    - name: Security.security_groups
+      type: object

packages/cloud_security_posture/data_stream/vulnerabilities/fields/ecs.yml

@@ -80,6 +80,10 @@
   external: ecs
 - name: cloud.account.name
   external: ecs
+- name: cloud.instance.name
+  external: ecs
+- name: cloud.instance.id
+  external: ecs
 - name: cloud.provider
   external: ecs
 - name: cloud.region

packages/cloud_security_posture/data_stream/vulnerabilities/fields/network.yml

@@ -0,0 +1,9 @@
+- name: network
+  type: group
+  fields:
+    - name: Private_ip
+      type: keyword
+    - name: Public_ip
+      type: keyword
+    - name: Mac_addresses
+      type: keyword

packages/cloud_security_posture/data_stream/vulnerabilities/fields/resource.yml

@@ -1,3 +1,4 @@
+# Deprecated replaced by cloud.instance fields
 - name: resource
   type: group
   fields:

packages/cloud_security_posture/data_stream/vulnerabilities/fields/vulnerability.yml

@@ -1,6 +1,7 @@
 - name: vulnerability
   type: group
   fields:
+    # Deprecated replaced by category
     - name: class
       type: keyword
     - name: package.version
@@ -9,7 +10,7 @@
       type: keyword
     - name: package.fixed_version
       type: keyword
-    - name: title
+    - name: Title
       type: keyword
     - name: data_source.ID
       type: keyword