diff --git a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
index 1b1bae37f4fbb..51c29c15a8097 100644
--- a/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
+++ b/x-pack/plugins/security_solution/cypress/integration/alerts_detection_rules_custom.spec.ts
@@ -4,7 +4,7 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { newRule, totalNumberOfPrebuiltRulesInEsArchive } from '../objects/rule';
+import { newRule, totalNumberOfPrebuiltRulesInEsArchiveCustomRule } from '../objects/rule';
 
 import {
   CUSTOM_RULES_BTN,
@@ -64,7 +64,7 @@ import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
 
 import { ALERTS_URL } from '../urls/navigation';
 
-describe.skip('Detection rules, custom', () => {
+describe('Detection rules, custom', () => {
   before(() => {
     esArchiverLoad('custom_rule_with_timeline');
   });
@@ -89,7 +89,7 @@ describe.skip('Detection rules, custom', () => {
     changeToThreeHundredRowsPerPage();
     waitForRulesToBeLoaded();
 
-    const expectedNumberOfRules = totalNumberOfPrebuiltRulesInEsArchive + 1;
+    const expectedNumberOfRules = totalNumberOfPrebuiltRulesInEsArchiveCustomRule + 1;
     cy.get(RULES_TABLE).then(($table) => {
       cy.wrap($table.find(RULES_ROW).length).should('eql', expectedNumberOfRules);
     });
diff --git a/x-pack/plugins/security_solution/cypress/objects/rule.ts b/x-pack/plugins/security_solution/cypress/objects/rule.ts
index d750fe212002d..c9d3af57e5e59 100644
--- a/x-pack/plugins/security_solution/cypress/objects/rule.ts
+++ b/x-pack/plugins/security_solution/cypress/objects/rule.ts
@@ -11,6 +11,8 @@ export const totalNumberOfPrebuiltRules = rawRules.length;
 
 export const totalNumberOfPrebuiltRulesInEsArchive = 127;
 
+export const totalNumberOfPrebuiltRulesInEsArchiveCustomRule = 145;
+
 interface Mitre {
   tactic: string;
   techniques: string[];
@@ -57,7 +59,7 @@ const mitre2: Mitre = {
 };
 
 export const newRule: CustomRule = {
-  customQuery: 'host.name: *',
+  customQuery: 'host.name: * ',
   name: 'New Rule Test',
   description: 'The new rule description.',
   severity: 'High',
@@ -67,7 +69,7 @@ export const newRule: CustomRule = {
   falsePositivesExamples: ['False1', 'False2'],
   mitre: [mitre1, mitre2],
   note: '# test markdown',
-  timelineId: '352c6110-9ffb-11ea-b3d8-857d6042d9bd',
+  timelineId: '3270f530-bc84-11ea-b73f-89980a6a1ce7',
 };
 
 export const machineLearningRule: MachineLearningRule = {
diff --git a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/data.json.gz b/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/data.json.gz
index 3d50451cee39f..b3a94c77c1184 100644
Binary files a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/data.json.gz and b/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/data.json.gz differ
diff --git a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/mappings.json b/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/mappings.json
index 693878a88f899..01a768351e483 100644
--- a/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/mappings.json
+++ b/x-pack/test/security_solution_cypress/es_archives/custom_rule_with_timeline/mappings.json
@@ -14,36 +14,39 @@
           "alert": "7b44fba6773e37c806ce290ea9b7024e",
           "apm-indices": "9bb9b2bf1fa636ed8619cbab5ce6a1dd",
           "apm-telemetry": "3525d7c22c42bc80f5e6e9cb3f2b26a2",
-          "application_usage_totals": "c897e4310c5f24b07caaff3db53ae2c1",
-          "application_usage_transactional": "965839e75f809fefe04f92dc4d99722a",
+          "application_usage_totals": "3d1b76c39bfb2cc8296b024d73854724",
+          "application_usage_transactional": "43b8830d5d0df85a6823d290885fc9fd",
           "canvas-element": "7390014e1091044523666d97247392fc",
           "canvas-workpad": "b0a1706d356228dbdcb4a17e6b9eb231",
+          "canvas-workpad-template": "ae2673f678281e2c055d764b153e9715",
           "cases": "32aa96a6d3855ddda53010ae2048ac22",
           "cases-comments": "c2061fb929f585df57425102fa928b4b",
           "cases-configure": "42711cbb311976c0687853f4c1354572",
           "cases-user-actions": "32277330ec6b721abe3b846cfd939a71",
-          "config": "ae24d22d5986d04124cc6568f771066f",
+          "config": "c63748b75f39d0c54de12d12c1ccbc20",
           "dashboard": "d00f614b29a80360e1190193fd333bab",
-          "epm-packages": "92b4b1899b887b090d01c033f3118a85",
+          "endpoint:exceptions-artifact": "053713a6b91811c7de078ead17384914",
+          "endpoint:exceptions-manifest": "67c28185da541c1404e7852d30498cd6",
+          "epm-packages": "04696e7dba1b9597f7d6ed78a4a76658",
           "file-upload-telemetry": "0ed4d3e1983d1217a30982630897092e",
-          "fleet-agent-actions": "e520c855577170c24481be05c3ae14ec",
+          "fleet-agent-actions": "00fe5651ed2da16b7f8159bbf0f7d910",
           "fleet-agent-events": "3231653fafe4ef3196fe3b32ab774bf2",
-          "fleet-agents": "864760267df6c970f629bd4458506c53",
-          "fleet-enrollment-api-keys": "28b91e20b105b6f928e2012600085d8f",
+          "fleet-agents": "578bbfa81650206927683ebde0c85409",
+          "fleet-enrollment-api-keys": "451e5c329b3ae9722dc7bc8f5921e05d",
           "graph-workspace": "cd7ba1330e6682e9cc00b78850874be1",
           "index-pattern": "66eccb05066c5a89924f48a9e9736499",
-          "infrastructure-ui-source": "ddc0ecb18383f6b26101a2fadb2dab0c",
-          "ingest-agent-configs": "d9a5cbdce8e937f674a7b376c47a34a1",
-          "ingest-package-configs": "c0fe6347b0eebcbf421841669e3acd31",
-          "ingest-outputs": "0e57221778a7153c8292edf154099036",
+          "infrastructure-ui-source": "2b2809653635caf490c93f090502d04c",
+          "ingest-agent-configs": "f1e09bc73462386a8c07e9d1997d0688",
+          "ingest-outputs": "87da6a0e27b3a61ad389fb7a7e2da293",
+          "ingest-package-configs": "48e8bd97e488008e21c0b5a2367b83ad",
           "ingest_manager_settings": "c5b0749b4ab03c582efd4c14cb8f132c",
           "inventory-view": "88fc7e12fd1b45b6f0787323ce4f18d2",
           "kql-telemetry": "d12a98a6f19a2d273696597547e064ee",
-          "lens": "21c3ea0763beb1ecb0162529706b88c5",
+          "lens": "d33c68a69ff1e78c9888dedd2164ac22",
           "lens-ui-telemetry": "509bfa5978586998e05f9e303c07a327",
-          "map": "23d7aa4a720d4938ccde3983f87bd58d",
-          "maps-telemetry": "bfd39d88aadadb4be597ea984d433dbe",
-          "metrics-explorer-view": "428e319af3e822c80a84cf87123ca35c",
+          "map": "4a05b35c3a3a58fbc72dd0202dc3487f",
+          "maps-telemetry": "5ef305b18111b77789afefbd36b66171",
+          "metrics-explorer-view": "a8df1d270ee48c969d22d23812d08187",
           "migrationVersion": "4a1746014a75ade3a714e1db5763276f",
           "ml-telemetry": "257fd1d4b4fdbb9cb4b8a3b27da201e9",
           "namespace": "2f4316de49999235636386fe51dc06c1",
@@ -67,7 +70,7 @@
           "upgrade-assistant-reindex-operation": "296a89039fc4260292be36b1b005d8f2",
           "upgrade-assistant-telemetry": "56702cec857e0a9dacfb696655b4ff7b",
           "uptime-dynamic-settings": "fcdb453a30092f022f2642db29523d80",
-          "url": "b675c3be8d76ecf029294d51dc7ec65d",
+          "url": "c7f66a0df8b1b52f17c28c4adb111105",
           "visualization": "52d7a13ad68a150c4525b292d23e12cc"
         }
       },
@@ -109,145 +112,6 @@
             }
           }
         },
-        "agent_actions": {
-          "properties": {
-            "agent_id": {
-              "type": "keyword"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "data": {
-              "type": "flattened"
-            },
-            "sent_at": {
-              "type": "date"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "agent_configs": {
-          "properties": {
-            "datasources": {
-              "type": "keyword"
-            },
-            "description": {
-              "type": "text"
-            },
-            "id": {
-              "type": "keyword"
-            },
-            "is_default": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "text"
-            },
-            "namespace": {
-              "type": "keyword"
-            },
-            "revision": {
-              "type": "integer"
-            },
-            "status": {
-              "type": "keyword"
-            },
-            "updated_by": {
-              "type": "keyword"
-            },
-            "updated_on": {
-              "type": "keyword"
-            }
-          }
-        },
-        "agent_events": {
-          "properties": {
-            "action_id": {
-              "type": "keyword"
-            },
-            "agent_id": {
-              "type": "keyword"
-            },
-            "config_id": {
-              "type": "keyword"
-            },
-            "data": {
-              "type": "text"
-            },
-            "message": {
-              "type": "text"
-            },
-            "payload": {
-              "type": "text"
-            },
-            "stream_id": {
-              "type": "keyword"
-            },
-            "subtype": {
-              "type": "keyword"
-            },
-            "timestamp": {
-              "type": "date"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "agents": {
-          "properties": {
-            "access_api_key_id": {
-              "type": "keyword"
-            },
-            "active": {
-              "type": "boolean"
-            },
-            "config_id": {
-              "type": "keyword"
-            },
-            "config_newest_revision": {
-              "type": "integer"
-            },
-            "config_revision": {
-              "type": "integer"
-            },
-            "current_error_events": {
-              "type": "text"
-            },
-            "default_api_key": {
-              "type": "keyword"
-            },
-            "enrolled_at": {
-              "type": "date"
-            },
-            "last_checkin": {
-              "type": "date"
-            },
-            "last_updated": {
-              "type": "date"
-            },
-            "local_metadata": {
-              "type": "text"
-            },
-            "shared_id": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            },
-            "updated_at": {
-              "type": "date"
-            },
-            "user_provided_metadata": {
-              "type": "text"
-            },
-            "version": {
-              "type": "keyword"
-            }
-          }
-        },
         "alert": {
           "properties": {
             "actions": {
@@ -1264,29 +1128,12 @@
           }
         },
         "application_usage_totals": {
-          "properties": {
-            "appId": {
-              "type": "keyword"
-            },
-            "minutesOnScreen": {
-              "type": "float"
-            },
-            "numberOfClicks": {
-              "type": "long"
-            }
-          }
+          "dynamic": "false",
+          "type": "object"
         },
         "application_usage_transactional": {
+          "dynamic": "false",
           "properties": {
-            "appId": {
-              "type": "keyword"
-            },
-            "minutesOnScreen": {
-              "type": "float"
-            },
-            "numberOfClicks": {
-              "type": "long"
-            },
             "timestamp": {
               "type": "date"
             }
@@ -1339,6 +1186,38 @@
             }
           }
         },
+        "canvas-workpad-template": {
+          "dynamic": "false",
+          "properties": {
+            "help": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "name": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "tags": {
+              "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              },
+              "type": "text"
+            },
+            "template_key": {
+              "type": "keyword"
+            }
+          }
+        },
         "cases": {
           "properties": {
             "closed_at": {
@@ -1574,7 +1453,7 @@
           }
         },
         "config": {
-          "dynamic": "true",
+          "dynamic": "false",
           "properties": {
             "buildNum": {
               "type": "keyword"
@@ -1635,163 +1514,70 @@
             }
           }
         },
-        "datasources": {
+        "endpoint:exceptions-artifact": {
           "properties": {
-            "config_id": {
+            "body": {
+              "type": "binary"
+            },
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "encoding": {
+              "index": false,
               "type": "keyword"
             },
-            "description": {
-              "type": "text"
+            "identifier": {
+              "type": "keyword"
             },
-            "enabled": {
-              "type": "boolean"
+            "sha256": {
+              "type": "keyword"
             },
-            "inputs": {
+            "size": {
+              "index": false,
+              "type": "long"
+            }
+          }
+        },
+        "endpoint:exceptions-manifest": {
+          "properties": {
+            "created": {
+              "index": false,
+              "type": "date"
+            },
+            "ids": {
+              "index": false,
+              "type": "keyword"
+            }
+          }
+        },
+        "epm-packages": {
+          "properties": {
+            "es_index_patterns": {
+              "enabled": false,
+              "type": "object"
+            },
+            "installed": {
               "properties": {
-                "config": {
-                  "type": "flattened"
-                },
-                "enabled": {
-                  "type": "boolean"
-                },
-                "processors": {
+                "id": {
                   "type": "keyword"
                 },
-                "streams": {
-                  "properties": {
-                    "config": {
-                      "type": "flattened"
-                    },
-                    "dataset": {
-                      "type": "keyword"
-                    },
-                    "enabled": {
-                      "type": "boolean"
-                    },
-                    "id": {
-                      "type": "keyword"
-                    },
-                    "processors": {
-                      "type": "keyword"
-                    }
-                  },
-                  "type": "nested"
-                },
                 "type": {
                   "type": "keyword"
                 }
               },
               "type": "nested"
             },
+            "internal": {
+              "type": "boolean"
+            },
             "name": {
               "type": "keyword"
             },
-            "namespace": {
-              "type": "keyword"
+            "removable": {
+              "type": "boolean"
             },
-            "output_id": {
-              "type": "keyword"
-            },
-            "package": {
-              "properties": {
-                "name": {
-                  "type": "keyword"
-                },
-                "title": {
-                  "type": "keyword"
-                },
-                "version": {
-                  "type": "keyword"
-                }
-              }
-            },
-            "revision": {
-              "type": "integer"
-            }
-          }
-        },
-        "enrollment_api_keys": {
-          "properties": {
-            "active": {
-              "type": "boolean"
-            },
-            "api_key": {
-              "type": "binary"
-            },
-            "api_key_id": {
-              "type": "keyword"
-            },
-            "config_id": {
-              "type": "keyword"
-            },
-            "created_at": {
-              "type": "date"
-            },
-            "expire_at": {
-              "type": "date"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            },
-            "updated_at": {
-              "type": "date"
-            }
-          }
-        },
-        "epm-package": {
-          "properties": {
-            "installed": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "internal": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "version": {
-              "type": "keyword"
-            }
-          }
-        },
-        "epm-packages": {
-          "properties": {
-            "es_index_patterns": {
-              "dynamic": "false",
-              "type": "object"
-            },
-            "installed": {
-              "properties": {
-                "id": {
-                  "type": "keyword"
-                },
-                "type": {
-                  "type": "keyword"
-                }
-              },
-              "type": "nested"
-            },
-            "internal": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "removable": {
-              "type": "boolean"
-            },
-            "version": {
+            "version": {
               "type": "keyword"
             }
           }
@@ -1874,10 +1660,11 @@
               "type": "integer"
             },
             "current_error_events": {
+              "index": false,
               "type": "text"
             },
             "default_api_key": {
-              "type": "keyword"
+              "type": "binary"
             },
             "default_api_key_id": {
               "type": "keyword"
@@ -1894,6 +1681,9 @@
             "local_metadata": {
               "type": "flattened"
             },
+            "packages": {
+              "type": "keyword"
+            },
             "shared_id": {
               "type": "keyword"
             },
@@ -2026,6 +1816,9 @@
                 }
               }
             },
+            "inventoryDefaultView": {
+              "type": "keyword"
+            },
             "logAlias": {
               "type": "keyword"
             },
@@ -2061,6 +1854,9 @@
             "metricAlias": {
               "type": "keyword"
             },
+            "metricsExplorerDefaultView": {
+              "type": "keyword"
+            },
             "name": {
               "type": "text"
             }
@@ -2068,9 +1864,6 @@
         },
         "ingest-agent-configs": {
           "properties": {
-            "datasources": {
-              "type": "keyword"
-            },
             "description": {
               "type": "text"
             },
@@ -2081,6 +1874,7 @@
               "type": "boolean"
             },
             "monitoring_enabled": {
+              "index": false,
               "type": "keyword"
             },
             "name": {
@@ -2089,6 +1883,9 @@
             "namespace": {
               "type": "keyword"
             },
+            "package_configs": {
+              "type": "keyword"
+            },
             "revision": {
               "type": "integer"
             },
@@ -2103,6 +1900,35 @@
             }
           }
         },
+        "ingest-outputs": {
+          "properties": {
+            "ca_sha256": {
+              "index": false,
+              "type": "keyword"
+            },
+            "config": {
+              "type": "flattened"
+            },
+            "fleet_enroll_password": {
+              "type": "binary"
+            },
+            "fleet_enroll_username": {
+              "type": "binary"
+            },
+            "hosts": {
+              "type": "keyword"
+            },
+            "is_default": {
+              "type": "boolean"
+            },
+            "name": {
+              "type": "keyword"
+            },
+            "type": {
+              "type": "keyword"
+            }
+          }
+        },
         "ingest-package-configs": {
           "properties": {
             "config_id": {
@@ -2121,6 +1947,7 @@
               "type": "boolean"
             },
             "inputs": {
+              "enabled": false,
               "properties": {
                 "config": {
                   "type": "flattened"
@@ -2128,19 +1955,23 @@
                 "enabled": {
                   "type": "boolean"
                 },
-                "processors": {
-                  "type": "keyword"
-                },
                 "streams": {
                   "properties": {
-                    "agent_stream": {
+                    "compiled_stream": {
                       "type": "flattened"
                     },
                     "config": {
                       "type": "flattened"
                     },
                     "dataset": {
-                      "type": "keyword"
+                      "properties": {
+                        "name": {
+                          "type": "keyword"
+                        },
+                        "type": {
+                          "type": "keyword"
+                        }
+                      }
                     },
                     "enabled": {
                       "type": "boolean"
@@ -2148,9 +1979,6 @@
                     "id": {
                       "type": "keyword"
                     },
-                    "processors": {
-                      "type": "keyword"
-                    },
                     "vars": {
                       "type": "flattened"
                     }
@@ -2199,34 +2027,6 @@
             }
           }
         },
-        "ingest-outputs": {
-          "properties": {
-            "ca_sha256": {
-              "type": "keyword"
-            },
-            "config": {
-              "type": "flattened"
-            },
-            "fleet_enroll_password": {
-              "type": "binary"
-            },
-            "fleet_enroll_username": {
-              "type": "binary"
-            },
-            "hosts": {
-              "type": "keyword"
-            },
-            "is_default": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
         "ingest_manager_settings": {
           "properties": {
             "agent_auto_upgrade": {
@@ -2387,6 +2187,9 @@
         },
         "lens": {
           "properties": {
+            "description": {
+              "type": "text"
+            },
             "expression": {
               "index": false,
               "type": "keyword"
@@ -2420,9 +2223,6 @@
         },
         "map": {
           "properties": {
-            "bounds": {
-              "type": "geo_shape"
-            },
             "description": {
               "type": "text"
             },
@@ -2444,68 +2244,8 @@
           }
         },
         "maps-telemetry": {
-          "properties": {
-            "attributesPerMap": {
-              "properties": {
-                "dataSourcesCount": {
-                  "properties": {
-                    "avg": {
-                      "type": "long"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "min": {
-                      "type": "long"
-                    }
-                  }
-                },
-                "emsVectorLayersCount": {
-                  "dynamic": "true",
-                  "type": "object"
-                },
-                "layerTypesCount": {
-                  "dynamic": "true",
-                  "type": "object"
-                },
-                "layersCount": {
-                  "properties": {
-                    "avg": {
-                      "type": "long"
-                    },
-                    "max": {
-                      "type": "long"
-                    },
-                    "min": {
-                      "type": "long"
-                    }
-                  }
-                }
-              }
-            },
-            "indexPatternsWithGeoFieldCount": {
-              "type": "long"
-            },
-            "indexPatternsWithGeoPointFieldCount": {
-              "type": "long"
-            },
-            "indexPatternsWithGeoShapeFieldCount": {
-              "type": "long"
-            },
-            "mapsTotalCount": {
-              "type": "long"
-            },
-            "settings": {
-              "properties": {
-                "showMapVisualizationTypes": {
-                  "type": "boolean"
-                }
-              }
-            },
-            "timeCaptured": {
-              "type": "date"
-            }
-          }
+          "enabled": false,
+          "type": "object"
         },
         "metrics-explorer-view": {
           "properties": {
@@ -2571,6 +2311,9 @@
                     }
                   },
                   "type": "nested"
+                },
+                "source": {
+                  "type": "keyword"
                 }
               }
             }
@@ -2579,7 +2322,7 @@
         "migrationVersion": {
           "dynamic": "true",
           "properties": {
-            "dashboard": {
+            "alert": {
               "fields": {
                 "keyword": {
                   "ignore_above": 256,
@@ -2588,7 +2331,7 @@
               },
               "type": "text"
             },
-            "index-pattern": {
+            "config": {
               "fields": {
                 "keyword": {
                   "ignore_above": 256,
@@ -2597,7 +2340,7 @@
               },
               "type": "text"
             },
-            "ingest-agent-configs": {
+            "dashboard": {
               "fields": {
                 "keyword": {
                   "ignore_above": 256,
@@ -2606,7 +2349,7 @@
               },
               "type": "text"
             },
-            "ingest-package-configs": {
+            "index-pattern": {
               "fields": {
                 "keyword": {
                   "ignore_above": 256,
@@ -2670,45 +2413,14 @@
         "namespaces": {
           "type": "keyword"
         },
-        "outputs": {
+        "query": {
           "properties": {
-            "api_key": {
-              "type": "keyword"
-            },
-            "ca_sha256": {
-              "type": "keyword"
-            },
-            "config": {
-              "type": "flattened"
-            },
-            "fleet_enroll_password": {
-              "type": "binary"
+            "description": {
+              "type": "text"
             },
-            "fleet_enroll_username": {
-              "type": "binary"
-            },
-            "hosts": {
-              "type": "keyword"
-            },
-            "is_default": {
-              "type": "boolean"
-            },
-            "name": {
-              "type": "keyword"
-            },
-            "type": {
-              "type": "keyword"
-            }
-          }
-        },
-        "query": {
-          "properties": {
-            "description": {
-              "type": "text"
-            },
-            "filters": {
-              "enabled": false,
-              "type": "object"
+            "filters": {
+              "enabled": false,
+              "type": "object"
             },
             "query": {
               "properties": {
@@ -2784,6 +2496,7 @@
           }
         },
         "server": {
+          "dynamic": "strict",
           "properties": {
             "uuid": {
               "type": "keyword"
@@ -3208,6 +2921,9 @@
             }
           }
         },
+        "spaceId": {
+          "type": "keyword"
+        },
         "telemetry": {
           "properties": {
             "allowChangingOptInStatus": {
@@ -3424,6 +3140,7 @@
             "url": {
               "fields": {
                 "keyword": {
+                  "ignore_above": 2048,
                   "type": "keyword"
                 }
               },
@@ -3489,14 +3206,6 @@
         },
         "agent": {
           "properties": {
-            "build": {
-              "properties": {
-                "original": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
             "ephemeral_id": {
               "ignore_above": 1024,
               "type": "keyword"
@@ -3519,6 +3228,27 @@
             }
           }
         },
+        "as": {
+          "properties": {
+            "number": {
+              "type": "long"
+            },
+            "organization": {
+              "properties": {
+                "name": {
+                  "fields": {
+                    "text": {
+                      "norms": false,
+                      "type": "text"
+                    }
+                  },
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            }
+          }
+        },
         "client": {
           "properties": {
             "address": {
@@ -3684,10 +3414,6 @@
                 "id": {
                   "ignore_above": 1024,
                   "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
                 }
               }
             },
@@ -3715,18 +3441,6 @@
                 }
               }
             },
-            "project": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
             "provider": {
               "ignore_above": 1024,
               "type": "keyword"
@@ -3737,6 +3451,27 @@
             }
           }
         },
+        "code_signature": {
+          "properties": {
+            "exists": {
+              "type": "boolean"
+            },
+            "status": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "subject_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "trusted": {
+              "type": "boolean"
+            },
+            "valid": {
+              "type": "boolean"
+            }
+          }
+        },
         "container": {
           "properties": {
             "id": {
@@ -3949,9 +3684,6 @@
                 }
               }
             },
-            "compile_time": {
-              "type": "date"
-            },
             "hash": {
               "properties": {
                 "md5": {
@@ -3972,53 +3704,6 @@
                 }
               }
             },
-            "malware_classification": {
-              "properties": {
-                "features": {
-                  "properties": {
-                    "data": {
-                      "properties": {
-                        "buffer": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "decompressed_size": {
-                          "type": "integer"
-                        },
-                        "encoding": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "identifier": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "score": {
-                  "type": "double"
-                },
-                "threshold": {
-                  "type": "double"
-                },
-                "upx_packed": {
-                  "type": "boolean"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "mapped_address": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "mapped_size": {
-              "type": "long"
-            },
             "name": {
               "ignore_above": 1024,
               "type": "keyword"
@@ -4029,10 +3714,6 @@
             },
             "pe": {
               "properties": {
-                "architecture": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "company": {
                   "ignore_above": 1024,
                   "type": "keyword"
@@ -4045,10 +3726,6 @@
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "imphash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "original_file_name": {
                   "ignore_above": 1024,
                   "type": "keyword"
@@ -4147,46 +3824,6 @@
             }
           }
         },
-        "endpoint": {
-          "properties": {
-            "artifact": {
-              "properties": {
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "event": {
-              "properties": {
-                "process": {
-                  "properties": {
-                    "ancestry": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "policy": {
-              "properties": {
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
         "error": {
           "properties": {
             "code": {
@@ -4360,9 +3997,6 @@
               "ignore_above": 1,
               "type": "keyword"
             },
-            "entry_modified": {
-              "type": "double"
-            },
             "extension": {
               "ignore_above": 1024,
               "type": "keyword"
@@ -4399,352 +4033,114 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "macro": {
+            "mime_type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mode": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "mtime": {
+              "type": "date"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "owner": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "pe": {
               "properties": {
-                "code_page": {
-                  "type": "long"
-                },
-                "collection": {
-                  "properties": {
-                    "hash": {
-                      "properties": {
-                        "md5": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha1": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha256": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha512": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
+                "company": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
                 },
-                "errors": {
-                  "properties": {
-                    "count": {
-                      "type": "long"
-                    },
-                    "error_type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  },
-                  "type": "nested"
+                "description": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
                 },
-                "file_extension": {
+                "file_version": {
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "project_file": {
-                  "properties": {
-                    "hash": {
-                      "properties": {
-                        "md5": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha1": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha256": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha512": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
+                "original_file_name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
                 },
-                "stream": {
-                  "properties": {
-                    "hash": {
-                      "properties": {
-                        "md5": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha1": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha256": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha512": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "raw_code": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "raw_code_size": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  },
-                  "type": "nested"
-                }
-              }
-            },
-            "malware_classification": {
-              "properties": {
-                "features": {
-                  "properties": {
-                    "data": {
-                      "properties": {
-                        "buffer": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "decompressed_size": {
-                          "type": "integer"
-                        },
-                        "encoding": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "identifier": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "score": {
-                  "type": "double"
-                },
-                "threshold": {
-                  "type": "double"
-                },
-                "upx_packed": {
-                  "type": "boolean"
-                },
-                "version": {
+                "product": {
                   "ignore_above": 1024,
                   "type": "keyword"
                 }
               }
             },
-            "mime_type": {
+            "size": {
+              "type": "long"
+            },
+            "target_path": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "mode": {
+            "type": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "mtime": {
-              "type": "date"
-            },
-            "name": {
+            "uid": {
               "ignore_above": 1024,
               "type": "keyword"
-            },
-            "owner": {
+            }
+          }
+        },
+        "geo": {
+          "properties": {
+            "city_name": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
+            "continent_name": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "pe": {
-              "properties": {
-                "architecture": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "company": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "description": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "file_version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "imphash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "original_file_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "product": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "quarantine_path": {
+            "country_iso_code": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "quarantine_result": {
-              "type": "boolean"
-            },
-            "size": {
-              "type": "long"
-            },
-            "target_path": {
-              "fields": {
-                "text": {
-                  "norms": false,
-                  "type": "text"
-                }
-              },
+            "country_name": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "temp_file_path": {
+            "location": {
+              "type": "geo_point"
+            },
+            "name": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "type": {
+            "region_iso_code": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "uid": {
+            "region_name": {
               "ignore_above": 1024,
               "type": "keyword"
-            },
-            "x509": {
-              "properties": {
-                "alternative_names": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "issuer": {
-                  "properties": {
-                    "common_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "country": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "distinguished_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "locality": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "organization": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "organizational_unit": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "state_or_province": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "not_after": {
-                  "type": "date"
-                },
-                "not_before": {
-                  "type": "date"
-                },
-                "public_key_algorithm": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "public_key_curve": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "public_key_exponent": {
-                  "doc_values": false,
-                  "index": false,
-                  "type": "long"
-                },
-                "public_key_size": {
-                  "type": "long"
-                },
-                "serial_number": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "signature_algorithm": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "subject": {
-                  "properties": {
-                    "common_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "country": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "distinguished_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "locality": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "organization": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "organizational_unit": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "state_or_province": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "version_number": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
             }
           }
         },
@@ -4764,6 +4160,26 @@
             }
           }
         },
+        "hash": {
+          "properties": {
+            "md5": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha1": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha256": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "sha512": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
         "host": {
           "properties": {
             "architecture": {
@@ -4862,10 +4278,6 @@
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "variant": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "version": {
                   "ignore_above": 1024,
                   "type": "keyword"
@@ -4995,10 +4407,6 @@
                 },
                 "status_code": {
                   "type": "long"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
                 }
               }
             },
@@ -5008,19 +4416,27 @@
             }
           }
         },
+        "interface": {
+          "properties": {
+            "alias": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
         "labels": {
           "type": "object"
         },
         "log": {
           "properties": {
-            "file": {
-              "properties": {
-                "path": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
             "level": {
               "ignore_above": 1024,
               "type": "keyword"
@@ -5320,10 +4736,6 @@
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "variant": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "version": {
                   "ignore_above": 1024,
                   "type": "keyword"
@@ -5370,21 +4782,61 @@
             }
           }
         },
-        "package": {
+        "os": {
           "properties": {
-            "architecture": {
+            "family": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "build_version": {
+            "full": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "checksum": {
+            "kernel": {
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "description": {
+            "name": {
+              "fields": {
+                "text": {
+                  "norms": false,
+                  "type": "text"
+                }
+              },
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "platform": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "build_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "checksum": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
               "ignore_above": 1024,
               "type": "keyword"
             },
@@ -5424,6 +4876,30 @@
             }
           }
         },
+        "pe": {
+          "properties": {
+            "company": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "description": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "file_version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "original_file_name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "product": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
         "process": {
           "properties": {
             "args": {
@@ -5501,46 +4977,6 @@
                 }
               }
             },
-            "malware_classification": {
-              "properties": {
-                "features": {
-                  "properties": {
-                    "data": {
-                      "properties": {
-                        "buffer": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "decompressed_size": {
-                          "type": "integer"
-                        },
-                        "encoding": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    }
-                  }
-                },
-                "identifier": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "score": {
-                  "type": "double"
-                },
-                "threshold": {
-                  "type": "double"
-                },
-                "upx_packed": {
-                  "type": "boolean"
-                },
-                "version": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
             "name": {
               "fields": {
                 "text": {
@@ -5688,10 +5124,6 @@
             },
             "pe": {
               "properties": {
-                "architecture": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "company": {
                   "ignore_above": 1024,
                   "type": "keyword"
@@ -5704,10 +5136,6 @@
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "imphash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "original_file_name": {
                   "ignore_above": 1024,
                   "type": "keyword"
@@ -5727,132 +5155,17 @@
             "ppid": {
               "type": "long"
             },
-            "services": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
             "start": {
               "type": "date"
             },
             "thread": {
               "properties": {
-                "call_stack": {
-                  "properties": {
-                    "instruction_pointer": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "memory_section": {
-                      "properties": {
-                        "address": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "protection": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "size": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "module_path": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "rva": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "symbol_info": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
                 "id": {
                   "type": "long"
                 },
                 "name": {
                   "ignore_above": 1024,
                   "type": "keyword"
-                },
-                "service": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "start_address": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "start_address_module": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "token": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "elevation": {
-                      "type": "boolean"
-                    },
-                    "elevation_type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "impersonation_level": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "integrity_level": {
-                      "type": "long"
-                    },
-                    "integrity_level_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "is_appcontainer": {
-                      "type": "boolean"
-                    },
-                    "privileges": {
-                      "properties": {
-                        "description": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "enabled": {
-                          "type": "boolean"
-                        },
-                        "name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      },
-                      "type": "nested"
-                    },
-                    "sid": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "user": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "uptime": {
-                  "type": "long"
                 }
               }
             },
@@ -5866,70 +5179,9 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
-            "token": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "elevation": {
-                  "type": "boolean"
-                },
-                "elevation_type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "impersonation_level": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "integrity_level": {
-                  "type": "long"
-                },
-                "integrity_level_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "is_appcontainer": {
-                  "type": "boolean"
-                },
-                "privileges": {
-                  "properties": {
-                    "description": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "enabled": {
-                      "type": "boolean"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  },
-                  "type": "nested"
-                },
-                "sid": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "type": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "user": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
             "uptime": {
               "type": "long"
             },
-            "user": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
             "working_directory": {
               "fields": {
                 "text": {
@@ -6342,6 +5594,12 @@
             },
             "rule": {
               "properties": {
+                "author": {
+                  "type": "keyword"
+                },
+                "building_block_type": {
+                  "type": "keyword"
+                },
                 "created_at": {
                   "type": "date"
                 },
@@ -6378,6 +5636,9 @@
                 "language": {
                   "type": "keyword"
                 },
+                "license": {
+                  "type": "keyword"
+                },
                 "max_signals": {
                   "type": "keyword"
                 },
@@ -6399,28 +5660,60 @@
                 "risk_score": {
                   "type": "keyword"
                 },
-                "rule_id": {
-                  "type": "keyword"
+                "risk_score_mapping": {
+                  "properties": {
+                    "field": {
+                      "type": "keyword"
+                    },
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "keyword"
+                    }
+                  }
                 },
-                "saved_id": {
+                "rule_id": {
                   "type": "keyword"
                 },
-                "severity": {
+                "rule_name_override": {
                   "type": "keyword"
                 },
-                "size": {
+                "saved_id": {
                   "type": "keyword"
                 },
-                "tags": {
+                "severity": {
                   "type": "keyword"
                 },
-                "threat": {
+                "severity_mapping": {
                   "properties": {
-                    "framework": {
+                    "field": {
                       "type": "keyword"
                     },
-                    "tactic": {
-                      "properties": {
+                    "operator": {
+                      "type": "keyword"
+                    },
+                    "severity": {
+                      "type": "keyword"
+                    },
+                    "value": {
+                      "type": "keyword"
+                    }
+                  }
+                },
+                "size": {
+                  "type": "keyword"
+                },
+                "tags": {
+                  "type": "keyword"
+                },
+                "threat": {
+                  "properties": {
+                    "framework": {
+                      "type": "keyword"
+                    },
+                    "tactic": {
+                      "properties": {
                         "id": {
                           "type": "keyword"
                         },
@@ -6453,6 +5746,9 @@
                 "timeline_title": {
                   "type": "keyword"
                 },
+                "timestamp_override": {
+                  "type": "keyword"
+                },
                 "to": {
                   "type": "keyword"
                 },
@@ -6539,674 +5835,53 @@
                   "type": "keyword"
                 },
                 "region_name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            },
-            "ip": {
-              "type": "ip"
-            },
-            "mac": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "nat": {
-              "properties": {
-                "ip": {
-                  "type": "ip"
-                },
-                "port": {
-                  "type": "long"
-                }
-              }
-            },
-            "packets": {
-              "type": "long"
-            },
-            "port": {
-              "type": "long"
-            },
-            "registered_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "top_level_domain": {
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
-            "user": {
-              "properties": {
-                "domain": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "email": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "full_name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "group": {
-                  "properties": {
-                    "domain": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "hash": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                }
-              }
-            }
-          }
-        },
-        "tags": {
-          "ignore_above": 1024,
-          "type": "keyword"
-        },
-        "target": {
-          "properties": {
-            "dll": {
-              "properties": {
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "compile_time": {
-                  "type": "date"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "malware_classification": {
-                  "properties": {
-                    "features": {
-                      "properties": {
-                        "data": {
-                          "properties": {
-                            "buffer": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "decompressed_size": {
-                              "type": "integer"
-                            },
-                            "encoding": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "identifier": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "score": {
-                      "type": "double"
-                    },
-                    "threshold": {
-                      "type": "double"
-                    },
-                    "upx_packed": {
-                      "type": "boolean"
-                    },
-                    "version": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "mapped_address": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "mapped_size": {
-                  "type": "long"
-                },
-                "name": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "path": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "pe": {
-                  "properties": {
-                    "architecture": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "company": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "description": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "file_version": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "imphash": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "original_file_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "product": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                }
-              }
-            },
-            "process": {
-              "properties": {
-                "args": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "args_count": {
-                  "type": "long"
-                },
-                "code_signature": {
-                  "properties": {
-                    "exists": {
-                      "type": "boolean"
-                    },
-                    "status": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "trusted": {
-                      "type": "boolean"
-                    },
-                    "valid": {
-                      "type": "boolean"
-                    }
-                  }
-                },
-                "command_line": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "entity_id": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "executable": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "exit_code": {
-                  "type": "long"
-                },
-                "hash": {
-                  "properties": {
-                    "md5": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha1": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha256": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "sha512": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "malware_classification": {
-                  "properties": {
-                    "features": {
-                      "properties": {
-                        "data": {
-                          "properties": {
-                            "buffer": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "decompressed_size": {
-                              "type": "integer"
-                            },
-                            "encoding": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "identifier": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "score": {
-                      "type": "double"
-                    },
-                    "threshold": {
-                      "type": "double"
-                    },
-                    "upx_packed": {
-                      "type": "boolean"
-                    },
-                    "version": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "name": {
-                  "fields": {
-                    "text": {
-                      "norms": false,
-                      "type": "text"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "parent": {
-                  "properties": {
-                    "args": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "args_count": {
-                      "type": "long"
-                    },
-                    "code_signature": {
-                      "properties": {
-                        "exists": {
-                          "type": "boolean"
-                        },
-                        "status": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "subject_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "trusted": {
-                          "type": "boolean"
-                        },
-                        "valid": {
-                          "type": "boolean"
-                        }
-                      }
-                    },
-                    "command_line": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "entity_id": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "executable": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "exit_code": {
-                      "type": "long"
-                    },
-                    "hash": {
-                      "properties": {
-                        "md5": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha1": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha256": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "sha512": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "name": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "pgid": {
-                      "type": "long"
-                    },
-                    "pid": {
-                      "type": "long"
-                    },
-                    "ppid": {
-                      "type": "long"
-                    },
-                    "start": {
-                      "type": "date"
-                    },
-                    "thread": {
-                      "properties": {
-                        "id": {
-                          "type": "long"
-                        },
-                        "name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "title": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "uptime": {
-                      "type": "long"
-                    },
-                    "working_directory": {
-                      "fields": {
-                        "text": {
-                          "norms": false,
-                          "type": "text"
-                        }
-                      },
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "pe": {
-                  "properties": {
-                    "architecture": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "company": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "description": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "file_version": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "imphash": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "original_file_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "product": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
-                },
-                "pgid": {
-                  "type": "long"
-                },
-                "pid": {
-                  "type": "long"
-                },
-                "ppid": {
-                  "type": "long"
-                },
-                "services": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
-                "start": {
-                  "type": "date"
-                },
-                "thread": {
-                  "properties": {
-                    "call_stack": {
-                      "properties": {
-                        "instruction_pointer": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "memory_section": {
-                          "properties": {
-                            "address": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "protection": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "size": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          }
-                        },
-                        "module_path": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "rva": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "symbol_info": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "id": {
-                      "type": "long"
-                    },
-                    "name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "service": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "start": {
-                      "type": "date"
-                    },
-                    "start_address": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "start_address_module": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "token": {
-                      "properties": {
-                        "domain": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "elevation": {
-                          "type": "boolean"
-                        },
-                        "elevation_type": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "impersonation_level": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "integrity_level": {
-                          "type": "long"
-                        },
-                        "integrity_level_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "is_appcontainer": {
-                          "type": "boolean"
-                        },
-                        "privileges": {
-                          "properties": {
-                            "description": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            },
-                            "enabled": {
-                              "type": "boolean"
-                            },
-                            "name": {
-                              "ignore_above": 1024,
-                              "type": "keyword"
-                            }
-                          },
-                          "type": "nested"
-                        },
-                        "sid": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "type": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "user": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "uptime": {
-                      "type": "long"
-                    }
-                  }
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              }
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "nat": {
+              "properties": {
+                "ip": {
+                  "type": "ip"
                 },
-                "title": {
+                "port": {
+                  "type": "long"
+                }
+              }
+            },
+            "packets": {
+              "type": "long"
+            },
+            "port": {
+              "type": "long"
+            },
+            "registered_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "top_level_domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "user": {
+              "properties": {
+                "domain": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "email": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "full_name": {
                   "fields": {
                     "text": {
                       "norms": false,
@@ -7216,71 +5891,31 @@
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "token": {
+                "group": {
                   "properties": {
                     "domain": {
                       "ignore_above": 1024,
                       "type": "keyword"
                     },
-                    "elevation": {
-                      "type": "boolean"
-                    },
-                    "elevation_type": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "impersonation_level": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "integrity_level": {
-                      "type": "long"
-                    },
-                    "integrity_level_name": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "is_appcontainer": {
-                      "type": "boolean"
-                    },
-                    "privileges": {
-                      "properties": {
-                        "description": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "enabled": {
-                          "type": "boolean"
-                        },
-                        "name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      },
-                      "type": "nested"
-                    },
-                    "sid": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "type": {
+                    "id": {
                       "ignore_above": 1024,
                       "type": "keyword"
                     },
-                    "user": {
+                    "name": {
                       "ignore_above": 1024,
                       "type": "keyword"
                     }
                   }
                 },
-                "uptime": {
-                  "type": "long"
+                "hash": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
                 },
-                "user": {
+                "id": {
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "working_directory": {
+                "name": {
                   "fields": {
                     "text": {
                       "norms": false,
@@ -7294,6 +5929,10 @@
             }
           }
         },
+        "tags": {
+          "ignore_above": 1024,
+          "type": "keyword"
+        },
         "threat": {
           "properties": {
             "framework": {
@@ -7397,112 +6036,6 @@
                 "supported_ciphers": {
                   "ignore_above": 1024,
                   "type": "keyword"
-                },
-                "x509": {
-                  "properties": {
-                    "alternative_names": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "issuer": {
-                      "properties": {
-                        "common_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "country": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "distinguished_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "locality": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organization": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organizational_unit": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "state_or_province": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "not_after": {
-                      "type": "date"
-                    },
-                    "not_before": {
-                      "type": "date"
-                    },
-                    "public_key_algorithm": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "public_key_curve": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "public_key_exponent": {
-                      "doc_values": false,
-                      "index": false,
-                      "type": "long"
-                    },
-                    "public_key_size": {
-                      "type": "long"
-                    },
-                    "serial_number": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "signature_algorithm": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject": {
-                      "properties": {
-                        "common_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "country": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "distinguished_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "locality": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organization": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organizational_unit": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "state_or_province": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "version_number": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
                 }
               }
             },
@@ -7563,112 +6096,6 @@
                 "subject": {
                   "ignore_above": 1024,
                   "type": "keyword"
-                },
-                "x509": {
-                  "properties": {
-                    "alternative_names": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "issuer": {
-                      "properties": {
-                        "common_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "country": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "distinguished_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "locality": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organization": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organizational_unit": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "state_or_province": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "not_after": {
-                      "type": "date"
-                    },
-                    "not_before": {
-                      "type": "date"
-                    },
-                    "public_key_algorithm": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "public_key_curve": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "public_key_exponent": {
-                      "doc_values": false,
-                      "index": false,
-                      "type": "long"
-                    },
-                    "public_key_size": {
-                      "type": "long"
-                    },
-                    "serial_number": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "signature_algorithm": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    },
-                    "subject": {
-                      "properties": {
-                        "common_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "country": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "distinguished_name": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "locality": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organization": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "organizational_unit": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        },
-                        "state_or_province": {
-                          "ignore_above": 1024,
-                          "type": "keyword"
-                        }
-                      }
-                    },
-                    "version_number": {
-                      "ignore_above": 1024,
-                      "type": "keyword"
-                    }
-                  }
                 }
               }
             },
@@ -7879,10 +6306,6 @@
                   "ignore_above": 1024,
                   "type": "keyword"
                 },
-                "variant": {
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "version": {
                   "ignore_above": 1024,
                   "type": "keyword"
@@ -7895,6 +6318,18 @@
             }
           }
         },
+        "vlan": {
+          "properties": {
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
         "vulnerability": {
           "properties": {
             "category": {