Add new fields file.origin_referrer_url & file.origin_url

CHANGELOG.next.md

@@ -22,6 +22,7 @@ Thanks, you're awesome :-) -->
 * Advanced `process.io` and `process.tty` fields to GA. #2317
 * Added `threat.indicator.id`. #2324
 * Added `process.group` to generated schemas. #2335
+* Added `file.origin_referrer_url` and `file.origin_url` #2348
 
 #### Improvements
 

docs/fields/field-details.asciidoc

@@ -4334,6 +4334,38 @@ example: `example.png`
 
 // ===============================================================
 
+|
+[[field-file-origin-referrer-url]]
+<<field-file-origin-referrer-url, file.origin_referrer_url>>
+
+a| The URL of the webpage that linked to the file.
+
+type: keyword
+
+
+
+example: `https://example.com`
+
+| extended
+
+// ===============================================================
+
+|
+[[field-file-origin-url]]
+<<field-file-origin-url, file.origin_url>>
+
+a| The URL where the file is hosted.
+
+type: keyword
+
+
+
+example: `https://example.com/file.zip`
+
+| extended
+
+// ===============================================================
+
 |
 [[field-file-owner]]
 <<field-file-owner, file.owner>>

experimental/generated/beats/fields.ecs.yml

@@ -3019,6 +3019,20 @@
       ignore_above: 1024
       description: Name of the file including the extension, without the directory.
       example: example.png
+    - name: origin_referrer_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: The URL of the webpage that linked to the file.
+      example: https://example.com
+      default_field: false
+    - name: origin_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: The URL where the file is hosted.
+      example: https://example.com/file.zip
+      default_field: false
     - name: owner
       level: extended
       type: keyword
@@ -9657,6 +9671,20 @@
       description: Name of the file including the extension, without the directory.
       example: example.png
       default_field: false
+    - name: enrichments.indicator.file.origin_referrer_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: The URL of the webpage that linked to the file.
+      example: https://example.com
+      default_field: false
+    - name: enrichments.indicator.file.origin_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: The URL where the file is hosted.
+      example: https://example.com/file.zip
+      default_field: false
     - name: enrichments.indicator.file.owner
       level: extended
       type: keyword
@@ -11278,6 +11306,20 @@
       description: Name of the file including the extension, without the directory.
       example: example.png
       default_field: false
+    - name: indicator.file.origin_referrer_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: The URL of the webpage that linked to the file.
+      example: https://example.com
+      default_field: false
+    - name: indicator.file.origin_url
+      level: extended
+      type: keyword
+      ignore_above: 8192
+      description: The URL where the file is hosted.
+      example: https://example.com/file.zip
+      default_field: false
     - name: indicator.file.owner
       level: extended
       type: keyword

experimental/generated/csv/fields.csv

@@ -364,6 +364,8 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,file,file.mode,keyword,extended,,0640,Mode of the file in octal representation.
 8.12.0-dev+exp,true,file,file.mtime,date,extended,,,Last time the file content was modified.
 8.12.0-dev+exp,true,file,file.name,keyword,extended,,example.png,"Name of the file including the extension, without the directory."
+8.12.0-dev+exp,true,file,file.origin_referrer_url,keyword,extended,,https://example.com,The URL of the webpage that linked to the file.
+8.12.0-dev+exp,true,file,file.origin_url,keyword,extended,,https://example.com/file.zip,The URL where the file is hosted.
 8.12.0-dev+exp,true,file,file.owner,keyword,extended,,alice,File owner's username.
 8.12.0-dev+exp,true,file,file.path,keyword,extended,,/home/alice/example.png,"Full path to the file, including the file name."
 8.12.0-dev+exp,true,file,file.path.text,match_only_text,extended,,/home/alice/example.png,"Full path to the file, including the file name."
@@ -1230,6 +1232,8 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.mode,keyword,extended,,0640,Mode of the file in octal representation.
 8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.mtime,date,extended,,,Last time the file content was modified.
 8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.name,keyword,extended,,example.png,"Name of the file including the extension, without the directory."
+8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.origin_referrer_url,keyword,extended,,https://example.com,The URL of the webpage that linked to the file.
+8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.origin_url,keyword,extended,,https://example.com/file.zip,The URL where the file is hosted.
 8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.owner,keyword,extended,,alice,File owner's username.
 8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.path,keyword,extended,,/home/alice/example.png,"Full path to the file, including the file name."
 8.12.0-dev+exp,true,threat,threat.enrichments.indicator.file.path.text,match_only_text,extended,,/home/alice/example.png,"Full path to the file, including the file name."
@@ -1449,6 +1453,8 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,threat,threat.indicator.file.mode,keyword,extended,,0640,Mode of the file in octal representation.
 8.12.0-dev+exp,true,threat,threat.indicator.file.mtime,date,extended,,,Last time the file content was modified.
 8.12.0-dev+exp,true,threat,threat.indicator.file.name,keyword,extended,,example.png,"Name of the file including the extension, without the directory."
+8.12.0-dev+exp,true,threat,threat.indicator.file.origin_referrer_url,keyword,extended,,https://example.com,The URL of the webpage that linked to the file.
+8.12.0-dev+exp,true,threat,threat.indicator.file.origin_url,keyword,extended,,https://example.com/file.zip,The URL where the file is hosted.
 8.12.0-dev+exp,true,threat,threat.indicator.file.owner,keyword,extended,,alice,File owner's username.
 8.12.0-dev+exp,true,threat,threat.indicator.file.path,keyword,extended,,/home/alice/example.png,"Full path to the file, including the file name."
 8.12.0-dev+exp,true,threat,threat.indicator.file.path.text,match_only_text,extended,,/home/alice/example.png,"Full path to the file, including the file name."

experimental/generated/ecs/ecs_flat.yml

@@ -4966,6 +4966,28 @@ file.name:
   normalize: []
   short: Name of the file including the extension, without the directory.
   type: keyword
+file.origin_referrer_url:
+  dashed_name: file-origin-referrer-url
+  description: The URL of the webpage that linked to the file.
+  example: https://example.com
+  flat_name: file.origin_referrer_url
+  ignore_above: 8192
+  level: extended
+  name: origin_referrer_url
+  normalize: []
+  short: The URL of the webpage that linked to the file.
+  type: keyword
+file.origin_url:
+  dashed_name: file-origin-url
+  description: The URL where the file is hosted.
+  example: https://example.com/file.zip
+  flat_name: file.origin_url
+  ignore_above: 8192
+  level: extended
+  name: origin_url
+  normalize: []
+  short: The URL where the file is hosted.
+  type: keyword
 file.owner:
   dashed_name: file-owner
   description: File owner's username.
@@ -15607,6 +15629,30 @@ threat.enrichments.indicator.file.name:
   original_fieldset: file
   short: Name of the file including the extension, without the directory.
   type: keyword
+threat.enrichments.indicator.file.origin_referrer_url:
+  dashed_name: threat-enrichments-indicator-file-origin-referrer-url
+  description: The URL of the webpage that linked to the file.
+  example: https://example.com
+  flat_name: threat.enrichments.indicator.file.origin_referrer_url
+  ignore_above: 8192
+  level: extended
+  name: origin_referrer_url
+  normalize: []
+  original_fieldset: file
+  short: The URL of the webpage that linked to the file.
+  type: keyword
+threat.enrichments.indicator.file.origin_url:
+  dashed_name: threat-enrichments-indicator-file-origin-url
+  description: The URL where the file is hosted.
+  example: https://example.com/file.zip
+  flat_name: threat.enrichments.indicator.file.origin_url
+  ignore_above: 8192
+  level: extended
+  name: origin_url
+  normalize: []
+  original_fieldset: file
+  short: The URL where the file is hosted.
+  type: keyword
 threat.enrichments.indicator.file.owner:
   dashed_name: threat-enrichments-indicator-file-owner
   description: File owner's username.
@@ -18343,6 +18389,30 @@ threat.indicator.file.name:
   original_fieldset: file
   short: Name of the file including the extension, without the directory.
   type: keyword
+threat.indicator.file.origin_referrer_url:
+  dashed_name: threat-indicator-file-origin-referrer-url
+  description: The URL of the webpage that linked to the file.
+  example: https://example.com
+  flat_name: threat.indicator.file.origin_referrer_url
+  ignore_above: 8192
+  level: extended
+  name: origin_referrer_url
+  normalize: []
+  original_fieldset: file
+  short: The URL of the webpage that linked to the file.
+  type: keyword
+threat.indicator.file.origin_url:
+  dashed_name: threat-indicator-file-origin-url
+  description: The URL where the file is hosted.
+  example: https://example.com/file.zip
+  flat_name: threat.indicator.file.origin_url
+  ignore_above: 8192
+  level: extended
+  name: origin_url
+  normalize: []
+  original_fieldset: file
+  short: The URL where the file is hosted.
+  type: keyword
 threat.indicator.file.owner:
   dashed_name: threat-indicator-file-owner
   description: File owner's username.

experimental/generated/ecs/ecs_nested.yml

@@ -6012,6 +6012,28 @@ file:
       normalize: []
       short: Name of the file including the extension, without the directory.
       type: keyword
+    file.origin_referrer_url:
+      dashed_name: file-origin-referrer-url
+      description: The URL of the webpage that linked to the file.
+      example: https://example.com
+      flat_name: file.origin_referrer_url
+      ignore_above: 8192
+      level: extended
+      name: origin_referrer_url
+      normalize: []
+      short: The URL of the webpage that linked to the file.
+      type: keyword
+    file.origin_url:
+      dashed_name: file-origin-url
+      description: The URL where the file is hosted.
+      example: https://example.com/file.zip
+      flat_name: file.origin_url
+      ignore_above: 8192
+      level: extended
+      name: origin_url
+      normalize: []
+      short: The URL where the file is hosted.
+      type: keyword
     file.owner:
       dashed_name: file-owner
       description: File owner's username.
@@ -18308,6 +18330,30 @@ threat:
       original_fieldset: file
       short: Name of the file including the extension, without the directory.
       type: keyword
+    threat.enrichments.indicator.file.origin_referrer_url:
+      dashed_name: threat-enrichments-indicator-file-origin-referrer-url
+      description: The URL of the webpage that linked to the file.
+      example: https://example.com
+      flat_name: threat.enrichments.indicator.file.origin_referrer_url
+      ignore_above: 8192
+      level: extended
+      name: origin_referrer_url
+      normalize: []
+      original_fieldset: file
+      short: The URL of the webpage that linked to the file.
+      type: keyword
+    threat.enrichments.indicator.file.origin_url:
+      dashed_name: threat-enrichments-indicator-file-origin-url
+      description: The URL where the file is hosted.
+      example: https://example.com/file.zip
+      flat_name: threat.enrichments.indicator.file.origin_url
+      ignore_above: 8192
+      level: extended
+      name: origin_url
+      normalize: []
+      original_fieldset: file
+      short: The URL where the file is hosted.
+      type: keyword
     threat.enrichments.indicator.file.owner:
       dashed_name: threat-enrichments-indicator-file-owner
       description: File owner's username.
@@ -21050,6 +21096,30 @@ threat:
       original_fieldset: file
       short: Name of the file including the extension, without the directory.
       type: keyword
+    threat.indicator.file.origin_referrer_url:
+      dashed_name: threat-indicator-file-origin-referrer-url
+      description: The URL of the webpage that linked to the file.
+      example: https://example.com
+      flat_name: threat.indicator.file.origin_referrer_url
+      ignore_above: 8192
+      level: extended
+      name: origin_referrer_url
+      normalize: []
+      original_fieldset: file
+      short: The URL of the webpage that linked to the file.
+      type: keyword
+    threat.indicator.file.origin_url:
+      dashed_name: threat-indicator-file-origin-url
+      description: The URL where the file is hosted.
+      example: https://example.com/file.zip
+      flat_name: threat.indicator.file.origin_url
+      ignore_above: 8192
+      level: extended
+      name: origin_url
+      normalize: []
+      original_fieldset: file
+      short: The URL where the file is hosted.
+      type: keyword
     threat.indicator.file.owner:
       dashed_name: threat-indicator-file-owner
       description: File owner's username.

experimental/generated/elasticsearch/composable/component/file.json

@@ -347,6 +347,14 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
+            "origin_referrer_url": {
+              "ignore_above": 8192,
+              "type": "keyword"
+            },
+            "origin_url": {
+              "ignore_above": 8192,
+              "type": "keyword"
+            },
             "owner": {
               "ignore_above": 1024,
               "type": "keyword"

experimental/generated/elasticsearch/composable/component/threat.json

@@ -331,6 +331,14 @@
                           "ignore_above": 1024,
                           "type": "keyword"
                         },
+                        "origin_referrer_url": {
+                          "ignore_above": 8192,
+                          "type": "keyword"
+                        },
+                        "origin_url": {
+                          "ignore_above": 8192,
+                          "type": "keyword"
+                        },
                         "owner": {
                           "ignore_above": 1024,
                           "type": "keyword"
@@ -1259,6 +1267,14 @@
                       "ignore_above": 1024,
                       "type": "keyword"
                     },
+                    "origin_referrer_url": {
+                      "ignore_above": 8192,
+                      "type": "keyword"
+                    },
+                    "origin_url": {
+                      "ignore_above": 8192,
+                      "type": "keyword"
+                    },
                     "owner": {
                       "ignore_above": 1024,
                       "type": "keyword"