[Cloud Security] Fix ECS import method #5106
Conversation
kfirpeled
added
Team:Cloud Security
| - name: host.name | ||
| external: ecs | ||
| type: keyword | ||
| - name: host.os.codename |
There was a problem hiding this comment.
host.os.codename and host.containerized are not part of ECS atm
elastic/ecs#294
elastic/ecs#1512
Do you think it's worth adding them as a custom field? and for the sake of backward compatibility?
There was a problem hiding this comment.
As long as the field type does not change between the type you set manually and the type the ECS field ends up being its fine to map them. If its unsure then we should get confirmation about the preferred type first.
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
| - name: host.name | ||
| external: ecs | ||
| type: keyword | ||
| - name: host.os.codename |
There was a problem hiding this comment.
As long as the field type does not change between the type you set manually and the type the ECS field ends up being its fine to map them. If its unsure then we should get confirmation about the preferred type first.
🌐 Coverage report
|
What does this PR do?
This PR fixes the way
cloud_security_postureimports ECS mappings. Till now, we did it manually without knowing how to instructelastic-packagewhich ECS version to import its mappings from.Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Tested with elastic-package 0.72 (requires go 1.19 when built locally)
Related issues
Screenshots