Skip to content

Commit 9d29b51

Browse files
jonathan-buttnerjonathan-buttner
authored
Adding in geo fields to fix maps page (#87)
1 parent abfa3e0 commit 9d29b51

File tree

40 files changed

+5399
-0
lines changed

40 files changed

+5399
-0
lines changed

‎custom_subsets/elastic_endpoint/alerts/malware_event.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,15 @@ fields:
1717
exceptionable: true
1818
version:
1919
exceptionable: true
20+
# these fields are needed in the mapping so the maps page of the security app does not throw a bunch of errors
21+
source:
22+
fields:
23+
geo:
24+
fields: "*"
25+
destination:
26+
fields:
27+
geo:
28+
fields: "*"
2029
dll:
2130
fields:
2231
name: {}

‎custom_subsets/elastic_endpoint/file/file.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ fields:
1010
ecs:
1111
fields:
1212
version: {}
13+
# these fields are needed in the mapping so the maps page of the security app does not throw a bunch of errors
14+
source:
15+
fields:
16+
geo:
17+
fields: "*"
18+
destination:
19+
fields:
20+
geo:
21+
fields: "*"
1322
host:
1423
fields:
1524
name: {}

‎custom_subsets/elastic_endpoint/file/unquarantine.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,15 @@ fields:
99
ecs:
1010
fields:
1111
version: {}
12+
# these fields are needed in the mapping so the maps page of the security app does not throw a bunch of errors
13+
source:
14+
fields:
15+
geo:
16+
fields: "*"
17+
destination:
18+
fields:
19+
geo:
20+
fields: "*"
1221
host:
1322
fields:
1423
name: {}

‎custom_subsets/elastic_endpoint/library/library.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ fields:
1010
ecs:
1111
fields:
1212
version: {}
13+
# these fields are needed in the mapping so the maps page of the security app does not throw a bunch of errors
14+
source:
15+
fields:
16+
geo:
17+
fields: "*"
18+
destination:
19+
fields:
20+
geo:
21+
fields: "*"
1322
host:
1423
fields:
1524
name: {}

‎custom_subsets/elastic_endpoint/process/process.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ fields:
1010
ecs:
1111
fields:
1212
version: {}
13+
# these fields are needed in the mapping so the maps page of the security app does not throw a bunch of errors
14+
source:
15+
fields:
16+
geo:
17+
fields: "*"
18+
destination:
19+
fields:
20+
geo:
21+
fields: "*"
1322
host:
1423
fields:
1524
name: {}

‎custom_subsets/elastic_endpoint/registry/registry.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ fields:
1010
ecs:
1111
fields:
1212
version: {}
13+
# these fields are needed in the mapping so the maps page of the security app does not throw a bunch of errors
14+
source:
15+
fields:
16+
geo:
17+
fields: "*"
18+
destination:
19+
fields:
20+
geo:
21+
fields: "*"
1322
host:
1423
fields:
1524
name: {}

‎custom_subsets/elastic_endpoint/security/security.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ fields:
1010
ecs:
1111
fields:
1212
version: {}
13+
# these fields are needed in the mapping so the maps page of the security app does not throw a bunch of errors
14+
source:
15+
fields:
16+
geo:
17+
fields: "*"
18+
destination:
19+
fields:
20+
geo:
21+
fields: "*"
1322
host:
1423
fields:
1524
name: {}

‎generated/alerts/ecs/ecs_flat.yml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2072,6 +2072,107 @@ data_stream.type:
20722072
normalize: []
20732073
short: Data stream type.
20742074
type: constant_keyword
2075+
destination.geo.city_name:
2076+
dashed_name: destination-geo-city-name
2077+
description: City name.
2078+
example: Montreal
2079+
flat_name: destination.geo.city_name
2080+
ignore_above: 1024
2081+
level: core
2082+
name: city_name
2083+
normalize: []
2084+
original_fieldset: geo
2085+
short: City name.
2086+
type: keyword
2087+
destination.geo.continent_name:
2088+
dashed_name: destination-geo-continent-name
2089+
description: Name of the continent.
2090+
example: North America
2091+
flat_name: destination.geo.continent_name
2092+
ignore_above: 1024
2093+
level: core
2094+
name: continent_name
2095+
normalize: []
2096+
original_fieldset: geo
2097+
short: Name of the continent.
2098+
type: keyword
2099+
destination.geo.country_iso_code:
2100+
dashed_name: destination-geo-country-iso-code
2101+
description: Country ISO code.
2102+
example: CA
2103+
flat_name: destination.geo.country_iso_code
2104+
ignore_above: 1024
2105+
level: core
2106+
name: country_iso_code
2107+
normalize: []
2108+
original_fieldset: geo
2109+
short: Country ISO code.
2110+
type: keyword
2111+
destination.geo.country_name:
2112+
dashed_name: destination-geo-country-name
2113+
description: Country name.
2114+
example: Canada
2115+
flat_name: destination.geo.country_name
2116+
ignore_above: 1024
2117+
level: core
2118+
name: country_name
2119+
normalize: []
2120+
original_fieldset: geo
2121+
short: Country name.
2122+
type: keyword
2123+
destination.geo.location:
2124+
dashed_name: destination-geo-location
2125+
description: Longitude and latitude.
2126+
example: '{ "lon": -73.614830, "lat": 45.505918 }'
2127+
flat_name: destination.geo.location
2128+
level: core
2129+
name: location
2130+
normalize: []
2131+
original_fieldset: geo
2132+
short: Longitude and latitude.
2133+
type: geo_point
2134+
destination.geo.name:
2135+
dashed_name: destination-geo-name
2136+
description: 'User-defined description of a location, at the level of granularity
2137+
they care about.
2138+
2139+
Could be the name of their data centers, the floor number, if this describes a
2140+
local physical entity, city names.
2141+
2142+
Not typically used in automated geolocation.'
2143+
example: boston-dc
2144+
flat_name: destination.geo.name
2145+
ignore_above: 1024
2146+
level: extended
2147+
name: name
2148+
normalize: []
2149+
original_fieldset: geo
2150+
short: User-defined description of a location.
2151+
type: keyword
2152+
destination.geo.region_iso_code:
2153+
dashed_name: destination-geo-region-iso-code
2154+
description: Region ISO code.
2155+
example: CA-QC
2156+
flat_name: destination.geo.region_iso_code
2157+
ignore_above: 1024
2158+
level: core
2159+
name: region_iso_code
2160+
normalize: []
2161+
original_fieldset: geo
2162+
short: Region ISO code.
2163+
type: keyword
2164+
destination.geo.region_name:
2165+
dashed_name: destination-geo-region-name
2166+
description: Region name.
2167+
example: Quebec
2168+
flat_name: destination.geo.region_name
2169+
ignore_above: 1024
2170+
level: core
2171+
name: region_name
2172+
normalize: []
2173+
original_fieldset: geo
2174+
short: Region name.
2175+
type: keyword
20752176
dll.Ext:
20762177
dashed_name: dll-Ext
20772178
description: Object for all custom defined fields to live in.
@@ -6094,6 +6195,107 @@ rule.version:
60946195
normalize: []
60956196
short: Rule version
60966197
type: keyword
6198+
source.geo.city_name:
6199+
dashed_name: source-geo-city-name
6200+
description: City name.
6201+
example: Montreal
6202+
flat_name: source.geo.city_name
6203+
ignore_above: 1024
6204+
level: core
6205+
name: city_name
6206+
normalize: []
6207+
original_fieldset: geo
6208+
short: City name.
6209+
type: keyword
6210+
source.geo.continent_name:
6211+
dashed_name: source-geo-continent-name
6212+
description: Name of the continent.
6213+
example: North America
6214+
flat_name: source.geo.continent_name
6215+
ignore_above: 1024
6216+
level: core
6217+
name: continent_name
6218+
normalize: []
6219+
original_fieldset: geo
6220+
short: Name of the continent.
6221+
type: keyword
6222+
source.geo.country_iso_code:
6223+
dashed_name: source-geo-country-iso-code
6224+
description: Country ISO code.
6225+
example: CA
6226+
flat_name: source.geo.country_iso_code
6227+
ignore_above: 1024
6228+
level: core
6229+
name: country_iso_code
6230+
normalize: []
6231+
original_fieldset: geo
6232+
short: Country ISO code.
6233+
type: keyword
6234+
source.geo.country_name:
6235+
dashed_name: source-geo-country-name
6236+
description: Country name.
6237+
example: Canada
6238+
flat_name: source.geo.country_name
6239+
ignore_above: 1024
6240+
level: core
6241+
name: country_name
6242+
normalize: []
6243+
original_fieldset: geo
6244+
short: Country name.
6245+
type: keyword
6246+
source.geo.location:
6247+
dashed_name: source-geo-location
6248+
description: Longitude and latitude.
6249+
example: '{ "lon": -73.614830, "lat": 45.505918 }'
6250+
flat_name: source.geo.location
6251+
level: core
6252+
name: location
6253+
normalize: []
6254+
original_fieldset: geo
6255+
short: Longitude and latitude.
6256+
type: geo_point
6257+
source.geo.name:
6258+
dashed_name: source-geo-name
6259+
description: 'User-defined description of a location, at the level of granularity
6260+
they care about.
6261+
6262+
Could be the name of their data centers, the floor number, if this describes a
6263+
local physical entity, city names.
6264+
6265+
Not typically used in automated geolocation.'
6266+
example: boston-dc
6267+
flat_name: source.geo.name
6268+
ignore_above: 1024
6269+
level: extended
6270+
name: name
6271+
normalize: []
6272+
original_fieldset: geo
6273+
short: User-defined description of a location.
6274+
type: keyword
6275+
source.geo.region_iso_code:
6276+
dashed_name: source-geo-region-iso-code
6277+
description: Region ISO code.
6278+
example: CA-QC
6279+
flat_name: source.geo.region_iso_code
6280+
ignore_above: 1024
6281+
level: core
6282+
name: region_iso_code
6283+
normalize: []
6284+
original_fieldset: geo
6285+
short: Region ISO code.
6286+
type: keyword
6287+
source.geo.region_name:
6288+
dashed_name: source-geo-region-name
6289+
description: Region name.
6290+
example: Quebec
6291+
flat_name: source.geo.region_name
6292+
ignore_above: 1024
6293+
level: core
6294+
name: region_name
6295+
normalize: []
6296+
original_fieldset: geo
6297+
short: Region name.
6298+
type: keyword
60976299
threat.framework:
60986300
dashed_name: threat-framework
60996301
description: Name of the threat framework used to further categorize and classify

0 commit comments

Comments
 (0)