[D4C] kubernetes category added. trace_point now hook_point (#5836)

* kubernetes category added. trace_point now hook_point * changelog updated * dataview created for cloud_defend * ecs version updated * hook_point example updated * example update * static fields added to ingest processors * default policy updates, removed conditions that wont be available for v1 * default policy updates * doc fix

Author: mitodrummer

packages/cloud_defend/_dev/build/build.yml

@@ -1,4 +1,4 @@
 dependencies:
  ecs:
- reference: git@8.6
+ reference: git@8.7
  import_mappings: true

packages/cloud_defend/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.0.3"
+ changes:
+ - description: Added kubernetes as a category. Renamed trace_point to hook_point
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/5836
 - version: "1.0.2"
  changes:
  - description: Added mapping for cloud_defend.trace_point. Fixed host.name and host.hostname examples, and added cloud.instance.name to field list in README.

packages/cloud_defend/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml

@@ -1,9 +1,24 @@
 ---
 description: Pipeline for cloud defend alerts
 processors:
+- set:
+ field: ecs.version
+ value: '8.7.0'
+- set:
+ field: agent.type
+ value: 'cloud-defend'
 - set:
  field: event.ingested
  value: '{{_ingest.timestamp}}'
+- set:
+ field: event.module
+ value: 'cloud_defend'
+- set:
+ field: data_stream.dataset
+ value: 'cloud_defend.alerts'
+- set:
+ field: data_stream.type
+ value: 'logs'
 on_failure:
 - set:
  field: error.message

packages/cloud_defend/data_stream/alerts/fields/fields.yml

@@ -7,9 +7,9 @@
 - name: cloud_defend.package_policy_revision
  type: short
  description: The revision of the cloud_defend.package_policy_id
-- name: cloud_defend.trace_point
+- name: cloud_defend.hook_point
  type: keyword
- description: The trace point used to trigger the event.
+ description: An array of hook points used to source the events data.
 - name: orchestrator.resource.label
  type: flattened
  description: An object containing the labels for the resource being acted upon.

packages/cloud_defend/data_stream/file/elasticsearch/ingest_pipeline/default.yml

@@ -1,9 +1,24 @@
 ---
 description: Pipeline for cloud_defend file telemetry
 processors:
+- set:
+ field: ecs.version
+ value: '8.7.0'
+- set:
+ field: agent.type
+ value: 'cloud-defend'
 - set:
  field: event.ingested
  value: '{{_ingest.timestamp}}'
+- set:
+ field: event.module
+ value: 'cloud_defend'
+- set:
+ field: data_stream.dataset
+ value: 'cloud_defend.file'
+- set:
+ field: data_stream.type
+ value: 'logs'
 on_failure:
 - set:
  field: error.message

packages/cloud_defend/data_stream/file/fields/fields.yml

@@ -7,9 +7,9 @@
 - name: cloud_defend.package_policy_revision
  type: short
  description: The revision of the cloud_defend.package_policy_id
-- name: cloud_defend.trace_point
+- name: cloud_defend.hook_point
  type: keyword
- description: The trace point used to trigger the event.
+ description: An array of hook points used to source the events data.
 - name: orchestrator.resource.label
  type: flattened
  description: An object containing the labels for the resource being acted upon.

packages/cloud_defend/data_stream/process/elasticsearch/ingest_pipeline/default.yml

@@ -1,9 +1,24 @@
 ---
 description: Pipeline for cloud_defend process telemetry
 processors:
+- set:
+ field: ecs.version
+ value: '8.7.0'
+- set:
+ field: agent.type
+ value: 'cloud-defend'
 - set:
  field: event.ingested
  value: '{{_ingest.timestamp}}'
+- set:
+ field: event.module
+ value: 'cloud_defend'
+- set:
+ field: data_stream.dataset
+ value: 'cloud_defend.process'
+- set:
+ field: data_stream.type
+ value: 'logs'
 on_failure:
 - set:
  field: error.message

packages/cloud_defend/data_stream/process/fields/fields.yml

@@ -7,9 +7,9 @@
 - name: cloud_defend.package_policy_revision
  type: short
  description: The revision of the cloud_defend.package_policy_id
-- name: cloud_defend.trace_point
+- name: cloud_defend.hook_point
  type: keyword
- description: The trace point used to trigger the event.
+ description: An array of hook points used to source the events data.
 - name: orchestrator.resource.label
  type: flattened
  description: An object containing the labels for the resource being acted upon.

packages/cloud_defend/docs/README.md

@@ -123,9 +123,7 @@ In this example,
 | **operation** | The list of system operations to match on. Options include `fork` and `exec`.
 | **processExecutable** | A list of executables (full path included) to match on. e.g. /usr/bin/cat. Wildcard support is same as targetFilePath above.
 | **processName** | A list of process names (executable basename) to match on. e.g. 'bash', 'vi', 'cat' etc...
-| **processUserId** | A list of process user ids to match on. e.g. '0'.
 | **sessionLeaderInteractive** | If set to true, will only match on interactive sessions (i.e. sessions with a controlling TTY)
-| **sessionLeaderName** | A list of session leader executables basenames to match on. e.g. `bash, zsh, csh, cron etc`**
 
 # Responses
 
@@ -174,7 +172,7 @@ responses:
 | cloud_defend.matched_selectors | ['interactiveSessions'] |
 | cloud_defend.package_policy_id | '4c9cbba0-c812-11ed-a8dd-91ec403e4f03' |
 | cloud_defend.package_policy_revision | 2 |
-| cloud_defend.trace_point | ... |
+| cloud_defend.hook_point | ['tracepoint__sched_process_fork','tracepoint__sched_process_exec', 'kprobe__taskstats_exit'] |
 | [container.id](https://www.elastic.co/guide/en/ecs/current/ecs-container.html#field-container-id) | nginx_1
 | [container.image.name](https://www.elastic.co/guide/en/ecs/current/ecs-container.html#field-container-image-name) | nginx |
 | [container.image.tag](https://www.elastic.co/guide/en/ecs/current/ecs-container.html#field-container-image-tag) | latest |
@@ -295,7 +293,7 @@ responses:
 | cloud_defend.matched_selectors | ['binModifications'] |
 | cloud_defend.package_policy_id | 4c9cbba0-c812-11ed-a8dd-91ec403e4f03 |
 | cloud_defend.package_policy_revision | 2 |
-| cloud_defend.trace_point | One of: lsm__path_chmod, lsm__path_mknod, lsm__file_open, lsm__path_truncate, lsm__path_rename, lsm__path_link, lsm__path_unlink |
+| cloud_defend.hook_point | One of: lsm__path_chmod, lsm__path_mknod, lsm__file_open, lsm__path_truncate, lsm__path_rename, lsm__path_link, lsm__path_unlink |
 | [container.id](https://www.elastic.co/guide/en/ecs/current/ecs-container.html#field-container-id) | nginx_1
 | [container.image.name](https://www.elastic.co/guide/en/ecs/current/ecs-container.html#field-container-image-name) | nginx |
 | [container.image.tag](https://www.elastic.co/guide/en/ecs/current/ecs-container.html#field-container-image-tag) | latest |

packages/cloud_defend/kibana/index_pattern/cloud_defend-42ae0e4c-d963-4661-a507-16e45a793fc2.json

@@ -0,0 +1,14 @@
+{
+ "attributes": {
+ "description": "",
+ "title": "logs-cloud_defend*",
+ "timeFieldName": "@timestamp",
+ "namespaces": "[*]"
+ },
+ "coreMigrationVersion": "8.8.0",
+ "id": "cloud_defend-42ae0e4c-d963-4661-a507-16e45a793fc2",
+ "migrationVersion": {
+ "index-pattern": "8.0.0"
+ },
+ "type": "index-pattern"
+}