ti_*: Fix ECS date mapping on threat fields #10674
Conversation
🚀 Benchmarks reportTo see the full report comment with |
andrewkroh added Integration:ti_anomali 💚 Build Succeeded
History
cc @kcreddy |
|
| Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
kcreddy added bugfix kcreddy added Integration:ti_eset 
| Package ti_anomali - 1.22.1 containing this change is available at https://epr.elastic.co/search?package=ti_anomali |
| Package ti_cif3 - 1.14.1 containing this change is available at https://epr.elastic.co/search?package=ti_cif3 |
| Package ti_crowdstrike - 1.1.3 containing this change is available at https://epr.elastic.co/search?package=ti_crowdstrike |
| Package ti_cybersixgill - 1.30.1 containing this change is available at https://epr.elastic.co/search?package=ti_cybersixgill |
| Package ti_eclecticiq - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=ti_eclecticiq |
| Package ti_eset - 1.2.2 containing this change is available at https://epr.elastic.co/search?package=ti_eset |
| Package ti_maltiverse - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=ti_maltiverse |
| Package ti_mandiant_advantage - 1.3.1 containing this change is available at https://epr.elastic.co/search?package=ti_mandiant_advantage |
| Package ti_opencti - 2.3.2 containing this change is available at https://epr.elastic.co/search?package=ti_opencti |
| Package ti_otx - 1.25.1 containing this change is available at https://epr.elastic.co/search?package=ti_otx |
| Package ti_rapid7_threat_command - 2.0.1 containing this change is available at https://epr.elastic.co/search?package=ti_rapid7_threat_command |
| Package ti_recordedfuture - 1.26.1 containing this change is available at https://epr.elastic.co/search?package=ti_recordedfuture |
| Package ti_threatconnect - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=ti_threatconnect |
| Package ti_threatq - 1.28.1 containing this change is available at https://epr.elastic.co/search?package=ti_threatq |
Fix ECS date mapping for threat fields. ecs@mappings component template is missing threat fields mapped as date. Example: fields such as first_seen, last_seen, modified_at are being mapped as keyword in transform's source datastream-backed indices. The transform's destination indices are not effected as they are not datastream-backed and mappings are explicitly defined as date. This causes field type conflicts. - Explicitly add ECS threat fields that are of type date into source data-stream backed fields. - Ensure fields are correctly mapped using system tests.
Fix ECS date mapping for threat fields. ecs@mappings component template is missing threat fields mapped as date. Example: fields such as first_seen, last_seen, modified_at are being mapped as keyword in transform's source datastream-backed indices. The transform's destination indices are not effected as they are not datastream-backed and mappings are explicitly defined as date. This causes field type conflicts. - Explicitly add ECS threat fields that are of type date into source data-stream backed fields. - Ensure fields are correctly mapped using system tests.
4 participants
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots
Before (Mapping Conflict)
After (No Mapping Conflict)