aws.securityhub_findings: Add fields to _source as needed by CDR workflows.

packages/aws/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.31.1"
+ changes:
+ - description: Add `cloud.provider`, `event.kind`, and `observer.vendor` fields to _source as needed by CDR workflows.
+ type: bugfix
+ link: https://github.com/elastic/integrations/pull/11608
 - version: "2.31.0"
  changes:
  - description: Improve support for Cloud Detection and Response (CDR) workflows in securityhub_findings data stream.

packages/aws/data_stream/securityhub_findings/elasticsearch/ingest_pipeline/default.yml

@@ -4,6 +4,9 @@ processors:
  - set:
  field: ecs.version
  value: '8.11.0'
+ - set:
+ field: event.kind
+ value: state
  - append:
  field: event.type
  value: info
@@ -30,13 +33,14 @@ processors:
  - json.CreatedAt
  target_field: _id
  ignore_missing: true
- - remove: 
- field: 
- - cloud.provider
- - event.kind
- - observer.vendor
- ignore_missing: true
- description: Fields defined as constant_keyword are removed from _source for storage efficiency.
+ - set:
+ field: observer.vendor
+ value: AWS Security Hub
+ tag: set_observer_vendor
+ - set:
+ field: cloud.provider
+ value: aws
+ tag: set_cloud_provider
  - rename:
  field: json.Action.ActionType
  target_field: aws.securityhub_findings.action.type

packages/aws/data_stream/securityhub_findings/fields/ecs.yml

@@ -1,10 +1,7 @@
 # Define ECS constant fields as constant_keyword
 - name: cloud.provider
  type: constant_keyword
- value: aws
 - name: event.kind
  type: constant_keyword
- value: state
 - name: observer.vendor
  type: constant_keyword
- value: AWS Security Hub

packages/aws/elasticsearch/transform/latest_cdr_misconfigurations/fields/ecs.yml

@@ -1,13 +1,10 @@
 # Define ECS constant fields as constant_keyword
 - name: cloud.provider
  type: constant_keyword
- value: aws
 - name: event.kind
  type: constant_keyword
- value: state
 - name: observer.vendor
  type: constant_keyword
- value: AWS Security Hub
 # Define ECS fields for transform
 - name: cloud.account.id
  external: ecs

packages/aws/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.0.0
 name: aws
 title: AWS
-version: 2.31.0
+version: 2.31.1
 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
 type: integration
 categories: