osquery_manager: update ECS mapping #16650
Draft
+37 −11
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Rename error to error.message
mmahacek added bug 
💔 Build Failed
Failed CI StepsHistorycc @mmahacek |
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
A number of ECS fields are not defined within the integration field mapping, which is causing them to map as object instead of the expected nested type. These fields are:
dll.pe.sections
file.macho.sections
file.pe.sections
process.parent.macho.sections
process.parent.pe.sections
threat.enrichments.indicator.file.pe.sections
threat.indicator.file.pe.sections
Additionally, the integration defines an error field as text, however this conflicts with the ECS error field that is expected to be an object.
Proposed commit message
osquery_manager: update ECS mapping and rename error to error.message
Please explain:
This text will be pasted into the squash dialog when the change is committed and will be
a long term historical record of the change to help future contributors understand the
change, please help them by making it clear and comprehensive, they may be you.
If the commit title is adequate to describe both of these things, The text here may be omitted
or replaced with "See title". The title of the PR will be used as the commit message title when
the merge is made and the "See title" marker will be removed if present.
The text here and the PR title will be subject to the PR review process.
-->
Update ECS mapping for the osquery_manager.results datastream.
Update osquery_manager.action_responses ingest pipeline to rename
errortoerror.messageChecklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
There are no special tests to run outside of
elastic-package testRelated issues
Screenshots