Osquerybeat: Add event.module into the result data (#27261) (#27263)

(cherry picked from commit 526f332) Co-authored-by: Aleksandr Maus <[email protected]>
elastic · Aug 5, 2021 · 7d18dd4 · 7d18dd4
1 parent 92e3312
commit 7d18dd4
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/x-pack/osquerybeat/beater/osquerybeat.go b/x-pack/osquerybeat/beater/osquerybeat.go
@@ -48,6 +48,8 @@ const (
 	configurationRefreshIntervalSecs = 60
 
 	osqueryTimeout = 60 * time.Second
+
+	eventModule = "osquery_manager"
 )
 
 const (
@@ -441,6 +443,11 @@ func (bt *osquerybeat) publishEvents(index, actionID, responseID string, hits []
 			fields = common.MapStr{}
 		}
 
+		// Add event.module for ECS
+		fields["event"] = map[string]string{
+			"module": eventModule,
+		}
+
 		fields["type"] = bt.b.Info.Name
 		fields["action_id"] = actionID
 		fields["osquery"] = hit