= async ({
+ callES,
+ dynamicSettings,
+ index,
+ from,
+ to,
+ search,
+ size,
+}) => {
+ const searchWrapper = `*${search}*`;
+ const params: any = {
+ index: dynamicSettings.heartbeatIndices,
+ body: {
+ from: index,
+ size,
+ query: {
+ bool: {
+ filter: [
+ {
+ exists: {
+ field: 'tls',
+ },
+ },
+ {
+ range: {
+ '@timestamp': {
+ gte: from,
+ lte: to,
+ },
+ },
+ },
+ ],
+ },
+ },
+ _source: [
+ 'monitor.id',
+ 'monitor.name',
+ 'tls.server.x509.issuer.common_name',
+ 'tls.server.x509.subject.common_name',
+ 'tls.server.hash.sha1',
+ 'tls.server.hash.sha256',
+ 'tls.certificate_not_valid_before',
+ 'tls.certificate_not_valid_after',
+ ],
+ collapse: {
+ field: 'tls.server.hash.sha256',
+ inner_hits: {
+ _source: {
+ includes: ['monitor.id', 'monitor.name'],
+ },
+ collapse: {
+ field: 'monitor.id',
+ },
+ name: 'monitors',
+ sort: [{ 'monitor.id': 'asc' }],
+ },
+ },
+ },
+ };
+
+ if (search) {
+ params.body.query.bool.should = [
+ {
+ wildcard: {
+ 'tls.server.issuer': {
+ value: searchWrapper,
+ },
+ },
+ },
+ {
+ wildcard: {
+ 'tls.common_name': {
+ value: searchWrapper,
+ },
+ },
+ },
+ {
+ wildcard: {
+ 'monitor.id': {
+ value: searchWrapper,
+ },
+ },
+ },
+ {
+ wildcard: {
+ 'monitor.name': {
+ value: searchWrapper,
+ },
+ },
+ },
+ ];
+ }
+
+ const result = await callES('search', params);
+ const formatted = (result?.hits?.hits ?? []).map((hit: any) => {
+ const {
+ _source: {
+ tls: {
+ server: {
+ x509: {
+ issuer: { common_name: issuer },
+ subject: { common_name },
+ },
+ hash: { sha1, sha256 },
+ },
+ certificate_not_valid_after,
+ certificate_not_valid_before,
+ },
+ },
+ } = hit;
+ const monitors = hit.inner_hits.monitors.hits.hits.map((monitor: any) => ({
+ name: monitor._source?.monitor.name,
+ id: monitor._source?.monitor.id,
+ }));
+ return {
+ monitors,
+ certificate_not_valid_after,
+ certificate_not_valid_before,
+ issuer,
+ sha1,
+ sha256,
+ common_name,
+ };
+ });
+ return formatted;
+};
diff --git a/x-pack/plugins/uptime/server/lib/requests/index.ts b/x-pack/plugins/uptime/server/lib/requests/index.ts
index 6317f665d377f..243bb089cc7b4 100644
--- a/x-pack/plugins/uptime/server/lib/requests/index.ts
+++ b/x-pack/plugins/uptime/server/lib/requests/index.ts
@@ -4,6 +4,7 @@
* you may not use this file except in compliance with the Elastic License.
*/
+export { getCerts } from './get_certs';
export { getFilterBar, GetFilterBarParams } from './get_filter_bar';
export { getUptimeIndexPattern as getIndexPattern } from './get_index_pattern';
export { getLatestMonitor, GetLatestMonitorParams } from './get_latest_monitor';
diff --git a/x-pack/plugins/uptime/server/lib/requests/uptime_requests.ts b/x-pack/plugins/uptime/server/lib/requests/uptime_requests.ts
index e9a7aa94dd3aa..84154429b9188 100644
--- a/x-pack/plugins/uptime/server/lib/requests/uptime_requests.ts
+++ b/x-pack/plugins/uptime/server/lib/requests/uptime_requests.ts
@@ -9,6 +9,7 @@ import {
HistogramResult,
Ping,
PingsResponse as PingResults,
+ GetCertsParams,
GetPingsParams,
} from '../../../../../legacy/plugins/uptime/common/runtime_types';
import {
@@ -28,6 +29,7 @@ import {
MonitorLocations,
Snapshot,
StatesIndexStatus,
+ Cert,
} from '../../../../../legacy/plugins/uptime/common/runtime_types';
import { GetMonitorStatesResult } from './get_monitor_states';
import { GetSnapshotCountParams } from './get_snapshot_counts';
@@ -36,6 +38,7 @@ import { MonitorDurationResult } from '../../../../../legacy/plugins/uptime/comm
type ESQ = UMElasticsearchQueryFn
;
export interface UptimeRequests {
+ getCerts: ESQ;
getFilterBar: ESQ;
getIndexPattern: ESQ<{}, {}>;
getLatestMonitor: ESQ;
diff --git a/x-pack/plugins/uptime/server/rest_api/certs.ts b/x-pack/plugins/uptime/server/rest_api/certs.ts
new file mode 100644
index 0000000000000..31fb3f4ab96a7
--- /dev/null
+++ b/x-pack/plugins/uptime/server/rest_api/certs.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { schema } from '@kbn/config-schema';
+import { UMServerLibs } from '../lib/lib';
+import { UMRestApiRouteFactory } from '.';
+import { API_URLS } from '../../../../legacy/plugins/uptime/common/constants/rest_api';
+
+const DEFAULT_INDEX = 0;
+const DEFAULT_SIZE = 25;
+const DEFAULT_FROM = 'now-1d';
+const DEFAULT_TO = 'now';
+
+export const createGetCertsRoute: UMRestApiRouteFactory = (libs: UMServerLibs) => ({
+ method: 'GET',
+ path: API_URLS.CERTS,
+ validate: {
+ query: schema.object({
+ from: schema.maybe(schema.string()),
+ to: schema.maybe(schema.string()),
+ search: schema.maybe(schema.string()),
+ index: schema.maybe(schema.number()),
+ size: schema.maybe(schema.number()),
+ }),
+ },
+ writeAccess: false,
+ options: {
+ tags: ['access:uptime-read'],
+ },
+ handler: async ({ callES, dynamicSettings }, _context, request, response): Promise => {
+ const index = request.query?.index ?? DEFAULT_INDEX;
+ const size = request.query?.size ?? DEFAULT_SIZE;
+ const from = request.query?.from ?? DEFAULT_FROM;
+ const to = request.query?.to ?? DEFAULT_TO;
+ const { search } = request.query;
+
+ return response.ok({
+ body: {
+ certs: await libs.requests.getCerts({
+ callES,
+ dynamicSettings,
+ index,
+ search,
+ size,
+ from,
+ to,
+ }),
+ },
+ });
+ },
+});
diff --git a/x-pack/plugins/uptime/server/rest_api/index.ts b/x-pack/plugins/uptime/server/rest_api/index.ts
index ae1e499dcc26c..a7a63342d11d4 100644
--- a/x-pack/plugins/uptime/server/rest_api/index.ts
+++ b/x-pack/plugins/uptime/server/rest_api/index.ts
@@ -4,6 +4,7 @@
* you may not use this file except in compliance with the Elastic License.
*/
+import { createGetCertsRoute } from './certs';
import { createGetOverviewFilters } from './overview_filters';
import { createGetPingHistogramRoute, createGetPingsRoute } from './pings';
import { createGetDynamicSettingsRoute, createPostDynamicSettingsRoute } from './dynamic_settings';
@@ -23,6 +24,7 @@ export { createRouteWithAuth } from './create_route_with_auth';
export { uptimeRouteWrapper } from './uptime_route_wrapper';
export const restApiRoutes: UMRestApiRouteFactory[] = [
+ createGetCertsRoute,
createGetOverviewFilters,
createGetPingsRoute,
createGetIndexPatternRoute,
diff --git a/x-pack/test/api_integration/apis/uptime/rest/certs.ts b/x-pack/test/api_integration/apis/uptime/rest/certs.ts
new file mode 100644
index 0000000000000..7510ea3f34d28
--- /dev/null
+++ b/x-pack/test/api_integration/apis/uptime/rest/certs.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from '@kbn/expect';
+import moment from 'moment';
+import { isRight } from 'fp-ts/lib/Either';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { API_URLS } from '../../../../../legacy/plugins/uptime/common/constants';
+import { CertType } from '../../../../../legacy/plugins/uptime/common/runtime_types';
+import { makeChecksWithStatus } from './helper/make_checks';
+
+export default function({ getService }: FtrProviderContext) {
+ const supertest = getService('supertest');
+ const legacyEsService = getService('legacyEs');
+ const esArchiver = getService('esArchiver');
+
+ describe('certs api', () => {
+ describe('empty index', async () => {
+ it('returns empty array for no data', async () => {
+ const apiResponse = await supertest.get(API_URLS.CERTS);
+ expect(JSON.stringify(apiResponse.body)).to.eql('{"certs":[]}');
+ });
+ });
+
+ describe('when data is present', async () => {
+ const now = moment();
+ const cnva = now.add(6, 'months').toISOString();
+ const cnvb = now.subtract(23, 'weeks').toISOString();
+ const monitorId = 'monitor1';
+ before(async () => {
+ makeChecksWithStatus(
+ legacyEsService,
+ monitorId,
+ 3,
+ 1,
+ 10000,
+ {
+ tls: {
+ certificate_not_valid_after: cnva,
+ certificate_not_valid_before: cnvb,
+ server: {
+ x509: {
+ issuer: {
+ common_name: 'issuer-common-name',
+ },
+ subject: {
+ common_name: 'subject-common-name',
+ },
+ },
+ hash: {
+ sha1: 'fewjio23r3',
+ sha256: 'few9023fijoefw',
+ },
+ },
+ },
+ },
+ 'up',
+ (d: any) => d
+ );
+ });
+ after('unload test docs', () => {
+ esArchiver.unload('uptime/blank');
+ });
+
+ it('retrieves expected cert data', async () => {
+ const apiResponse = await supertest.get(API_URLS.CERTS);
+ const { body } = apiResponse;
+
+ expect(body.certs).not.to.be(undefined);
+ expect(Array.isArray(body.certs)).to.be(true);
+ expect(body.certs).to.have.length(1);
+
+ const decoded = CertType.decode(body.certs[0]);
+ expect(isRight(decoded)).to.be(true);
+
+ const cert = body.certs[0];
+ expect(Array.isArray(cert.monitors)).to.be(true);
+ expect(cert.monitors[0]).to.eql({ id: monitorId });
+ expect(cert.certificate_not_valid_after).to.eql(cnva);
+ expect(cert.certificate_not_valid_before).to.eql(cnvb);
+ expect(cert.common_name).to.eql('subject-common-name');
+ expect(cert.issuer).to.eql('issuer-common-name');
+ });
+ });
+ });
+}
diff --git a/x-pack/test/api_integration/apis/uptime/rest/index.ts b/x-pack/test/api_integration/apis/uptime/rest/index.ts
index 29755bbddbc86..f77c14e960ab2 100644
--- a/x-pack/test/api_integration/apis/uptime/rest/index.ts
+++ b/x-pack/test/api_integration/apis/uptime/rest/index.ts
@@ -37,11 +37,12 @@ export default function({ getService, loadTestFile }: FtrProviderContext) {
});
describe('with generated data', () => {
- before('load heartbeat data', async () => await esArchiver.load('uptime/blank'));
+ beforeEach('load heartbeat data', async () => await esArchiver.loadIfNeeded('uptime/blank'));
after('unload', async () => await esArchiver.unload('uptime/blank'));
- loadTestFile(require.resolve('./snapshot'));
+ loadTestFile(require.resolve('./certs'));
loadTestFile(require.resolve('./dynamic_settings'));
+ loadTestFile(require.resolve('./snapshot'));
loadTestFile(require.resolve('./monitor_states_generated'));
loadTestFile(require.resolve('./telemetry_collectors'));
});
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
index 07f3a34d6ff44..44847d5c8146c 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/find_statuses.ts
@@ -50,17 +50,18 @@ export default ({ getService }: FtrProviderContext): void => {
.send(getSimpleRule())
.expect(200);
- await new Promise(resolve => setTimeout(resolve, 1000)).then(async () => {
- // query the single rule from _find
- const { body } = await supertest
- .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
- .set('kbn-xsrf', 'true')
- .send({ ids: [resBody.id] })
- .expect(200);
+ // wait for Task Manager to execute the rule and update status
+ await new Promise(resolve => setTimeout(resolve, 5000));
- // expected result for status should be 'going to run' or 'succeeded
- expect(['succeeded', 'going to run']).to.contain(body[resBody.id].current_status.status);
- });
+ // query the single rule from _find
+ const { body } = await supertest
+ .post(`${DETECTION_ENGINE_RULES_URL}/_find_statuses`)
+ .set('kbn-xsrf', 'true')
+ .send({ ids: [resBody.id] })
+ .expect(200);
+
+ // expected result for status should be 'going to run' or 'succeeded
+ expect(['succeeded', 'going to run']).to.contain(body[resBody.id].current_status.status);
});
});
};
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/utils.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/utils.ts
index cebe24dc5ccc2..e508cf1aaa2e0 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/utils.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/utils.ts
@@ -154,7 +154,7 @@ export const getSimpleRuleOutput = (ruleId = 'rule-1'): Partial {
before(async () => {
@@ -111,5 +112,15 @@ export default function({ getPageObjects, getService }) {
const afterRefreshTimerTimestamp = await getRequestTimestamp();
expect(beforeRefreshTimerTimestamp).not.to.equal(afterRefreshTimerTimestamp);
});
+
+ // see https://github.com/elastic/kibana/issues/61596 on why it is specific to maps
+ it("dashboard's back button should navigate to previous page", async () => {
+ await PageObjects.common.navigateToApp('dashboard');
+ await PageObjects.dashboard.preserveCrossAppState();
+ await PageObjects.dashboard.loadSavedDashboard('map embeddable example');
+ await PageObjects.dashboard.waitForRenderComplete();
+ await browser.goBack();
+ expect(await PageObjects.dashboard.onDashboardLandingPage()).to.be(true);
+ });
});
}
diff --git a/x-pack/test/functional/es_archives/uptime/blank/mappings.json b/x-pack/test/functional/es_archives/uptime/blank/mappings.json
index 7879c82612a96..fff4ef47bce0c 100644
--- a/x-pack/test/functional/es_archives/uptime/blank/mappings.json
+++ b/x-pack/test/functional/es_archives/uptime/blank/mappings.json
@@ -12,79 +12,115 @@
"beat": "heartbeat",
"version": "8.0.0"
},
- "date_detection": false,
"dynamic_templates": [
{
"labels": {
+ "path_match": "labels.*",
+ "match_mapping_type": "string",
"mapping": {
"type": "keyword"
- },
- "match_mapping_type": "string",
- "path_match": "labels.*"
+ }
}
},
{
"container.labels": {
+ "path_match": "container.labels.*",
+ "match_mapping_type": "string",
"mapping": {
"type": "keyword"
- },
- "match_mapping_type": "string",
- "path_match": "container.labels.*"
+ }
}
},
{
"dns.answers": {
+ "path_match": "dns.answers.*",
+ "match_mapping_type": "string",
"mapping": {
"type": "keyword"
- },
+ }
+ }
+ },
+ {
+ "log.syslog": {
+ "path_match": "log.syslog.*",
"match_mapping_type": "string",
- "path_match": "dns.answers.*"
+ "mapping": {
+ "type": "keyword"
+ }
}
},
{
- "fields": {
+ "network.inner": {
+ "path_match": "network.inner.*",
+ "match_mapping_type": "string",
"mapping": {
"type": "keyword"
- },
+ }
+ }
+ },
+ {
+ "observer.egress": {
+ "path_match": "observer.egress.*",
"match_mapping_type": "string",
- "path_match": "fields.*"
+ "mapping": {
+ "type": "keyword"
+ }
}
},
{
- "docker.container.labels": {
+ "observer.ingress": {
+ "path_match": "observer.ingress.*",
+ "match_mapping_type": "string",
"mapping": {
"type": "keyword"
- },
+ }
+ }
+ },
+ {
+ "fields": {
+ "path_match": "fields.*",
+ "match_mapping_type": "string",
+ "mapping": {
+ "type": "keyword"
+ }
+ }
+ },
+ {
+ "docker.container.labels": {
+ "path_match": "docker.container.labels.*",
"match_mapping_type": "string",
- "path_match": "docker.container.labels.*"
+ "mapping": {
+ "type": "keyword"
+ }
}
},
{
"kubernetes.labels.*": {
+ "path_match": "kubernetes.labels.*",
"mapping": {
"type": "keyword"
- },
- "path_match": "kubernetes.labels.*"
+ }
}
},
{
"kubernetes.annotations.*": {
+ "path_match": "kubernetes.annotations.*",
"mapping": {
"type": "keyword"
- },
- "path_match": "kubernetes.annotations.*"
+ }
}
},
{
"strings_as_keyword": {
+ "match_mapping_type": "string",
"mapping": {
"ignore_above": 1024,
"type": "keyword"
- },
- "match_mapping_type": "string"
+ }
}
}
],
+ "date_detection": false,
"properties": {
"@timestamp": {
"type": "date"
@@ -92,28 +128,28 @@
"agent": {
"properties": {
"ephemeral_id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"hostname": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -125,8 +161,14 @@
"organization": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -135,8 +177,8 @@
"client": {
"properties": {
"address": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"as": {
"properties": {
@@ -146,8 +188,14 @@
"organization": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -157,41 +205,41 @@
"type": "long"
},
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"continent_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -199,8 +247,8 @@
"type": "ip"
},
"mac": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"nat": {
"properties": {
@@ -218,43 +266,67 @@
"port": {
"type": "long"
},
+ "registered_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "top_level_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"user": {
"properties": {
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"email": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"group": {
"properties": {
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -265,76 +337,97 @@
"account": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"availability_zone": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"image": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"instance": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"machine": {
"properties": {
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"project": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"provider": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "code_signature": {
+ "properties": {
+ "exists": {
+ "type": "boolean"
+ },
+ "status": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subject_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "trusted": {
+ "type": "boolean"
+ },
+ "valid": {
+ "type": "boolean"
}
}
},
"container": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"image": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"tag": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -342,20 +435,20 @@
"type": "object"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"runtime": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"destination": {
"properties": {
"address": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"as": {
"properties": {
@@ -365,8 +458,14 @@
"organization": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -376,41 +475,41 @@
"type": "long"
},
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"continent_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -418,8 +517,8 @@
"type": "ip"
},
"mac": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"nat": {
"properties": {
@@ -437,43 +536,144 @@
"port": {
"type": "long"
},
+ "registered_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "top_level_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"user": {
"properties": {
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"email": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"group": {
"properties": {
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ }
+ }
+ }
+ }
+ },
+ "dll": {
+ "properties": {
+ "code_signature": {
+ "properties": {
+ "exists": {
+ "type": "boolean"
+ },
+ "status": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subject_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "trusted": {
+ "type": "boolean"
+ },
+ "valid": {
+ "type": "boolean"
+ }
+ }
+ },
+ "hash": {
+ "properties": {
+ "md5": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha1": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha256": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha512": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "path": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "pe": {
+ "properties": {
+ "company": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "description": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "file_version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "original_file_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "product": {
+ "type": "keyword",
+ "ignore_above": 1024
}
}
}
@@ -484,55 +684,63 @@
"answers": {
"properties": {
"class": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"data": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"ttl": {
"type": "long"
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"header_flags": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"op_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"question": {
"properties": {
"class": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"registered_domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subdomain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "top_level_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -540,12 +748,12 @@
"type": "ip"
},
"response_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -563,51 +771,61 @@
"ecs": {
"properties": {
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"error": {
"properties": {
"code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"message": {
- "norms": false,
- "type": "text"
+ "type": "text",
+ "norms": false
+ },
+ "stack_trace": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"event": {
"properties": {
"action": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"category": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"created": {
"type": "date"
},
"dataset": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"duration": {
"type": "long"
@@ -616,32 +834,39 @@
"type": "date"
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "ingested": {
+ "type": "date"
},
"kind": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"module": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"original": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"outcome": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"provider": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "reference": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"risk_score": {
"type": "float"
@@ -659,12 +884,16 @@
"type": "date"
},
"timezone": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "url": {
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -676,6 +905,31 @@
"accessed": {
"type": "date"
},
+ "attributes": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "code_signature": {
+ "properties": {
+ "exists": {
+ "type": "boolean"
+ },
+ "status": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subject_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "trusted": {
+ "type": "boolean"
+ },
+ "valid": {
+ "type": "boolean"
+ }
+ }
+ },
"created": {
"type": "date"
},
@@ -683,254 +937,318 @@
"type": "date"
},
"device": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"directory": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "drive_letter": {
+ "type": "keyword",
+ "ignore_above": 1
},
"extension": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"gid": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"group": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"hash": {
"properties": {
"md5": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"sha1": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"sha256": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"sha512": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"inode": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "mime_type": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"mode": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"mtime": {
"type": "date"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"owner": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"path": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "pe": {
+ "properties": {
+ "company": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "description": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "file_version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "original_file_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "product": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
},
"size": {
"type": "long"
},
"target_path": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"uid": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"geo": {
"properties": {
"city_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"continent_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"group": {
"properties": {
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hash": {
"properties": {
"md5": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"sha1": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"sha256": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"sha512": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"host": {
"properties": {
"architecture": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"containerized": {
"type": "boolean"
},
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"geo": {
"properties": {
"city_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"continent_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hostname": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"ip": {
"type": "ip"
},
"mac": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"os": {
"properties": {
"build": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"codename": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"family": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"kernel": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"platform": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"uptime": {
"type": "long"
@@ -938,40 +1256,56 @@
"user": {
"properties": {
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"email": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"group": {
"properties": {
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -987,8 +1321,14 @@
"type": "long"
},
"content": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
},
@@ -996,12 +1336,12 @@
"type": "long"
},
"method": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"referrer": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1013,18 +1353,28 @@
"type": "long"
},
"content": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"bytes": {
"type": "long"
},
+ "redirects": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"status_code": {
"type": "long"
}
@@ -1077,8 +1427,8 @@
}
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1096,17 +1446,33 @@
}
}
},
+ "interface": {
+ "properties": {
+ "alias": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
"jolokia": {
"properties": {
"agent": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1116,22 +1482,22 @@
"server": {
"properties": {
"product": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"vendor": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"url": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1147,20 +1513,20 @@
"container": {
"properties": {
"image": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"deployment": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1172,42 +1538,42 @@
}
},
"namespace": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"node": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"pod": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"uid": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"replicaset": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"statefulset": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
}
@@ -1219,28 +1585,76 @@
"log": {
"properties": {
"level": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"logger": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "origin": {
+ "properties": {
+ "file": {
+ "properties": {
+ "line": {
+ "type": "long"
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "function": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
},
"original": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "syslog": {
+ "properties": {
+ "facility": {
+ "properties": {
+ "code": {
+ "type": "long"
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "priority": {
+ "type": "long"
+ },
+ "severity": {
+ "properties": {
+ "code": {
+ "type": "long"
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ }
+ }
}
}
},
"message": {
- "norms": false,
- "type": "text"
+ "type": "text",
+ "norms": false
},
"monitor": {
"properties": {
"check_group": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"duration": {
"properties": {
@@ -1250,282 +1664,766 @@
}
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"ip": {
"type": "ip"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"status": {
- "ignore_above": 1024,
- "type": "keyword"
- },
- "type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"timespan": {
"type": "date_range"
+ },
+ "type": {
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"network": {
"properties": {
"application": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"bytes": {
"type": "long"
},
"community_id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"direction": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"forwarded_ip": {
"type": "ip"
},
"iana_number": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "inner": {
+ "properties": {
+ "vlan": {
+ "properties": {
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ }
+ }
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"packets": {
"type": "long"
},
"protocol": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"transport": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "vlan": {
+ "properties": {
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
}
}
},
"observer": {
"properties": {
+ "egress": {
+ "properties": {
+ "interface": {
+ "properties": {
+ "alias": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "vlan": {
+ "properties": {
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "zone": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
"geo": {
"properties": {
"city_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"continent_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hostname": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "ingress": {
+ "properties": {
+ "interface": {
+ "properties": {
+ "alias": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "vlan": {
+ "properties": {
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "zone": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
},
"ip": {
"type": "ip"
},
"mac": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"os": {
"properties": {
"family": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"kernel": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"platform": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
+ "product": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"serial_number": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"vendor": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"organization": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
},
"os": {
"properties": {
"family": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"kernel": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"platform": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
- "process": {
+ "package": {
"properties": {
- "args": {
- "ignore_above": 1024,
- "type": "keyword"
+ "architecture": {
+ "type": "keyword",
+ "ignore_above": 1024
},
- "executable": {
- "ignore_above": 1024,
- "type": "keyword"
+ "build_version": {
+ "type": "keyword",
+ "ignore_above": 1024
},
- "hash": {
- "properties": {
- "md5": {
- "ignore_above": 1024,
- "type": "keyword"
- },
- "sha1": {
- "ignore_above": 1024,
- "type": "keyword"
- },
- "sha256": {
- "ignore_above": 1024,
- "type": "keyword"
- },
- "sha512": {
- "ignore_above": 1024,
- "type": "keyword"
- }
- }
+ "checksum": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "description": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "install_scope": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "installed": {
+ "type": "date"
+ },
+ "license": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
- "pgid": {
- "type": "long"
+ "path": {
+ "type": "keyword",
+ "ignore_above": 1024
},
- "pid": {
- "type": "long"
+ "reference": {
+ "type": "keyword",
+ "ignore_above": 1024
},
- "ppid": {
+ "size": {
"type": "long"
},
- "start": {
- "type": "date"
+ "type": {
+ "type": "keyword",
+ "ignore_above": 1024
},
- "thread": {
- "properties": {
- "id": {
- "type": "long"
- },
- "name": {
- "ignore_above": 1024,
- "type": "keyword"
- }
+ "version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "pe": {
+ "properties": {
+ "company": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "description": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "file_version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "original_file_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "product": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "process": {
+ "properties": {
+ "args": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "args_count": {
+ "type": "long"
+ },
+ "code_signature": {
+ "properties": {
+ "exists": {
+ "type": "boolean"
+ },
+ "status": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subject_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "trusted": {
+ "type": "boolean"
+ },
+ "valid": {
+ "type": "boolean"
+ }
+ }
+ },
+ "command_line": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "entity_id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "executable": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "exit_code": {
+ "type": "long"
+ },
+ "hash": {
+ "properties": {
+ "md5": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha1": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha256": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha512": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "name": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "parent": {
+ "properties": {
+ "args": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "args_count": {
+ "type": "long"
+ },
+ "code_signature": {
+ "properties": {
+ "exists": {
+ "type": "boolean"
+ },
+ "status": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subject_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "trusted": {
+ "type": "boolean"
+ },
+ "valid": {
+ "type": "boolean"
+ }
+ }
+ },
+ "command_line": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "entity_id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "executable": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "exit_code": {
+ "type": "long"
+ },
+ "hash": {
+ "properties": {
+ "md5": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha1": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha256": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha512": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "name": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "pgid": {
+ "type": "long"
+ },
+ "pid": {
+ "type": "long"
+ },
+ "ppid": {
+ "type": "long"
+ },
+ "start": {
+ "type": "date"
+ },
+ "thread": {
+ "properties": {
+ "id": {
+ "type": "long"
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "title": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "uptime": {
+ "type": "long"
+ },
+ "working_directory": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ }
+ }
+ },
+ "pe": {
+ "properties": {
+ "company": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "description": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "file_version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "original_file_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "product": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "pgid": {
+ "type": "long"
+ },
+ "pid": {
+ "type": "long"
+ },
+ "ppid": {
+ "type": "long"
+ },
+ "start": {
+ "type": "date"
+ },
+ "thread": {
+ "properties": {
+ "id": {
+ "type": "long"
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
}
},
"title": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"uptime": {
"type": "long"
},
"working_directory": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ }
+ }
+ },
+ "registry": {
+ "properties": {
+ "data": {
+ "properties": {
+ "bytes": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "strings": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "type": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "hive": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "key": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "path": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "value": {
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"related": {
"properties": {
+ "hash": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"ip": {
"type": "ip"
+ },
+ "user": {
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1543,11 +2441,55 @@
}
}
},
+ "rule": {
+ "properties": {
+ "author": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "category": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "description": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "license": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "reference": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "ruleset": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "uuid": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
"server": {
"properties": {
"address": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"as": {
"properties": {
@@ -1557,8 +2499,14 @@
"organization": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -1568,41 +2516,41 @@
"type": "long"
},
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"continent_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1610,8 +2558,8 @@
"type": "ip"
},
"mac": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"nat": {
"properties": {
@@ -1629,43 +2577,67 @@
"port": {
"type": "long"
},
+ "registered_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "top_level_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"user": {
"properties": {
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"email": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"group": {
"properties": {
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -1674,28 +2646,36 @@
"service": {
"properties": {
"ephemeral_id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "node": {
+ "properties": {
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
},
"state": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"type": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1717,8 +2697,8 @@
"source": {
"properties": {
"address": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"as": {
"properties": {
@@ -1728,8 +2708,14 @@
"organization": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -1739,41 +2725,41 @@
"type": "long"
},
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"geo": {
"properties": {
"city_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"continent_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"country_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"location": {
"type": "geo_point"
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_iso_code": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"region_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1781,8 +2767,8 @@
"type": "ip"
},
"mac": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"nat": {
"properties": {
@@ -1800,43 +2786,67 @@
"port": {
"type": "long"
},
+ "registered_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "top_level_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"user": {
"properties": {
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"email": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"group": {
"properties": {
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
}
@@ -1853,8 +2863,8 @@
}
},
"tags": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"tcp": {
"properties": {
@@ -1878,11 +2888,57 @@
}
}
},
+ "threat": {
+ "properties": {
+ "framework": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "tactic": {
+ "properties": {
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "reference": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "technique": {
+ "properties": {
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "reference": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ }
+ }
+ },
"timeseries": {
"properties": {
"instance": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1894,6 +2950,78 @@
"certificate_not_valid_before": {
"type": "date"
},
+ "cipher": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "client": {
+ "properties": {
+ "certificate": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "certificate_chain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "hash": {
+ "properties": {
+ "md5": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha1": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha256": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "issuer": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "ja3": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "not_after": {
+ "type": "date"
+ },
+ "not_before": {
+ "type": "date"
+ },
+ "server_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subject": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "supported_ciphers": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "curve": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "established": {
+ "type": "boolean"
+ },
+ "next_protocol": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "resumed": {
+ "type": "boolean"
+ },
"rtt": {
"properties": {
"handshake": {
@@ -1904,6 +3032,114 @@
}
}
}
+ },
+ "server": {
+ "properties": {
+ "certificate": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "certificate_chain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "hash": {
+ "properties": {
+ "md5": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha1": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "sha256": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "issuer": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "ja3s": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "not_after": {
+ "type": "date"
+ },
+ "not_before": {
+ "type": "date"
+ },
+ "subject": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "x509": {
+ "properties": {
+ "issuer": {
+ "properties": {
+ "common_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "distinguished_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "not_after": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "not_before": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "public_key_algorithm": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "public_key_exponent": {
+ "type": "long"
+ },
+ "public_key_size": {
+ "type": "long"
+ },
+ "serial_number": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "signature_algorithm": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "subject": {
+ "properties": {
+ "common_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "distinguished_name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ }
+ }
+ }
+ }
+ },
+ "version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "version_protocol": {
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
@@ -1912,16 +3148,16 @@
"trace": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"transaction": {
"properties": {
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
}
@@ -1930,83 +3166,123 @@
"url": {
"properties": {
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "extension": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"fragment": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"original": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"password": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"path": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"port": {
"type": "long"
},
"query": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "registered_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"scheme": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "top_level_domain": {
+ "type": "keyword",
+ "ignore_above": 1024
},
"username": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"user": {
"properties": {
"domain": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"email": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full_name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"group": {
"properties": {
+ "domain": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"hash": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"id": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
}
}
},
@@ -2015,370 +3291,467 @@
"device": {
"properties": {
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"original": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"os": {
"properties": {
"family": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"full": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"kernel": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"name": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
},
"platform": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
},
"version": {
- "ignore_above": 1024,
- "type": "keyword"
+ "type": "keyword",
+ "ignore_above": 1024
}
}
- }
- }
- },
- "settings": {
- "index": {
- "mapping": {
- "total_fields": {
- "limit": "10000"
+ },
+ "vlan": {
+ "properties": {
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "name": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
}
},
- "number_of_replicas": "1",
- "number_of_shards": "1",
- "query": {
- "default_field": [
- "message",
- "tags",
- "agent.ephemeral_id",
- "agent.id",
- "agent.name",
- "agent.type",
- "agent.version",
- "as.organization.name",
- "client.address",
- "client.as.organization.name",
- "client.domain",
- "client.geo.city_name",
- "client.geo.continent_name",
- "client.geo.country_iso_code",
- "client.geo.country_name",
- "client.geo.name",
- "client.geo.region_iso_code",
- "client.geo.region_name",
- "client.mac",
- "client.user.domain",
- "client.user.email",
- "client.user.full_name",
- "client.user.group.id",
- "client.user.group.name",
- "client.user.hash",
- "client.user.id",
- "client.user.name",
- "cloud.account.id",
- "cloud.availability_zone",
- "cloud.instance.id",
- "cloud.instance.name",
- "cloud.machine.type",
- "cloud.provider",
- "cloud.region",
- "container.id",
- "container.image.name",
- "container.image.tag",
- "container.name",
- "container.runtime",
- "destination.address",
- "destination.as.organization.name",
- "destination.domain",
- "destination.geo.city_name",
- "destination.geo.continent_name",
- "destination.geo.country_iso_code",
- "destination.geo.country_name",
- "destination.geo.name",
- "destination.geo.region_iso_code",
- "destination.geo.region_name",
- "destination.mac",
- "destination.user.domain",
- "destination.user.email",
- "destination.user.full_name",
- "destination.user.group.id",
- "destination.user.group.name",
- "destination.user.hash",
- "destination.user.id",
- "destination.user.name",
- "dns.answers.class",
- "dns.answers.data",
- "dns.answers.name",
- "dns.answers.type",
- "dns.header_flags",
- "dns.id",
- "dns.op_code",
- "dns.question.class",
- "dns.question.name",
- "dns.question.registered_domain",
- "dns.question.type",
- "dns.response_code",
- "dns.type",
- "ecs.version",
- "error.code",
- "error.id",
- "error.message",
- "event.action",
- "event.category",
- "event.code",
- "event.dataset",
- "event.hash",
- "event.id",
- "event.kind",
- "event.module",
- "event.original",
- "event.outcome",
- "event.provider",
- "event.timezone",
- "event.type",
- "file.device",
- "file.directory",
- "file.extension",
- "file.gid",
- "file.group",
- "file.hash.md5",
- "file.hash.sha1",
- "file.hash.sha256",
- "file.hash.sha512",
- "file.inode",
- "file.mode",
- "file.name",
- "file.owner",
- "file.path",
- "file.target_path",
- "file.type",
- "file.uid",
- "geo.city_name",
- "geo.continent_name",
- "geo.country_iso_code",
- "geo.country_name",
- "geo.name",
- "geo.region_iso_code",
- "geo.region_name",
- "group.id",
- "group.name",
- "hash.md5",
- "hash.sha1",
- "hash.sha256",
- "hash.sha512",
- "host.architecture",
- "host.geo.city_name",
- "host.geo.continent_name",
- "host.geo.country_iso_code",
- "host.geo.country_name",
- "host.geo.name",
- "host.geo.region_iso_code",
- "host.geo.region_name",
- "host.hostname",
- "host.id",
- "host.mac",
- "host.name",
- "host.os.family",
- "host.os.full",
- "host.os.kernel",
- "host.os.name",
- "host.os.platform",
- "host.os.version",
- "host.type",
- "host.user.domain",
- "host.user.email",
- "host.user.full_name",
- "host.user.group.id",
- "host.user.group.name",
- "host.user.hash",
- "host.user.id",
- "host.user.name",
- "http.request.body.content",
- "http.request.method",
- "http.request.referrer",
- "http.response.body.content",
- "http.version",
- "log.level",
- "log.logger",
- "log.original",
- "network.application",
- "network.community_id",
- "network.direction",
- "network.iana_number",
- "network.name",
- "network.protocol",
- "network.transport",
- "network.type",
- "observer.geo.city_name",
- "observer.geo.continent_name",
- "observer.geo.country_iso_code",
- "observer.geo.country_name",
- "observer.geo.name",
- "observer.geo.region_iso_code",
- "observer.geo.region_name",
- "observer.hostname",
- "observer.mac",
- "observer.os.family",
- "observer.os.full",
- "observer.os.kernel",
- "observer.os.name",
- "observer.os.platform",
- "observer.os.version",
- "observer.serial_number",
- "observer.type",
- "observer.vendor",
- "observer.version",
- "organization.id",
- "organization.name",
- "os.family",
- "os.full",
- "os.kernel",
- "os.name",
- "os.platform",
- "os.version",
- "process.args",
- "process.executable",
- "process.hash.md5",
- "process.hash.sha1",
- "process.hash.sha256",
- "process.hash.sha512",
- "process.name",
- "process.thread.name",
- "process.title",
- "process.working_directory",
- "server.address",
- "server.as.organization.name",
- "server.domain",
- "server.geo.city_name",
- "server.geo.continent_name",
- "server.geo.country_iso_code",
- "server.geo.country_name",
- "server.geo.name",
- "server.geo.region_iso_code",
- "server.geo.region_name",
- "server.mac",
- "server.user.domain",
- "server.user.email",
- "server.user.full_name",
- "server.user.group.id",
- "server.user.group.name",
- "server.user.hash",
- "server.user.id",
- "server.user.name",
- "service.ephemeral_id",
- "service.id",
- "service.name",
- "service.state",
- "service.type",
- "service.version",
- "source.address",
- "source.as.organization.name",
- "source.domain",
- "source.geo.city_name",
- "source.geo.continent_name",
- "source.geo.country_iso_code",
- "source.geo.country_name",
- "source.geo.name",
- "source.geo.region_iso_code",
- "source.geo.region_name",
- "source.mac",
- "source.user.domain",
- "source.user.email",
- "source.user.full_name",
- "source.user.group.id",
- "source.user.group.name",
- "source.user.hash",
- "source.user.id",
- "source.user.name",
- "tracing.trace.id",
- "tracing.transaction.id",
- "url.domain",
- "url.fragment",
- "url.full",
- "url.original",
- "url.password",
- "url.path",
- "url.query",
- "url.scheme",
- "url.username",
- "user.domain",
- "user.email",
- "user.full_name",
- "user.group.id",
- "user.group.name",
- "user.hash",
- "user.id",
- "user.name",
- "user_agent.device.name",
- "user_agent.name",
- "user_agent.original",
- "user_agent.os.family",
- "user_agent.os.full",
- "user_agent.os.kernel",
- "user_agent.os.name",
- "user_agent.os.platform",
- "user_agent.os.version",
- "user_agent.version",
- "agent.hostname",
- "error.type",
- "timeseries.instance",
- "cloud.project.id",
- "cloud.image.id",
- "host.os.build",
- "host.os.codename",
- "kubernetes.pod.name",
- "kubernetes.pod.uid",
- "kubernetes.namespace",
- "kubernetes.node.name",
- "kubernetes.replicaset.name",
- "kubernetes.deployment.name",
- "kubernetes.statefulset.name",
- "kubernetes.container.name",
- "kubernetes.container.image",
- "jolokia.agent.version",
- "jolokia.agent.id",
- "jolokia.server.product",
- "jolokia.server.version",
- "jolokia.server.vendor",
- "jolokia.url",
- "monitor.type",
- "monitor.name",
- "monitor.id",
- "monitor.status",
- "monitor.check_group",
- "http.response.body.hash",
- "fields.*"
- ]
- },
- "refresh_interval": "5s"
+ "vulnerability": {
+ "properties": {
+ "category": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "classification": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "description": {
+ "type": "keyword",
+ "fields": {
+ "text": {
+ "type": "text",
+ "norms": false
+ }
+ },
+ "ignore_above": 1024
+ },
+ "enumeration": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "reference": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "report_id": {
+ "type": "keyword",
+ "ignore_above": 1024
+ },
+ "scanner": {
+ "properties": {
+ "vendor": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "score": {
+ "properties": {
+ "base": {
+ "type": "float"
+ },
+ "environmental": {
+ "type": "float"
+ },
+ "temporal": {
+ "type": "float"
+ },
+ "version": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ },
+ "severity": {
+ "type": "keyword",
+ "ignore_above": 1024
+ }
+ }
+ }
}
}
+ },
+ "settings": {
+ "index": {
+ "mapping": {
+ "total_fields": {
+ "limit": "10000"
+ }
+ },
+ "number_of_replicas": "1",
+ "number_of_shards": "1",
+ "query": {
+ "default_field": [
+ "message",
+ "tags",
+ "agent.ephemeral_id",
+ "agent.id",
+ "agent.name",
+ "agent.type",
+ "agent.version",
+ "as.organization.name",
+ "client.address",
+ "client.as.organization.name",
+ "client.domain",
+ "client.geo.city_name",
+ "client.geo.continent_name",
+ "client.geo.country_iso_code",
+ "client.geo.country_name",
+ "client.geo.name",
+ "client.geo.region_iso_code",
+ "client.geo.region_name",
+ "client.mac",
+ "client.user.domain",
+ "client.user.email",
+ "client.user.full_name",
+ "client.user.group.id",
+ "client.user.group.name",
+ "client.user.hash",
+ "client.user.id",
+ "client.user.name",
+ "cloud.account.id",
+ "cloud.availability_zone",
+ "cloud.instance.id",
+ "cloud.instance.name",
+ "cloud.machine.type",
+ "cloud.provider",
+ "cloud.region",
+ "container.id",
+ "container.image.name",
+ "container.image.tag",
+ "container.name",
+ "container.runtime",
+ "destination.address",
+ "destination.as.organization.name",
+ "destination.domain",
+ "destination.geo.city_name",
+ "destination.geo.continent_name",
+ "destination.geo.country_iso_code",
+ "destination.geo.country_name",
+ "destination.geo.name",
+ "destination.geo.region_iso_code",
+ "destination.geo.region_name",
+ "destination.mac",
+ "destination.user.domain",
+ "destination.user.email",
+ "destination.user.full_name",
+ "destination.user.group.id",
+ "destination.user.group.name",
+ "destination.user.hash",
+ "destination.user.id",
+ "destination.user.name",
+ "dns.answers.class",
+ "dns.answers.data",
+ "dns.answers.name",
+ "dns.answers.type",
+ "dns.header_flags",
+ "dns.id",
+ "dns.op_code",
+ "dns.question.class",
+ "dns.question.name",
+ "dns.question.registered_domain",
+ "dns.question.type",
+ "dns.response_code",
+ "dns.type",
+ "ecs.version",
+ "error.code",
+ "error.id",
+ "error.message",
+ "event.action",
+ "event.category",
+ "event.code",
+ "event.dataset",
+ "event.hash",
+ "event.id",
+ "event.kind",
+ "event.module",
+ "event.original",
+ "event.outcome",
+ "event.provider",
+ "event.timezone",
+ "event.type",
+ "file.device",
+ "file.directory",
+ "file.extension",
+ "file.gid",
+ "file.group",
+ "file.hash.md5",
+ "file.hash.sha1",
+ "file.hash.sha256",
+ "file.hash.sha512",
+ "file.inode",
+ "file.mode",
+ "file.name",
+ "file.owner",
+ "file.path",
+ "file.target_path",
+ "file.type",
+ "file.uid",
+ "geo.city_name",
+ "geo.continent_name",
+ "geo.country_iso_code",
+ "geo.country_name",
+ "geo.name",
+ "geo.region_iso_code",
+ "geo.region_name",
+ "group.id",
+ "group.name",
+ "hash.md5",
+ "hash.sha1",
+ "hash.sha256",
+ "hash.sha512",
+ "host.architecture",
+ "host.geo.city_name",
+ "host.geo.continent_name",
+ "host.geo.country_iso_code",
+ "host.geo.country_name",
+ "host.geo.name",
+ "host.geo.region_iso_code",
+ "host.geo.region_name",
+ "host.hostname",
+ "host.id",
+ "host.mac",
+ "host.name",
+ "host.os.family",
+ "host.os.full",
+ "host.os.kernel",
+ "host.os.name",
+ "host.os.platform",
+ "host.os.version",
+ "host.type",
+ "host.user.domain",
+ "host.user.email",
+ "host.user.full_name",
+ "host.user.group.id",
+ "host.user.group.name",
+ "host.user.hash",
+ "host.user.id",
+ "host.user.name",
+ "http.request.body.content",
+ "http.request.method",
+ "http.request.referrer",
+ "http.response.body.content",
+ "http.version",
+ "log.level",
+ "log.logger",
+ "log.original",
+ "network.application",
+ "network.community_id",
+ "network.direction",
+ "network.iana_number",
+ "network.name",
+ "network.protocol",
+ "network.transport",
+ "network.type",
+ "observer.geo.city_name",
+ "observer.geo.continent_name",
+ "observer.geo.country_iso_code",
+ "observer.geo.country_name",
+ "observer.geo.name",
+ "observer.geo.region_iso_code",
+ "observer.geo.region_name",
+ "observer.hostname",
+ "observer.mac",
+ "observer.os.family",
+ "observer.os.full",
+ "observer.os.kernel",
+ "observer.os.name",
+ "observer.os.platform",
+ "observer.os.version",
+ "observer.serial_number",
+ "observer.type",
+ "observer.vendor",
+ "observer.version",
+ "organization.id",
+ "organization.name",
+ "os.family",
+ "os.full",
+ "os.kernel",
+ "os.name",
+ "os.platform",
+ "os.version",
+ "process.args",
+ "process.executable",
+ "process.hash.md5",
+ "process.hash.sha1",
+ "process.hash.sha256",
+ "process.hash.sha512",
+ "process.name",
+ "process.thread.name",
+ "process.title",
+ "process.working_directory",
+ "server.address",
+ "server.as.organization.name",
+ "server.domain",
+ "server.geo.city_name",
+ "server.geo.continent_name",
+ "server.geo.country_iso_code",
+ "server.geo.country_name",
+ "server.geo.name",
+ "server.geo.region_iso_code",
+ "server.geo.region_name",
+ "server.mac",
+ "server.user.domain",
+ "server.user.email",
+ "server.user.full_name",
+ "server.user.group.id",
+ "server.user.group.name",
+ "server.user.hash",
+ "server.user.id",
+ "server.user.name",
+ "service.ephemeral_id",
+ "service.id",
+ "service.name",
+ "service.state",
+ "service.type",
+ "service.version",
+ "source.address",
+ "source.as.organization.name",
+ "source.domain",
+ "source.geo.city_name",
+ "source.geo.continent_name",
+ "source.geo.country_iso_code",
+ "source.geo.country_name",
+ "source.geo.name",
+ "source.geo.region_iso_code",
+ "source.geo.region_name",
+ "source.mac",
+ "source.user.domain",
+ "source.user.email",
+ "source.user.full_name",
+ "source.user.group.id",
+ "source.user.group.name",
+ "source.user.hash",
+ "source.user.id",
+ "source.user.name",
+ "tracing.trace.id",
+ "tracing.transaction.id",
+ "url.domain",
+ "url.fragment",
+ "url.full",
+ "url.original",
+ "url.password",
+ "url.path",
+ "url.query",
+ "url.scheme",
+ "url.username",
+ "user.domain",
+ "user.email",
+ "user.full_name",
+ "user.group.id",
+ "user.group.name",
+ "user.hash",
+ "user.id",
+ "user.name",
+ "user_agent.device.name",
+ "user_agent.name",
+ "user_agent.original",
+ "user_agent.os.family",
+ "user_agent.os.full",
+ "user_agent.os.kernel",
+ "user_agent.os.name",
+ "user_agent.os.platform",
+ "user_agent.os.version",
+ "user_agent.version",
+ "agent.hostname",
+ "error.type",
+ "timeseries.instance",
+ "cloud.project.id",
+ "cloud.image.id",
+ "host.os.build",
+ "host.os.codename",
+ "kubernetes.pod.name",
+ "kubernetes.pod.uid",
+ "kubernetes.namespace",
+ "kubernetes.node.name",
+ "kubernetes.replicaset.name",
+ "kubernetes.deployment.name",
+ "kubernetes.statefulset.name",
+ "kubernetes.container.name",
+ "kubernetes.container.image",
+ "jolokia.agent.version",
+ "jolokia.agent.id",
+ "jolokia.server.product",
+ "jolokia.server.version",
+ "jolokia.server.vendor",
+ "jolokia.url",
+ "monitor.type",
+ "monitor.name",
+ "monitor.id",
+ "monitor.status",
+ "monitor.check_group",
+ "http.response.body.hash",
+ "fields.*"
+ ]
+ },
+ "refresh_interval": "5s"
+ }
}
}
diff --git a/x-pack/test/functional_endpoint/apps/endpoint/host_list.ts b/x-pack/test/functional_endpoint/apps/endpoint/host_list.ts
index 9a4ffecf85d52..35843dc6a76db 100644
--- a/x-pack/test/functional_endpoint/apps/endpoint/host_list.ts
+++ b/x-pack/test/functional_endpoint/apps/endpoint/host_list.ts
@@ -12,7 +12,8 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
const esArchiver = getService('esArchiver');
const testSubjects = getService('testSubjects');
- describe('host list', function() {
+ // FLAKY: https://github.com/elastic/kibana/issues/63621
+ describe.skip('host list', function() {
this.tags('ciGroup7');
const sleep = (ms = 100) => new Promise(resolve => setTimeout(resolve, ms));
before(async () => {
diff --git a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
index 0e6f991be24d0..562f64656319e 100644
--- a/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
+++ b/x-pack/test/functional_with_es_ssl/apps/triggers_actions_ui/connectors.ts
@@ -185,7 +185,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
expect(searchResultsAfterDelete.length).to.eql(0);
});
- it('should not be able to delete a pre-configured connector', async () => {
+ it('should not be able to delete a preconfigured connector', async () => {
const preconfiguredConnectorName = 'xyz';
await pageObjects.triggersActionsUI.searchConnectors(preconfiguredConnectorName);
@@ -196,7 +196,7 @@ export default ({ getPageObjects, getService }: FtrProviderContext) => {
expect(await testSubjects.exists('preConfiguredTitleMessage')).to.be(true);
});
- it('should not be able to edit a pre-configured connector', async () => {
+ it('should not be able to edit a preconfigured connector', async () => {
const preconfiguredConnectorName = 'xyz';
await pageObjects.triggersActionsUI.searchConnectors(preconfiguredConnectorName);
diff --git a/yarn.lock b/yarn.lock
index 45540cd2675b7..b47befbf9057b 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4477,10 +4477,10 @@
dependencies:
"@types/node" "*"
-"@types/papaparse@^4.5.11":
- version "4.5.11"
- resolved "https://registry.yarnpkg.com/@types/papaparse/-/papaparse-4.5.11.tgz#dcd4f64da55f768c2e2cf92ccac1973c67a73890"
- integrity sha512-zOw6K7YyA/NuZ2yZ8lzZFe2U3fn+vFfcRfiQp4ZJHG6y8WYWy2SYFbq6mp4yUgpIruJHBjKZtgyE0vvCoWEq+A==
+"@types/papaparse@^5.0.3":
+ version "5.0.3"
+ resolved "https://registry.yarnpkg.com/@types/papaparse/-/papaparse-5.0.3.tgz#7cedc1ebc9484819af8306a8b42f9f08ca9bdb44"
+ integrity sha512-SgWGWnBGxl6XgjKDM2eoDg163ZFQtH6m6C2aOuaAf1T2gUB3rjaiPDDARbY9WlacRgZqieRG9imAfJaJ+5ouDA==
dependencies:
"@types/node" "*"
@@ -22585,10 +22585,10 @@ pako@~1.0.5:
resolved "https://registry.yarnpkg.com/pako/-/pako-1.0.6.tgz#0101211baa70c4bca4a0f63f2206e97b7dfaf258"
integrity sha512-lQe48YPsMJAig+yngZ87Lus+NF+3mtu7DVOBu6b/gHO1YpKwIj5AWjZ/TOS7i46HD/UixzWb1zeWDZfGZ3iYcg==
-papaparse@^4.6.3:
- version "4.6.3"
- resolved "https://registry.yarnpkg.com/papaparse/-/papaparse-4.6.3.tgz#742e5eaaa97fa6c7e1358d2934d8f18f44aee781"
- integrity sha512-LRq7BrHC2kHPBYSD50aKuw/B/dGcg29omyJbKWY3KsYUZU69RKwaBHu13jGmCYBtOc4odsLCrFyk6imfyNubJQ==
+papaparse@^5.2.0:
+ version "5.2.0"
+ resolved "https://registry.yarnpkg.com/papaparse/-/papaparse-5.2.0.tgz#97976a1b135c46612773029153dc64995caa3b7b"
+ integrity sha512-ylq1wgUSnagU+MKQtNeVqrPhZuMYBvOSL00DHycFTCxownF95gpLAk1HiHdUW77N8yxRq1qHXLdlIPyBSG9NSA==
parallel-transform@^1.1.0:
version "1.1.0"