Create ECS compliant index templates #270

AlexRuiz7 · 2024-06-18T15:20:14Z

AlexRuiz7 · 2024-06-18T16:25:04Z

`agents` index data model

Fields summary

The fields are based on wazuh/wazuh#23396 (comment)

Field	ECS field	Type	Description
uuid	`agent.id`	keyword	Agent's ID
name	`agent.name`	keyword	Agent's name
groups	*`agent.groups`	keyword	Agent's groups
internal_key	*`agent.key`	keyword	Agent's registration key
type	`agent.type`	keyword	Type of agent
version	`agent.version`	keyword	Agent's version
connection_status	*`agent.is_connected`	boolean	Agents' interpreted connection status depending on `agent.last_login`
last_keepalive	*`agent.last_login`	date	Agent's last login
ip	`host.ip`	ip	Host IP addresses. Note: this field should contain an array of values.
os_*	`host.os.full`	keyword	Operating system name, including the version or code name.

* Custom field

ECS mapping

---
name: agent
fields:
  base:
    fields:
      tags: []
  agent:
    fields:
      id: {}
      name: {}
      type: {}
      version: {}
      groups: {}
      key: {}
      last_login: {}
      is_connected: {}
  host:
    fields:
      ip: {}
      os:
        fields:
          full: {}

---
---
- name: agent
  title: Wazuh Agents
  short: Wazuh Inc. custom fields.
  type: group
  group: 2
  fields:
    - name: groups
      type: keyword
      level: custom
      description: >
        The groups the agent belongs to.
    - name: key
      type: keyword
      level: custom
      description: >
        The agent's registration key.
    - name: last_login
      type: date
      level: custom
      description: >
        The agent's last login.
    - name: is_connected
      type: boolean
      level: custom
      description: >
        Agents' interpreted connection status depending on `agent.last_login`.

Index settings

{
    "index_patterns": [".agents*"],
    "priority": 1,
    "template": {
        "settings": {
            "index": {
                "hidden": true,
                "number_of_shards": "1",
                "number_of_replicas": "0",
                "refresh_interval": "5s",
                "query.default_field": [
                    "agent.id",
                    "agent.groups",
                    "agent.name",
                    "agent.type",
                    "agent.version",
                    "agent.name",
                    "host.os.full",
                    "host.ip"
                ]
            }
        }
    }
}

AlexRuiz7 · 2024-06-18T17:27:48Z

`wazuh-alerts-5.x` time series index

Stateless index.

Fields summary

For this stage, we are using all the fields of the ECS. No custom fields are used. As a result, we are using the default mapping of the ECS.

ECS main mappings

The generated template must match this one.

ECS mapping

---
name: main
fields:
    base:
        fields: "*"
    agent:
        fields: "*"
    as:
        fields: "*"
    client:
        fields:
            address: {}
            as:
                fields: "*"
            bytes: {}
            domain: {}
            geo:
                fields: "*"
            ip: {}
            mac: {}
            nat:
                fields:
                    ip: {}
                    port: {}
            packets: {}
            port: {}
            subdomain: {}
            registered_domain: {}
            top_level_domain: {}
            user:
                fields:
                    domain: {}
                    email: {}
                    full_name: {}
                    group:
                        fields: "*"
                    hash: {}
                    id: {}
                    name: {}
                    roles: {}
    cloud:
        fields: "*"
    code_signature:
        fields: "*"
    container:
        fields: "*"
    data_stream:
        fields: "*"
    destination:
        fields:
            address: {}
            as:
                fields: "*"
            bytes: {}
            domain: {}
            geo:
                fields: "*"
            ip: {}
            mac: {}
            nat:
                fields:
                    ip: {}
                    port: {}
            packets: {}
            port: {}
            subdomain: {}
            registered_domain: {}
            top_level_domain: {}
            user:
                fields:
                    domain: {}
                    email: {}
                    full_name: {}
                    group:
                        fields: "*"
                    hash: {}
                    id: {}
                    name: {}
                    roles: {}
    device:
        fields: "*"
    dll:
        fields: "*"
    dns:
        fields: "*"
    ecs:
        fields: "*"
    elf:
        fields: "*"
    email:
        fields: "*"
    error:
        fields: "*"
    event:
        fields: "*"
    faas:
        fields: "*"
    file:
        fields: "*"
    geo:
        fields: "*"
    group:
        fields: "*"
    hash:
        fields: "*"
    host:
        fields: "*"
    http:
        fields: "*"
    interface:
        fields: "*"
    log:
        fields: "*"
    macho:
        fields: "*"
    network:
        fields: "*"
    observer:
        fields: "*"
    orchestrator:
        fields: "*"
    organization:
        fields: "*"
    os:
        fields: "*"
    package:
        fields: "*"
    pe:
        fields: "*"
    process:
        fields:
            args: {}
            args_count: {}
            code_signature:
                fields: "*"
            command_line: {}
            elf:
                fields: "*"
            end: {}
            entity_id: {}
            entry_leader:
                fields:
                    args: {}
                    args_count: {}
                    command_line: {}
                    entity_id: {}
                    entry_meta:
                        fields:
                            type: {}
                            source:
                                fields:
                                    ip: {}
                    executable: {}
                    interactive: {}
                    name: {}
                    parent:
                        fields:
                            entity_id: {}
                            pid: {}
                            vpid: {}
                            start: {}
                            session_leader:
                                fields:
                                    entity_id: {}
                                    pid: {}
                                    vpid: {}
                                    start: {}
                    pid: {}
                    vpid: {}
                    same_as_process: {}
                    start: {}
                    tty:
                        fields:
                            char_device:
                                fields:
                                    major: {}
                                    minor: {}
                    working_directory: {}
                    user:
                        fields:
                            id: {}
                            name: {}
                    real_user:
                        fields:
                            id: {}
                            name: {}
                    saved_user:
                        fields:
                            id: {}
                            name: {}
                    group:
                        fields:
                            id: {}
                            name: {}
                    real_group:
                        fields:
                            id: {}
                            name: {}
                    saved_group:
                        fields:
                            id: {}
                            name: {}
                    supplemental_groups:
                        fields:
                            id: {}
                            name: {}
                    attested_user:
                        fields:
                            id: {}
                            name: {}
                    attested_groups:
                        fields:
                            name: {}
            entry_meta:
                fields:
                    type:
                        docs_only: True
            env_vars: {}
            executable: {}
            exit_code: {}
            group_leader:
                fields:
                    args: {}
                    args_count: {}
                    command_line: {}
                    entity_id: {}
                    executable: {}
                    interactive: {}
                    name: {}
                    pid: {}
                    vpid: {}
                    same_as_process: {}
                    start: {}
                    tty:
                        fields:
                            char_device:
                                fields:
                                    major: {}
                                    minor: {}
                    working_directory: {}
                    user:
                        fields:
                            id: {}
                            name: {}
                    real_user:
                        fields:
                            id: {}
                            name: {}
                    saved_user:
                        fields:
                            id: {}
                            name: {}
                    group:
                        fields:
                            id: {}
                            name: {}
                    real_group:
                        fields:
                            id: {}
                            name: {}
                    saved_group:
                        fields:
                            id: {}
                            name: {}
                    supplemental_groups:
                        fields:
                            id: {}
                            name: {}
            hash:
                fields: "*"
            interactive: {}
            io:
                fields: "*"
            macho:
                fields: "*"
            name: {}
            parent:
                fields:
                    args: {}
                    args_count: {}
                    code_signature:
                        fields: "*"
                    command_line: {}
                    elf:
                        fields: "*"
                    end: {}
                    entity_id: {}
                    executable: {}
                    exit_code: {}
                    group_leader:
                        fields:
                            entity_id: {}
                            pid: {}
                            vpid: {}
                            start: {}
                    hash:
                        fields: "*"
                    interactive: {}
                    macho:
                        fields: "*"
                    name: {}
                    pe:
                        fields: "*"
                    pgid: {}
                    pid: {}
                    vpid: {}
                    start: {}
                    thread:
                        fields:
                            id: {}
                            name: {}
                            capabilities:
                                fields:
                                    effective: {}
                                    permitted: {}
                    title: {}
                    tty:
                        fields:
                            char_device:
                                fields:
                                    major: {}
                                    minor: {}
                    uptime: {}
                    working_directory: {}
                    user:
                        fields:
                            id: {}
                            name: {}
                    real_user:
                        fields:
                            id: {}
                            name: {}
                    saved_user:
                        fields:
                            id: {}
                            name: {}
                    group:
                        fields:
                            id: {}
                            name: {}
                    real_group:
                        fields:
                            id: {}
                            name: {}
                    saved_group:
                        fields:
                            id: {}
                            name: {}
                    supplemental_groups:
                        fields:
                            id: {}
                            name: {}
            pe:
                fields: "*"
            pgid: {}
            pid: {}
            vpid: {}
            previous:
                fields:
                    args: {}
                    args_count: {}
                    executable: {}
            real_group:
                fields:
                    id: {}
                    name: {}
            real_user:
                fields:
                    id: {}
                    name: {}
            same_as_process:
                docs_only: True
            saved_group:
                fields:
                    id: {}
                    name: {}
            saved_user:
                fields:
                    id: {}
                    name: {}
            start: {}
            supplemental_groups:
                fields:
                    id: {}
                    name: {}
            session_leader:
                fields:
                    args: {}
                    args_count: {}
                    command_line: {}
                    entity_id: {}
                    executable: {}
                    interactive: {}
                    name: {}
                    pid: {}
                    vpid: {}
                    same_as_process: {}
                    start: {}
                    tty:
                        fields:
                            char_device:
                                fields:
                                    major: {}
                                    minor: {}
                    working_directory: {}
                    parent:
                        fields:
                            entity_id: {}
                            pid: {}
                            vpid: {}
                            start: {}
                            session_leader:
                                fields:
                                    entity_id: {}
                                    pid: {}
                                    vpid: {}
                                    start: {}
                    user:
                        fields:
                            id: {}
                            name: {}
                    real_user:
                        fields:
                            id: {}
                            name: {}
                    saved_user:
                        fields:
                            id: {}
                            name: {}
                    group:
                        fields:
                            id: {}
                            name: {}
                    real_group:
                        fields:
                            id: {}
                            name: {}
                    saved_group:
                        fields:
                            id: {}
                            name: {}
                    supplemental_groups:
                        fields:
                            id: {}
                            name: {}
            thread:
                fields:
                    id: {}
                    name: {}
                    capabilities:
                        fields:
                            effective: {}
                            permitted: {}
            title: {}
            tty:
                fields: "*"
            uptime: {}
            user:
                fields:
                    id: {}
                    name: {}
            working_directory: {}
    registry:
        fields: "*"
    related:
        fields: "*"
    risk:
        fields: "*"
    rule:
        fields: "*"
    server:
        fields:
            address: {}
            as:
                fields: "*"
            bytes: {}
            domain: {}
            geo:
                fields: "*"
            ip: {}
            mac: {}
            nat:
                fields:
                    ip: {}
                    port: {}
            packets: {}
            port: {}
            subdomain: {}
            registered_domain: {}
            top_level_domain: {}
            user:
                fields:
                    domain: {}
                    email: {}
                    full_name: {}
                    group:
                        fields: "*"
                    hash: {}
                    id: {}
                    name: {}
                    roles: {}
    service:
        fields: "*"
    source:
        fields:
            address: {}
            as:
                fields: "*"
            bytes: {}
            domain: {}
            geo:
                fields: "*"
            ip: {}
            mac: {}
            nat:
                fields:
                    ip: {}
                    port: {}
            packets: {}
            port: {}
            subdomain: {}
            registered_domain: {}
            top_level_domain: {}
            user:
                fields:
                    domain: {}
                    email: {}
                    full_name: {}
                    group:
                        fields: "*"
                    hash: {}
                    id: {}
                    name: {}
                    roles: {}
    threat:
        fields: "*"
    tls:
        fields: "*"
    tracing:
        fields: "*"
    url:
        fields: "*"
    user_agent:
        fields: "*"
    user:
        fields:
            changes:
                fields:
                    domain: {}
                    email: {}
                    group:
                        fields: "*"
                    full_name: {}
                    hash: {}
                    id: {}
                    name: {}
                    roles: {}
            domain: {}
            effective:
                fields:
                    domain: {}
                    email: {}
                    group:
                        fields: "*"
                    full_name: {}
                    hash: {}
                    id: {}
                    name: {}
                    roles: {}
            email: {}
            group:
                fields: "*"
            full_name: {}
            hash: {}
            id: {}
            name: {}
            risk:
                fields: "*"
            roles: {}
            target:
                fields:
                    domain: {}
                    email: {}
                    group:
                        fields: "*"
                    full_name: {}
                    hash: {}
                    id: {}
                    name: {}
                    roles: {}
    vlan:
        fields: "*"
    vulnerability:
        fields: "*"
    x509:
        fields: "*"

{
  "index_patterns": [
    "wazuh-alerts-5.x-*"
  ],
  "priority": 1,
  "template": {
    "settings": {
      "index": {
        "mapping": {
          "total_fields": {
            "limit": 2500
          }
        },
        "refresh_interval": "5s"
      }
    }
  }
}

AlexRuiz7 · 2024-06-18T17:42:09Z

The index templates above are in draft. When reviewed and approved. I'll create the tooling to generate these index templates automatically.

See https://github.com/wazuh/wazuh-indexer/blob/4.9.0/ecs

AlexRuiz7 · 2024-06-26T10:03:31Z

`wazuh-states-fim` index data model

Fields summary

The fields are based on #282 (comment)

Based on ECS:

Field	ECS field	Type	Description
	`agent.id`	keyword	Agent's ID
	*`agent.groups`	keyword	Agent's groups
arch	* ?	keyword	Is arch a file property?
attributes	`file.attributes`	keyword	Array of file attributes.
file	`file.name`	keyword	Name of the file including the extension, without the directory.
full_path	`file.path`	keyword	Full path to the file, including the file name.
gid	`file.gid`	keyword	Primary group ID (GID) of the file.
gname	`file.group`	keyword	Primary group name of the file.
inode	`file.inode`	keyword	Inode representing the file in the filesystem.
md5	`file.hash.md5`	keyword	MD5 hash of the file.
mtime	`file.mtime`	date	Last time the file's metadata changed.
perm	`file.mode`	keyword	File permissions in octal mode.
sha1	`file.hash.sha1`	keyword	SHA1 hash of the file.
sha256	`file.hash.sha256`	keyword	SHA256 hash of the file.
size	`file.size`	long	File size in bytes.
symbolic_path	`file.target_path`	keyword	Target path for symlinks.
type	`file.type`	keyword	File type (file, dir, or symlink).
uid	`file.uid`	keyword	User ID (UID) of the file owner.
uname	`file.owner`	keyword	File owner’s username.
value_name	`registry.key`	keyword	Hive-relative path of keys.
value_type	`registry.value`	keyword	Name of the value written.

* Custom field

ECS mapping

---
name: fim
fields:
    agent:
        fields:
            id: {}
            groups: {}
    file:
        fields:
            attributes: {}
            name: {}
            path: {}
            gid: {}
            group: {}
            inode: {}
            hash:
                fields:
                    md5: {}
                    sha1: {}
                    sha256: {}
            mtime: {}
            mode: {}
            size: {}
            target_path: {}
            type: {}
            uid: {}
            owner: {}
    registry:
        fields:
            key: {}
            value: {}

Index settings

{
    "index_patterns": ["wazuh-states-fim*"],
    "priority": 1,
    "template": {
        "settings": {
            "index": {
                "number_of_shards": "1",
                "number_of_replicas": "0",
                "refresh_interval": "5s",
                "query.default_field": [
                    "agent.id",
                    "agent.groups",
                    "file.name",
                    "file.path",
                    "file.target_path",
                    "file.group",
                    "file.uid",
                    "file.gid"
                ]
            }
        }
    }
}

AlexRuiz7 · 2024-06-26T10:58:25Z

`wazuh-states-vulnerabilities` index data model

Fields summary

The fields are based on https://github.com/wazuh/wazuh-indexer/blob/4.9.0/ecs/vulnerability-detector

Based on ECS:

ECS field	Type	Description
`agent.id`	keyword	Unique identifier of this agent (if one exists).
*`agent.groups`	keyword	Agent's groups
`agent.name`	keyword	Custom name of the agent.
`agent.type`	keyword	Type of the agent.
`agent.version`	keyword	Version of the agent.
`host.os.full`	keyword	Operating system name, including the version or code name.
`host.os.kernel`	keyword	Operating system kernel version as a raw string.
`host.os.name`	keyword	Operating system name, without the version.
`host.os.platform`	keyword	Operating system platform (such centos, ubuntu, windows).
`host.os.type`	keyword	Use the os.type field to categorize the operating system into one of the broad commercial families.
`host.os.version`	keyword	Operating system version as a raw string.
`package.architecture`	keyword	Package architecture.
`package.build_version`	keyword	Additional information about the build version of the installed package.
`package.checksum`	keyword	Checksum of the installed package for verification.
`package.description`	keyword	Description of the package.
`package.install_scope`	keyword	Indicating how the package was installed, e.g. user-local, global.
`package.installed`	date	Time when package was installed.
`package.license`	keyword	License under which the package was released.
`package.name`	keyword	Package name
`package.path`	keyword	Path where the package is installed.
`package.reference`	keyword	Home page or reference URL of the software in this package, if available.
`package.size`	long	Package size in bytes.
`package.type`	keyword	Type of package.
`package.version`	keyword	Package version
`vulnerability.category`	keyword	The type of system or architecture that the vulnerability affects
`vulnerability.classification`	keyword	The classification of the vulnerability scoring system.
`vulnerability.description`	keyword	The description of the vulnerability that provides additional context of the vulnerability
*`vulnerability.detected_at`	date	Vulnerability's detection date.
`vulnerability.enumeration`	keyword	The type of identifier used for this vulnerability.
`vulnerability.id`	keyword	The identification (ID) is the number portion of a vulnerability entry.
*`vulnerability.published_at`	date	Vulnerability's publication date.
`vulnerability.reference`	keyword	A resource that provides additional information, context, and mitigations for the identified vulnerability.
`vulnerability.report_id`	keyword	The report or scan identification number.
*`vulnerability.scanner.source`	keyword	The origin of the decision of the scanner (AKA feed used to detect the vulnerability).
`vulnerability.scanner.vendor`	keyword	The name of the vulnerability scanner vendor.
`vulnerability.score.base`	float	Scores can range from 0.0 to 10.0, with 10.0 being the most severe.
`vulnerability.score.environmental`	float	Scores can range from 0.0 to 10.0, with 10.0 being the most severe.
`vulnerability.score.temporal`	float	Scores can range from 0.0 to 10.0, with 10.0 being the most severe.
`vulnerability.score.version`	keyword	The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification.
`vulnerability.severity`	keyword	The severity of the vulnerability can help with metrics and internal prioritization regarding remediation.
*`vulnerability.under_evaluation`	boolean	Indicates if the vulnerability is awaiting analysis by the NVD.
*`wazuh.cluster.name`	keyword	Name of the Wazuh cluster.
*`wazuh.cluster.node`	keyword	Name of the Wazuh cluster node.
*`wazuh.schema.version`	keyword	Version of the Wazuh schema.

* Custom field

ECS mapping

---
name: wazuh-states-vulnerabilities
fields:
    base:
        tags: []
    agent:
        fields: "*"
    package:
        fields: "*"
    host:
        fields:
            os:
                fields:
                    full: ""
                    kernel: ""
                    name: ""
                    platform: ""
                    type: ""
                    version: ""
    vulnerability:
        fields: "*"
    wazuh:
        fields: "*"

---
- name: vulnerability
  title: Vulnerability
  group: 2
  short: Fields to describe the vulnerability relevant to an event.
  description: >
      The vulnerability fields describe information about a vulnerability that is
      relevant to an event.
  type: group
  fields:
      - name: detected_at
        type: date
        level: custom
        description: >
            Vulnerability's detection date.
      - name: published_at
        type: date
        level: custom
        description: >
            Vulnerability's publication date.
      - name: under_evaluation
        type: boolean
        level: custom
        description: >
            Indicates if the vulnerability is awaiting analysis by the NVD.
      - name: scanner.source
        type: keyword
        level: custom
        description: >
            The origin of the decision of the scanner (AKA feed used to detect the vulnerability).

---
---
- name: wazuh
  title: Wazuh
  description: >
      Wazuh Inc. custom fields
  fields:
      - name: cluster.name
        type: keyword
        level: custom
        description: >
            Wazuh cluster name.
      - name: cluster.node
        type: keyword
        level: custom
        description: >
            Wazuh cluster node name.
      - name: schema.version
        type: keyword
        level: custom
        description: >
            Wazuh schema version.

Index settings

{
    "index_patterns": ["wazuh-states-vulnerabilities*"],
    "priority": 1,
    "template": {
        "settings": {
            "index": {
                "number_of_shards": "1",
                "number_of_replicas": "0",
                "refresh_interval": "5s",
                "query.default_field": [
                    "agent.id",
                    "agent.group",
                    "host.os.full",
                    "host.os.version",
                    "package.name",
                    "package.version",
                    "vulnerability.id",
                    "vulnerability.description",
                    "vulnerability.severity",
                    "wazuh.cluster.name"
                ]
            }
        }
    }
}

AlexRuiz7 · 2024-07-02T09:53:41Z

Index templates for wazuh-monitoring and wazuh-statistics will be done for the MVP phase.

AlexRuiz7 · 2024-07-02T09:55:02Z

Index template for stateful-sca will be done for the MVP phase. It contains many static data that should not be indexed as part of each document.

AlexRuiz7 · 2024-09-05T11:14:15Z

`wazuh-states-inventory-system` index data model

Fields summary

The fields are based on #282 (comment)

Based on ECS:

Field name	ECS field name	Data type	Description
	`agent.id`	keyword	Agent's ID
	*`agent.groups`	keyword	Agent's groups
scan_time	`@timestamp`	date	Date/time when the event originated.
architecture	`host.architecture`	keyword	Operating system architecture.
hostname	`host.hostname`	keyword	Hostname of the host.
os_build	`host.os.kernel`	keyword	Operating system kernel version as a raw string.
os_codename	`host.os.full`	keyword	Operating system name, including the version or code name.
os_name	`host.os.name`	keyword	Operating system name, without the version.
os_platform	`host.os.platform`	keyword	Operating system platform (such centos, ubuntu, windows).
os_version	`host.os.version`	keyword	Operating system version as a raw string.
sysname	`host.os.type`	keyword	[linux, macos, unix, windows, ios, android]

* Custom field

Details

Removed fields:

os_display_version
os_major (can be extracted from os_version)
os_minor (can be extracted from os_version)
os_patch (can be extracted from os_version)
os_release
reference
release
scan_id
sysname
version
checksum

Available fields:

os.family
hots.name

ECS mapping

---
name: wazuh-states-inventory-system
fields:
    base:
        fields:
            "@timestamp": {}
    agent:
        fields:
            id: {}
            groups: {}
    host:
        fields:
            architecture: {}
            hostname: {}
            name: {}
            os:
                fields:
                    kernel: {}
                    full: {}
                    platform: {}
                    version: {}
                    type: {}

Index settings

{
    "index_patterns": ["wazuh-states-inventory-system*"],
    "priority": 1,
    "template": {
        "settings": {
            "index": {
                "number_of_shards": "1",
                "number_of_replicas": "0",
                "refresh_interval": "5s",
                "query.default_field": [
                    "agent.id",
                    "agent.groups",
                    "host.name",
                    "host.os.type",
                    "host.os.version"
                ]
            }
        }
    }
}

AlexRuiz7 · 2024-09-05T11:14:22Z

`wazuh-states-inventory-packages` index data model

Fields summary

The fields are based on #282 (comment)

Based on ECS:

Package Fields.

Field name	ECS field name	Data type	Description
	`agent.id`	keyword	Agent's ID
	*`agent.groups`	keyword	Agent's groups
scan_time	`@timestamp`	date	Timestamp of the scan
architecture	`package.architecture`	keyword	Package architecture.
description	`package.description`	keyword	Description of the package.
install_time	`package.installed`	date	Time when package was installed.
name	`package.name`	keyword	Package name.
location	`package.path`	keyword	Path where the package is installed.
size	`package.size`	long	Package size in bytes.
format	`package.type`	keyword	Type of package. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar.
version	`package.version`	keyword	Package version.

* Custom field

Fields not included in ECS

	Field name	ECS field name	Data type	Description
?	priority			Priority of the program
?	section			Section of the program category the package belongs to in DEB package managers
X	vendor	package.reference	keyword	Home page or reference URL of the software in this package, if available.
?	multiarch			Multi-architecture compatibility
X	source			Source of the program - package manager

ECS mapping

---
name: wazuh-states-inventory-packages
fields:
    base:
        fields:
            "@timestamp": {}
    agent:
        fields:
            id: {}
            groups: {}
    package:
        fields:
            architecture: ""
            description: ""
            installed: {}
            name: ""
            path: ""
            size: {}
            type: ""
            version: ""

Index settings

{
    "index_patterns": ["wazuh-states-inventory-packages*"],
    "priority": 1,
    "template": {
        "settings": {
            "index": {
                "number_of_shards": "1",
                "number_of_replicas": "0",
                "refresh_interval": "5s",
                "query.default_field": [
                    "agent.id",
                    "agent.groups",
                    "package.architecture"
                    "package.name",
                    "package.version",
                    "package.type"
                ]
            }
        }
    }
}

AlexRuiz7 · 2024-09-05T11:14:27Z

`wazuh-states-inventory-processes` index data model

Fields summary

The fields are based on #282 (comment)

Based on ECS:

Process Fields.

	Field name	ECS field name	Data type	Description	Comments
	`agent.id`	keyword	Agent's ID
	*`agent.groups`	keyword	Agent's groups
	scan_time	`@timestamp`	date	Date/time when the event originated.
	pid	`process.pid`	long	Process ID.
	name	`process.name`	keyword	Process name.
	ppid	`process.parent.pid`	long	Parent process ID.
	cmd	`process.command_line`	wildcard	Full command line that started the process, including the absolute path to the executable, and all arguments.
	argvs	`process.args`	keyword	Array of process arguments, starting with the absolute path to the executable.
	euser	`process.user.id`	keyword	Unique identifier of the effective user.
	ruser	`process.real_user.id`	keyword	Unique identifier of the real user.
	suser	`process.saved_user.id`	keyword	Unique identifier of the saved user.
	egroup	`process.group.id`	keyword	Unique identifier for the effective group on the system/platform.
	rgroup	`process.real_group.id`	keyword	Unique identifier for the real group on the system/platform.
	sgroup	`process.saved_group.id`	keyword	Unique identifier for the saved group on the system/platform.
	start_time	`process.start`	date	The time the process started.
!	tgid	`process.thread.id`	No ECS mapping	Thread ID	`thread.group` is not part of ECS; but `thread.id` is.
!	tty	`process.tty`	object	Information about the controlling TTY device. If set, the process belongs to an interactive session.	Needs clarification

* Custom field

!: Fields awaiting analysis

Fields not included in ECS

	Field name	ECS field name	Data type	Description	Comments
x	state	`process.state`	No ECS mapping	State of the process	Not part of ECS; Maybe as a custom field.
x	utime	`process.cpu.user`	No ECS mapping	User mode CPU time	Not part of ECS; Maybe as a custom field.
x	stime	`process.cpu.system`	No ECS mapping	Kernel mode CPU time	Not part of ECS; Maybe as a custom field.
x?	fgroup	`process.group.file.id`	No ECS mapping	unknown
x	priority	`process.priority`	No ECS mapping	Process priority	Not part of ECS; Maybe as a custom field.
x	nice	`process.nice`	No ECS mapping	Nice value	Not part of ECS; Maybe as a custom field.
x	size	`process.size`	No ECS mapping	Process size	Not part of ECS; Maybe as a custom field.
x	vm_size	`process.vm.size`	No ECS mapping	Virtual memory size	Not part of ECS; Maybe as a custom field.
x	resident	`process.memory.resident`	No ECS mapping	Resident set size	Not part of ECS; Maybe as a custom field.
x	share	`process.memory.share`	No ECS mapping	Shared memory size	Not part of ECS; Maybe as a custom field.
!	pgrp	`process.group.id`	keyword	Process group	Isn't it duplicated ??
x	session	`process.session`	No ECS mapping	Session ID	Not part of ECS; Needs clarification.
x	nlwp	`process.nlwp`	No ECS mapping	Number of light-weight processes	Not part of ECS; Needs clarification.
!	tgid	`process.thread.id`	No ECS mapping	Thread ID ID	`thread.group` is not part of ECS; but `thread.id` is.
!	tty	`process.tty`	object	Information about the controlling TTY device. If set, the process belongs to an interactive session.	Needs clarification
x	processor	`host.cpu.processor`	No ECS mapping	Processor number	No ECS field refers to the core number of the CPU.

ECS mapping

---
name: wazuh-states-inventory-processes
fields:
    base:
        fields:
            "@timestamp": {}
    agent:
        fields:
            id: {}
            groups: {}
    process:
        fields:
            pid: {}
            name: ""
            parent:
                fields:
                    pid: {}
            command_line: ""
            args: ""
            user:
                fields:
                    id: ""
            real_user:
                fields:
                    id: ""
            saved_user:
                fields:
                    id: ""
            group:
                fields:
                    id: ""
            real_group:
                fields:
                    id: ""
            saved_group:
                fields:
                    id: ""
            start: {}
            thread:
                fields:
                    id: ""
            tty: {}

Index settings

{
    "index_patterns": ["wazuh-states-inventory-processes*"],
    "priority": 1,
    "template": {
        "settings": {
            "index": {
                "number_of_shards": "1",
                "number_of_replicas": "0",
                "refresh_interval": "5s",
                "query.default_field": [
                    "agent.id",
                    "agent.groups",
                    "process.name",
                    "process.pid",
                    "process.command_line"
                ]
            }
        }
    }
}

marcinliszka12 · 2024-09-18T11:46:22Z

Hello. Please add agent.labels in Vulnerability Module the same way like in "Threat Hunting" module. Labels are awesome and can easy filter data based on personal entries in agent configuration.

AlexRuiz7 added level/task Task issue request/operational Operational requests type/research Research issue labels Jun 18, 2024

This was referenced Jun 18, 2024

Spike - Initial indexer initialization plugin design #256

Closed

Initialize wazuh-indexer-setup plugin wazuh/wazuh-indexer-plugins#3

Closed

AlexRuiz7 self-assigned this Jun 19, 2024

vikman90 mentioned this issue Jun 25, 2024

Define fields for stateful modules data #282

Closed

This comment was marked as outdated.

Sign in to view

This was referenced Jul 9, 2024

Indexer initialization plugin wazuh/wazuh-indexer-plugins#9

Open

Create UML diagrams for the wazuh-indexer-setup plugin wazuh/wazuh-indexer-plugins#11

Closed

AlexRuiz7 mentioned this issue Aug 7, 2024

Data persistence model definition #344

Open

4 tasks

This was referenced Aug 7, 2024

POC data persistence UX - endpoint inventory wazuh/wazuh-dashboard#213

Closed

POC data persistence UX - agent commands wazuh/wazuh-dashboard#214

Closed

GGP1 mentioned this issue Aug 14, 2024

Comms API - POST /events/stateful endpoint implementation wazuh/wazuh#24647

Closed

fdalmaup mentioned this issue Aug 20, 2024

Develop fleet management use cases wazuh/wazuh#24711

Closed

5 tasks

AlexRuiz7 mentioned this issue Aug 30, 2024

Remove multi-fields from the state-vulnerability index template #365

Closed

nico-stefani mentioned this issue Sep 4, 2024

Adapt Agent model according the last changes of the index data model wazuh/wazuh#25582

Closed

4 tasks

This was referenced Sep 11, 2024

Add stateless index template definition to the ECS tooling #394

Closed

Add states-fim index template definition to the ECS tooling #396

Closed

GGP1 mentioned this issue Sep 16, 2024

Update agent model wazuh/wazuh#25726

Merged

AlexRuiz7 linked a pull request Oct 15, 2024 that will close this issue

Add ECS docs #462

Draft

3 tasks

This was referenced Oct 28, 2024

Update stateful events models wazuh/wazuh#26575

Open

Update stateful events data models wazuh/wazuh#26568

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create ECS compliant index templates #270

Create ECS compliant index templates #270

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

This comment was marked as outdated.

AlexRuiz7 commented Jun 26, 2024 •

edited

Loading

AlexRuiz7 commented Jun 26, 2024 •

edited

Loading

This comment was marked as outdated.

AlexRuiz7 commented Jul 2, 2024

AlexRuiz7 commented Jul 2, 2024

AlexRuiz7 commented Sep 5, 2024 •

edited

Loading

AlexRuiz7 commented Sep 5, 2024 •

edited

Loading

AlexRuiz7 commented Sep 5, 2024 •

edited

Loading

marcinliszka12 commented Sep 18, 2024 •

edited

Loading

Create ECS compliant index templates #270

Create ECS compliant index templates #270

Comments

AlexRuiz7 commented Jun 18, 2024 • edited Loading

Description

Tasks

Implementation restrictions

AlexRuiz7 commented Jun 18, 2024 • edited Loading

agents index data model

Fields summary

ECS mapping

Index settings

AlexRuiz7 commented Jun 18, 2024 • edited Loading

wazuh-alerts-5.x time series index

Fields summary

ECS mapping

AlexRuiz7 commented Jun 18, 2024 • edited Loading

This comment was marked as outdated.

AlexRuiz7 commented Jun 26, 2024 • edited Loading

wazuh-states-fim index data model

Fields summary

ECS mapping

Index settings

AlexRuiz7 commented Jun 26, 2024 • edited Loading

wazuh-states-vulnerabilities index data model

Fields summary

ECS mapping

Index settings

This comment was marked as outdated.

AlexRuiz7 commented Jul 2, 2024

AlexRuiz7 commented Jul 2, 2024

AlexRuiz7 commented Sep 5, 2024 • edited Loading

wazuh-states-inventory-system index data model

Fields summary

ECS mapping

Index settings

AlexRuiz7 commented Sep 5, 2024 • edited Loading

wazuh-states-inventory-packages index data model

Fields summary

ECS mapping

Index settings

AlexRuiz7 commented Sep 5, 2024 • edited Loading

wazuh-states-inventory-processes index data model

Fields summary

ECS mapping

Index settings

marcinliszka12 commented Sep 18, 2024 • edited Loading

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

`agents` index data model

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

`wazuh-alerts-5.x` time series index

AlexRuiz7 commented Jun 18, 2024 •

edited

Loading

AlexRuiz7 commented Jun 26, 2024 •

edited

Loading

`wazuh-states-fim` index data model

AlexRuiz7 commented Jun 26, 2024 •

edited

Loading

`wazuh-states-vulnerabilities` index data model

AlexRuiz7 commented Sep 5, 2024 •

edited

Loading

`wazuh-states-inventory-system` index data model

AlexRuiz7 commented Sep 5, 2024 •

edited

Loading

`wazuh-states-inventory-packages` index data model

AlexRuiz7 commented Sep 5, 2024 •

edited

Loading

`wazuh-states-inventory-processes` index data model

marcinliszka12 commented Sep 18, 2024 •

edited

Loading