elastic / elastic/beats

[Osquerybeat] Update ECS Mappings

Open
#48,201 1 comment 0 reactions 2 assignees Claimed by @marc-gr View on GitHub
needs_team Osquerybeat
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 54m
Merged PRs (30d)
381

Description

A number of ECS fields are not defined within the integration field mapping, which is causing them to map as object instead of the expected nested type. These fields are:

- dll.pe.sections
- file.macho.sections
- file.pe.sections
- process.parent.macho.sections
- process.parent.pe.sections
- threat.enrichments.indicator.file.pe.sections
- threat.indicator.file.pe.sections

Additionally, the integration defines an error field as text, however this conflicts with the ECS error field that is expected to be an object.

References:
- https://github.com/elastic/integrations/issues/16643
- https://github.com/elastic/sdh-beats/issues/6755

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.