[Osquerybeat] Update ECS Mappings
Open
needs_team
Osquerybeat
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 54m
- Merged PRs (30d)
- 381
Description
A number of ECS fields are not defined within the integration field mapping, which is causing them to map as object instead of the expected nested type. These fields are:
- dll.pe.sections
- file.macho.sections
- file.pe.sections
- process.parent.macho.sections
- process.parent.pe.sections
- threat.enrichments.indicator.file.pe.sections
- threat.indicator.file.pe.sections
Additionally, the integration defines an error field as text, however this conflicts with the ECS error field that is expected to be an object.
References:
- https://github.com/elastic/integrations/issues/16643
- https://github.com/elastic/sdh-beats/issues/6755
Contributor guide
Assessment
This issue has not been assessed yet.