elastic / elastic/endpoint-package
[File/Network telemetry] Add entity_id mappings to file and network datastreams in endpoint-package
Open
v8.6.0
- Dominant language
- Python
- Stars
- 33
- Forks
- 20
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 5
Description
Epic: https://github.com/elastic/security-team/issues/4021
Endpoint-dev work is done, see: https://github.com/elastic/endpoint-dev/pull/11890/files
Based on the entity_id's added in the above PR, we should add mappings to both file and network data streams in endpoint-package for the following fields.
-process.entry_leader.entity_id
-process.session_leader.entity_id
-process.group_leader.entity_id
-process.parent.entity_id
-process.parent.group_leader.entity_id
-process.entry_leader.parent.entity_id
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.