[cloud_asset_inventory]: asset.name not set for asset.sub_type: azure-storage-blob-service

### Integration Name

Cloud Asset Inventory [cloud_asset_inventory]

### Dataset Name

cloud_asset_inventory.asset_inventory

### Integration Version

0.6.0

### Agent Version

8.17.3

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.3

### OS Version and Architecture

Agentless

### Software/API Version

Azure API

### Error Message

asset.name is empty, asset.raw.name is default, would expect something more useful in it.

### Event Original

Checked, but the Agentless Azure Cloud Asset Inventory policy doesn't allow me to activate keeping event.original. But here's an event as I see it indexed:

{
"_index": ".ds-logs-cloud_asset_inventory.asset_inventory-infrastructure_storage_object-storage_azure-storage-blob-service-default-2025.04.01-000001",
"_id": "ElJh8ZUBDGfqlwy3d2v3",
"_version": 1,
"_source": {
"cloud": {
"provider": "azure",
"service": {
"name": "Azure"
},
"organization": {},
"account": {}
},
"related.entity": [
"/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat/blobServices/default"
],
"resource_policies": [],
"agent": {
"name": "agentless-c7792626-a22d-4c13-9163-53504513a9ec-678d899fc4-n2kcq",
"id": "97045a23-023d-4091-b377-b947df25a177",
"type": "cloudbeat",
"ephemeral_id": "60e23899-3a1e-4d97-afa1-f66dfa2b9e06",
"version": "8.17.3"
},
"@timestamp": "2025-04-01T12:44:00.638Z",
"ecs": {
"version": "8.0.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "cloud_asset_inventory.asset_inventory"
},
"elastic_agent": {
"id": "97045a23-023d-4091-b377-b947df25a177",
"version": "8.17.3",
"snapshot": false
},
"asset": {
"sub_category": "storage",
"sub_type": "azure-storage-blob-service",
"name": "",
"raw": {
"subscription_id": "872e5f8b-a57a-4e62-8b5f-ab89b0088896",
"extension": {
"storageAccountId": "/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat",
"storageAccountName": "securitylogsfilebeat"
},
"resource_group": "security-logs-for-ingestions",
"name": "default",
"id": "/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat/blobServices/default",
"type": "microsoft.storage/storageaccounts/blobservices",
"properties": {
"containerDeleteRetentionPolicy": {
"days": 7,
"enabled": true
},
"cors": {
"corsRules": []
},
"changeFeed": {
"enabled": false
},
"restorePolicy": {
"enabled": false
},
"isVersioningEnabled": false,
"deleteRetentionPolicy": {
"allowPermanentDelete": false,
"days": 7,
"enabled": true
}
}
},
"id": [
"/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat/blobServices/default"
],
"category": "infrastructure",
"type": "object-storage",
"tags": null
},
"event": {
"agent_id_status": "verified",
"ingested": "2025-04-01T12:44:10Z",
"dataset": "cloud_asset_inventory.asset_inventory"
}
},
"fields": {
"asset.raw.name": [
"default"
],
"related.entity": [
"/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat/blobServices/default"
],
"elastic_agent.version": [
"8.17.3"
],
"asset.type": [
"object-storage"
],
"asset.raw.properties.containerDeleteRetentionPolicy.enabled": [
true
],
"asset.raw.name.text": [
"default"
],
"asset.raw.properties.deleteRetentionPolicy.days": [
7
],
"agent.type": [
"cloudbeat"
],
"asset.sub_category": [
"storage"
],
"asset.raw.subscription_id": [
"972e5f8b-657a-4e62-8b5f-eb89b0088896"
],
"asset.id": [
"/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat/blobServices/default"
],
"asset.raw.id": [
"/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat/blobServices/default"
],
"asset.raw.properties.changeFeed.enabled": [
false
],
"agent.name": [
"agentless-c7792626-a22d-4c13-9163-53504513a9ec-678d899fc4-n2kcq"
],
"asset.sub_type": [
"azure-storage-blob-service"
],
"elastic_agent.snapshot": [
false
],
"event.agent_id_status": [
"verified"
],
"asset.raw.properties.deleteRetentionPolicy.allowPermanentDelete": [
false
],
"asset.raw.extension.storageAccountName": [
"securitylogsfilebeat"
],
"asset.raw.extension.storageAccountId": [
"/subscriptions/872e5f8b-a57a-4e62-8b5f-ab89b0088896/resourceGroups/security-logs-for-ingestions/providers/Microsoft.Storage/storageAccounts/securitylogsfilebeat"
],
"elastic_agent.id": [
"97045a23-023d-4091-b377-b947df25a177"
],
"data_stream.namespace": [
"default"
],
"asset.raw.properties.isVersioningEnabled": [
false
],
"asset.raw.type": [
"microsoft.storage/storageaccounts/blobservices"
],
"asset.raw.properties.restorePolicy.enabled": [
false
],
"data_stream.type": [
"logs"
],
"asset.raw.properties.containerDeleteRetentionPolicy.days": [
7
],
"cloud.provider": [
"azure"
],
"event.ingested": [
"2025-04-01T12:44:10.000Z"
],
"@timestamp": [
"2025-04-01T12:44:00.638Z"
],
"cloud.service.name": [
"Azure"
],
"agent.id": [
"97045a23-023d-4091-b377-b947df25a177"
],
"asset.name": [
""
],
"ecs.version": [
"8.0.0"
],
"asset.raw.properties.deleteRetentionPolicy.enabled": [
true
],
"data_stream.dataset": [
"cloud_asset_inventory.asset_inventory"
],
"agent.ephemeral_id": [
"60e23899-3a1e-4d97-afa1-f66dfa2b9e06"
],
"agent.version": [
"8.17.3"
],
"asset.raw.resource_group": [
"security-logs-for-ingestions"
],
"event.dataset": [
"cloud_asset_inventory.asset_inventory"
],
"asset.category": [
"infrastructure"
]
}
}

### What did you do?

nothing special, just enabled it.

### What did you see?

asset.name empty for asset.category: infrastructure and asset.sub_type: aszre-storage-blob-service.

asset.raw.extension.sorageAccountName has a proper value.

### What did you expect to see?

asset.name should contain something meaningful, in that case probably the value of asset.raw.extension.sorageAccountName ?

### Anything else?

_No response_