Required changes to upgrade beats modules to 1.7:

• After 1.7 is released, update ecs dependency to 1.7 e.g.: [ECS] Update ecs to 1.6.0 #20792

Using https://github.com/elastic/ecs-dev/issues/199 as reference:

Experimental

Use of basic types with wildcard elastic/dev#1508 elastic/ecs#970:
(important note: Going with option 2 will require each Beat to implement this fallback mechanism to replace wildcard to keyword, when posting an index template to Elasticsearch.)

• Auditbeat (Upgrade to ECS 1.7.0 #22571)
• Metricbeat (Upgrade to ECS 1.7.0 #22571)
• Heartbeat (Upgrade to ECS 1.7.0 #22571)
• Packetbeat (Upgrade to ECS 1.7.0 #22571)
• Winlogbeat (Upgrade to ECS 1.7.0 #22571)
• Auditbeat (Upgrade to ECS 1.7.0 #22571)
• Packetbeat (Upgrade to ECS 1.7.0 #22571)
• Winlogbeat (Upgrade to ECS 1.7.0 #22571)
• Filebeat auditd (Upgrade to ECS 1.7.0 #22571)
• Filebeat rsa2elk modules (Upgrade to ECS 1.7.0 #22571)
• Filebeat checkpoint firewall (Upgrade to ECS 1.7.0 #22571)
• Filebeat cisco asa (Upgrade to ECS 1.7.0 #22571)
• Filebeat cef (Upgrade to ECS 1.7.0 #22571)
• Filebeat cisco ftd (Upgrade to ECS 1.7.0 #22571)
• Filebeat cisco umbrella (Upgrade to ECS 1.7.0 #22571)
• Filebeat citrix netscaler (Upgrade to ECS 1.7.0 #22571)
• Filebeat f5 (Upgrade to ECS 1.7.0 #22571)
• Filebeat crowdstrike falcon (Upgrade to ECS 1.7.0 #22571)
• Filebeat fortinet (Upgrade to ECS 1.7.0 #22571)
• Filebeat googlecloud audit (Upgrade to ECS 1.7.0 #22571)
• Filebeat microsoft (Upgrade to ECS 1.7.0 #22571)
• Filebeat Gsuite (Upgrade to ECS 1.7.0 #22571)
• Filebeat o365 (Upgrade to ECS 1.7.0 #22571)
• Filebeat zoom (Upgrade to ECS 1.7.0 #22571)
• Filebeat okta (Upgrade to ECS 1.7.0 #22571)
• Filebeat aws cloudtrail (Upgrade to ECS 1.7.0 #22571)
• Filebeat barracuda (Upgrade to ECS 1.7.0 #22571)
• Filebeat s3 (Upgrade to ECS 1.7.0 #22571)
• Filebeat juniper (Upgrade to ECS 1.7.0 #22571)
• Filebeat netscout (Upgrade to ECS 1.7.0 #22571)
• Filebeat panw (Upgrade to ECS 1.7.0 #22571)
• Filebeat snort (Upgrade to ECS 1.7.0 #22571)
• Filebeat sonicwall (Upgrade to ECS 1.7.0 #22571)
• Filebeat sophos (Upgrade to ECS 1.7.0 #22571)
• Filebeat zeek (Upgrade to ECS 1.7.0 #22571)

Additions in 1.7:

New ingress and egress allowed values for network.direction elastic/ecs#945:

• Auditbeat auditd (Add ingress/egress and configuration categorization go-libaudit#80) ([Auditbeat] Upgrade to latest go-libaudit to support ECS 1.7 #23000)
• Auditbeat system/socket ([Auditbeat] system/socket: Use ingress/egress for network direction #22991)
• Metricbeat ([Metricbeat] Use egress/ingress instead of inbound/outbound for system/socket metricset #22992)
• Packetbeat ([Packetbeat] Update ingress/egress traffic directionality #22996)
• Winlogbeat ([Winlogbeat] Use ingress/egress instead of inbound/outbound #22997)
• Filebeat auditd ([Filebeat] Use ingress/egress for crowdstrike and auditd modules #23041)
• Filebeat crowdstrike falcon ([Filebeat] Use ingress/egress for crowdstrike and auditd modules #23041)
• Filebeat netflow ([Filebeat] Add network.direction to netflow/log fileset #23052)
• Filebeat checkpoint firewall ([Filebeat] Allow cef and checkpoint modules to override network directionality based off of zones #23066)
• Filebeat cef ([Filebeat] Allow cef and checkpoint modules to override network directionality based off of zones #23066)
• Filebeat cisco asa ([Filebeat] Allow cisco/asa and cisco/ftd modules to override network directionality based off of zones #23068)
• Filebeat cisco ftd ([Filebeat] Allow cisco/asa and cisco/ftd modules to override network directionality based off of zones #23068)
• Filebeat fortinet firewall ([Filebeat] Add fortinet/firewall network direction override based on interface #23072)
• Filebeat cisco umbrella (waiting on CIDR matching processors/painless support in elasticsearch Painless convenience function for matching IP addresses elasticsearch#60668)
• Filebeat googlecloud firewall ([Filebeat] Add network.direction by specifying internal_networks to gcp module #23081)
• Filebeat googlecloud vpcflow ([Filebeat] Add network.direction by specifying internal_networks to gcp module #23081)
• Filebeat panw panos ([Filebeat] panos config option to set internal/external zones #22998)
• Filebeat sophos xg ([Filebeat] improve logic for network.direction in sophos xg fileset #22973)
• Filebeat zeek connection ([Filebeat] zeek ecs 1.7 updates for network.direction #22967)
• Filebeat rsa2elk modules (@adriansr) (need to add individual module configuration support, see Add network.direction classification to rsa2elk modules #23114)

HTTP request/response mime type elastic/ecs#944:
(important note: needs to analyze body)

• Packetbeat ([Processors] Mime-Type Detection #22940)
• Hearbeat ([Heartbeat] Add mime type detection #22976)
• Filebeat elasticsearch ([Filebeat] Add mime type detection for Elasticsearch module #22975)
• Filebeat o365 (doesn't capture request/response body)
• Filebeat gsuite (doesn't capture request/response body)
• Filebeat suricata eve (doesn't capture request/response body)
• Filebeat rsa2elk modules (doesn't capture request/response body)
• Filebeat checkpoint firewall (doesn't capture request/response body)
• Filebeat cef (doesn't capture request/response body)
• Filebeat cisco ftd (doesn't capture request/response body)
• Filebeat cisco umbrella (doesn't capture request/response body)
• Filebeat fortinet clientendpoint (doesn't capture request/response body)
• Filebeat fortinet firewall (doesn't capture request/response body)
• Filebeat fortinet fortimail (doesn't capture request/response body)
• Filebeat fortinet fortimanager (doesn't capture request/response body)
• Filebeat panw panos (doesn't capture request/response body)
• Filebeat sophos xg (doesn't capture request/response body)
• Filebeat zeek http (doesn't capture request/response body)

New allowed value configuration for event.category elastic/ecs#963:

• Winlogbeat ([Winlogbeat] Add configuration category and more security events #22988)
• Auditbeat system (no configuration events to be classified)
• Auditbeat auditd (Add ingress/egress and configuration categorization go-libaudit#80) ([Auditbeat] Upgrade to latest go-libaudit to support ECS 1.7 #23000)
• Filebeat auditd ([Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010)
• Filebeat GSuite ([Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010)
• Filebeat zoom ([Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010)
• Filebeat o365 ([Filebeat] Update event categorization for configuration events for auditd, gsuite, o365, and zoom #23010)
• Filebeat Okta (no configuration events to be classified)
• Filebeat microsoft (check if rsa2elk microsoft modules need updating)
• Filebeat rsa2elk modules (currently we don't do any event categorization)

Add subdomain domain breakdown across all domain breakdowns (currently only in dns) elastic/ecs#981:

• Packetbeat (seems done for dns)
• Winlogbeat ([Winlogbeat] Add subdomain value for sysmon module #22999)
• Filebeat suricata eve ([Filebeat] Enrich subdomain information for suricata and zeek #23011)
• Filebeat zeek dns ([Filebeat] Enrich subdomain information for suricata and zeek #23011)
• Filebeat rsa2elk modules (@adriansr)