[Enhancement] Add ".caseless" fields to process events#9850
[Enhancement] Add ".caseless" fields to process events#9850
Conversation
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
auth |
2680.97 | 2105.26 | -575.71 (-21.47%) | 💔 |
syslog |
23255.81 | 9345.79 | -13910.02 (-59.81%) | 💔 |
Package windows 👍(3) 💚(4) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
powershell |
1795.33 | 1436.78 | -358.55 (-19.97%) | 💔 |
To see the full report comment with /test benchmark fullreport
|
@w0rk3r : Can we please get the CI green here ? |
|
There was a problem hiding this comment.
This introduces a new field into an ECS controlled namespace that is not defined in ECS. We need to commit this to the schema first so that it becomes standardized. This will allow us to use a uniform definition everywhere and it's easily importable.
# fields.yml
- name: process.executable
external: ecs
This additional multi-field will end up in the Elasticsearch ecs@mappings template meaning that all users of data streams can have a consistent mapping for these fields (even if they aren't using an integration).
Probably one reason that we have incompatibility with detection rules (#9234) is that the rule(s) are using fields which have not been defined in ECS. So if we can align ECS then any future integrations will just work.
I also think we should debate alternative naming. My initial reaction was that calling this "lowercase" would be more clear because it conveys the fact that the value is being converted to lowercase.
|
Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as |
💚 Build Succeeded
History
cc @w0rk3r |
|
|
@andrewkroh @efd6, should I close this PR? From what I understand, changes made in elastic/ecs#2341 will auto-add these fields. Is that right? |
|
The change to ECS won't make it into the ecs@mappings component template that's part of ES until probably 8.16.0. So if you don't want to wait we can proceed with this now that the fields are agreed to in the schema. |
ECS incorporates these multi-fields now.
Proposed commit message
This PR adds
.caselessfields for the process name and executable to improve compatibility with our Elastic Defend integration. This enables us to handle language limitations in KQL more effectively.I'm also specifying the
.textfield as it was being removed from the markdown file otherwise.Elastic Defend Mapping:
Checklist
changelog.ymlfile.How to test this PR locally
Build the integration, ingest sysmon or windows security logs.
Related issues
Screenshots