In the SIEM app, we are using host.name vs using host.hostname. At the beginning of the project we were using only host.hostname but we switch to only use host.name because this field can be edited via the config file in beat.

We think that the endpoint should fill host.hostname and host.name at the same time, so we do not need to have a workaround in every query and the user won't be surprised that it is different trough our security app.