[Asset Inventory] Add event.category and event.module to all events#4053
[Asset Inventory] Add event.category and event.module to all events#4053kubasobon wants to merge 3 commits intoelastic:mainfrom
Conversation
|
This pull request does not have a backport label. Could you fix it @kubasobon? 🙏
|
|
@uri-weisman Added |
| }, | ||
| Event: Event{ | ||
| Kind: "asset", | ||
| Module: "asset discovery", |
There was a problem hiding this comment.
99% sure we should use an underscore for ECS field value, so - asset_discovery
In addition, we need to check the dataset naming because it should start with the module name.
"It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. "
There was a problem hiding this comment.
Hmm, we don't publish dataset names. I think provider makes sense? As in asset_discovery.aws, asset_discovery.gcp, etc. WDYT?
There was a problem hiding this comment.
💯
Just @caitlinbetz validating with you before pushing this.
We plan to add event.module: asset_discovery and event.dataset: asset_discovery.<CLOUD_PROVIDER> to the asset discovery integration.
Summary of your changes
event.categoryto all Events published by Asset Inventory. The values are compliant with the ECS.event.module: asset discoveryto all EventsRelated Issues
Closes #3890