Skip to content

[Asset Inventory] Add event.category and event.module to all events#4053

Open
kubasobon wants to merge 3 commits intoelastic:mainfrom
kubasobon:ecs-event-category
Open

[Asset Inventory] Add event.category and event.module to all events#4053
kubasobon wants to merge 3 commits intoelastic:mainfrom
kubasobon:ecs-event-category

Conversation

@kubasobon
Copy link
Member

@kubasobon kubasobon commented Mar 18, 2026

Summary of your changes

  • Adds event.category to all Events published by Asset Inventory. The values are compliant with the ECS.
  • Adds event.module: asset discovery to all Events

Related Issues

Closes #3890

@kubasobon kubasobon requested a review from a team as a code owner March 18, 2026 13:32
@mergify
Copy link

mergify bot commented Mar 18, 2026

This pull request does not have a backport label. Could you fix it @kubasobon? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

@kubasobon kubasobon requested a review from JordanSh March 18, 2026 15:18
Copy link
Contributor

@JordanSh JordanSh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👑

@kubasobon
Copy link
Member Author

kubasobon commented Mar 19, 2026

@uri-weisman Added event.module: asset discovery as well, just like we talked.

@kubasobon kubasobon changed the title [Asset Inventory] Add event.category to all events [Asset Inventory] Add event.category and event.module to all events Mar 19, 2026
},
Event: Event{
Kind: "asset",
Module: "asset discovery",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

99% sure we should use an underscore for ECS field value, so - asset_discovery
In addition, we need to check the dataset naming because it should start with the module name.

"It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. "

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, we don't publish dataset names. I think provider makes sense? As in asset_discovery.aws, asset_discovery.gcp, etc. WDYT?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💯
Just @caitlinbetz validating with you before pushing this.
We plan to add event.module: asset_discovery and event.dataset: asset_discovery.<CLOUD_PROVIDER> to the asset discovery integration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Asset Discovery] Add event.category and event.kind to published events

3 participants