CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2026-02-26 17:05:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15524 from Security-Onion-Solutions/reyesj2/elastic9-review

Browse Source 
fix field conflicts
This commit is contained in:
Jorge Reyes
2026-02-24 15:02:37 -06:00
committed by GitHub
parent 2552a5c17d 4d5ace2a89
commit 0bcfec3f56
4 changed files with 114 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticsearch/defaults.yaml
View File

@@ -858,6 +858,8 @@ elasticsearch:
composed_of: composed_of:
- agent-mappings - agent-mappings
- dtc-agent-mappings - dtc-agent-mappings
- event-mappings
- file-mappings
- host-mappings - host-mappings
- dtc-host-mappings - dtc-host-mappings
- http-mappings - http-mappings

8
salt/elasticsearch/files/ingest/kratos
View File

@@ -81,6 +81,14 @@
"ignore_missing": true "ignore_missing": true
} }
}, },
{
"rename": {
"field": "file",
"target_field": "file.path",
"ignore_failure": true,
"ignore_missing": true
}
},
{ {
"pipeline": { "pipeline": {
"name": "common" "name": "common"

182
salt/elasticsearch/templates/component/ecs/dns.json
View File

@@ -1,91 +1,103 @@
{ {
"_meta": { "_meta": {
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-dns.html", "documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-dns.html",
"ecs_version": "1.12.2" "ecs_version": "1.12.2"
}, },
"template": { "template": {
"mappings": { "mappings": {
"properties": { "properties": {
"dns": { "dns": {
"properties": { "properties": {
"answers": { "answers": {
"properties": { "properties": {
"class": { "class": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
}, },
"data": { "data": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
}, },
"name": { "name": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
}, },
"ttl": { "ttl": {
"type": "long" "type": "long"
}, },
"type": { "type": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
}
},
"type": "object"
},
"header_flags": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"op_code": {
"ignore_above": 1024,
"type": "keyword"
},
"question": {
"properties": {
"class": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"registered_domain": {
"ignore_above": 1024,
"type": "keyword"
},
"subdomain": {
"ignore_above": 1024,
"type": "keyword"
},
"top_level_domain": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"query": {
"properties" :{
"type":{
"ignore_above": 1024,
"type": "keyword"
},
"type_name": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"resolved_ip": {
"type": "ip"
},
"response_code": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
} }
},
"type": "object"
},
"header_flags": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"op_code": {
"ignore_above": 1024,
"type": "keyword"
},
"question": {
"properties": {
"class": {
"ignore_above": 1024,
"type": "keyword"
},
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"registered_domain": {
"ignore_above": 1024,
"type": "keyword"
},
"subdomain": {
"ignore_above": 1024,
"type": "keyword"
},
"top_level_domain": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
"resolved_ip": {
"type": "ip"
},
"response_code": {
"ignore_above": 1024,
"type": "keyword"
},
"type": {
"ignore_above": 1024,
"type": "keyword"
} }
}
} }
}
} }
}
} }

7
salt/elasticsearch/templates/component/ecs/file.json
View File

@@ -15,6 +15,13 @@
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
}, },
"bytes": {
"properties": {
"missing": {
"type": "long"
}
}
},
"code_signature": { "code_signature": {
"properties": { "properties": {
"digest_algorithm": { "digest_algorithm": {