File system type

[Trinity2019]

Change Summary

This adds device.file_system_type field to file/dll/process events and malware alerts. A process event example is here. also adding device.volume_device_type to malware alerts as it shows up in malware alert, example is here.

Sample document shown in above links.

Release Target

8.8.0

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

For Transform changes:

• The new transform successfully starts in Kibana
• The corresponding transform destination schema was updated if necessary

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-04-13T05:30:46.053+0000

• Duration: 8 min 15 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[Trinity2019]

@elastic/security-defend-workflows Can I get some reviews please? thanks a lot!

[kevinlog]

this looks good to me.

• only mapping additions
• all types are keyword which is supported

[Trinity2019]

Thanks @kevinlog for review!

[elasticmachine]

Package endpoint - 8.8.0 containing this change is available at https://epr.elastic.co/search?package=endpoint