Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[cloud_security_posture] Update index template mapping #3248

Merged
merged 8 commits into from May 3, 2022
Merged

[cloud_security_posture] Update index template mapping #3248

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a4bf593
update index template mapping
uri-weisman May 2, 2022
c382528
run elastic-package format
uri-weisman May 2, 2022
9d41daa
Merge branch 'main' into update_integration_mapping
uri-weisman May 2, 2022
f28b1c9
update changelog
uri-weisman May 2, 2022
757cb0d
Update manifest version
uri-weisman May 2, 2022
01b5534
CR changes
uri-weisman May 2, 2022
f5edd64
run elastic-package format
uri-weisman May 2, 2022
fa62da1
change resource raw to use enabled instead of index
uri-weisman May 3, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/cloud_security_posture/changelog.yml
View file
Open in desktop
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "0.0.6"
changes:
- description: Update findings template asset
type: enhancement
link: https://github.com/elastic/integrations/pull/3248
- version: "0.0.5"
changes:
- description: Add CSP rule template asset
Expand Down
21 changes: 12 additions & 9 deletions packages/cloud_security_posture/data_stream/findings/fields/findings.yml
View file
Open in desktop
Expand Up @@ -4,13 +4,13 @@
- name: keyword
type: keyword
ignore_above: 1024
- name: type
- name: type # deprecated - the new field is resource.type
type: text
multi_fields:
- name: keyword
type: keyword
ignore_above: 1024
- name: resource_id
- name: resource_id # deprecated - the new field is resource.id
type: text
multi_fields:
- name: keyword
Expand All @@ -36,15 +36,18 @@
type: group
fields:
- name: type
type: keyword
ignore_above: 256
- name: id
type: text
description: Source type of the resource
multi_fields:
- name: keyword
type: keyword
ignore_above: 1024
- name: filename
ignore_above: 256
- name: raw
index: false
- name: name
type: text
ignore_above: 1024
- name: sub_type
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't subtype be keyword?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't subtype be keyword?

I thought the user might want to search for a partial sub_type and get results.
For example, search for Controller and get data about ReplicationController | DeploymentController

Anyway, I used multi-fields which should index the field as text & keyword - multi-fields

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One of the conventions in ECS (and most integrations) is to use .text as the multi-field rather than .keyword. See https://www.elastic.co/guide/en/ecs/8.2/ecs-conventions.html#_ecs_convention_for_indexing_text_fields for an explanation. Just want to mention this in case there is still an opportunity to align with this convention.

type: text
description: Resource filename
multi_fields:
- name: keyword
type: keyword
Expand Down
2 changes: 1 addition & 1 deletion packages/cloud_security_posture/manifest.yml
View file
Open in desktop
@@ -1,7 +1,7 @@
format_version: 1.0.0
name: cloud_security_posture
title: "CIS Kubernetes Benchmark"
version: 0.0.5
version: 0.0.6
license: basic
description: "Check Kubernetes cluster compliance with the Kubernetes CIS benchmark."
type: integration
Expand Down