Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove the x-ecs-process and x-ecs-file entities from elastic_ecs mapping #1334

Closed
cmadam opened this issue Feb 17, 2023 · 0 comments · Fixed by #1335
Closed

Remove the x-ecs-process and x-ecs-file entities from elastic_ecs mapping #1334

cmadam opened this issue Feb 17, 2023 · 0 comments · Fixed by #1335

Comments

@cmadam
Copy link
Contributor

cmadam commented Feb 17, 2023

Clean up the current open-sourcing elastic_ecs connector mapping with respect to the STIX official/OCA standard. The general idea is that we want to prefer custom attributes/extensions over custom objects. We also prefer "common" custom attributes that are shared across multiple connectors. stix-shifter's job is normalization, so each connector-specific custom object or attribute is counter to its goals.

The redesign aims to examine each attribute of the x-ecs-process and x-ecs-file entities. If the attribute is part of the STIX specification then it is moved in the process or file entity, and its name remains unchanged. If the attribute is not a part of the STIX specification, then it is moved into the process or file entity, and it name is prefixed with x_. For example, the exit_code attribute from the x-ecs-process entity is moved in the x_exit_code attribute in the process entity.

This redesigned mapping would simplify the implementation of apps that use data retrieved from stix-shifter., by only having to deal with relations between standard STIX entities, without the need to accommodate additional custom objects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant