search

elastic / integrations

Elastic Integrations
https://www.elastic.co/integrations
Other
24 stars 436 forks source link

network_traffic: non-ECS fields are polluting root #5921

Open efd6 opened 1 year ago

efd6 commented 1 year ago

In #5918 there is a report of a field definition collision between NPC's use of resource and the Cloud Security team's use of resource in cloud_security_posture. We should not be using fields at root like this.

I've done a review of the datastreams in the integration and pretty much all of them pollute root to a greater or lesser degree. All of them should make sure that fields generated by packet beat that are not ECS-compliant are put in their own namespace. In some cases this will involve renaming of fields to avoid stutter/confusion.

elasticmachine commented 1 year ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

P1llus commented 1 year ago

I agree that we should rename them, just ensuring that we bump the major version and get an approval for the breaking change @jamiehynds might be able to help there.

I am working on some new dashboards for the integration as well, so those might need to be updated to reflect that as well.