ti_*: Fix ECS date mapping on threat fields - #10674
Conversation
🚀 Benchmarks reportTo see the full report comment with |
andrewkroh
added
Integration:ti_anomali
💚 Build Succeeded
History
cc @kcreddy |
|
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
kcreddy
added
bugfix
kcreddy
added
Integration:ti_eset
|
Package ti_anomali - 1.22.1 containing this change is available at https://epr.elastic.co/search?package=ti_anomali |
|
Package ti_cif3 - 1.14.1 containing this change is available at https://epr.elastic.co/search?package=ti_cif3 |
|
Package ti_crowdstrike - 1.1.3 containing this change is available at https://epr.elastic.co/search?package=ti_crowdstrike |
|
Package ti_cybersixgill - 1.30.1 containing this change is available at https://epr.elastic.co/search?package=ti_cybersixgill |
|
Package ti_eclecticiq - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=ti_eclecticiq |
|
Package ti_eset - 1.2.2 containing this change is available at https://epr.elastic.co/search?package=ti_eset |
|
Package ti_maltiverse - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=ti_maltiverse |
|
Package ti_mandiant_advantage - 1.3.1 containing this change is available at https://epr.elastic.co/search?package=ti_mandiant_advantage |
|
Package ti_opencti - 2.3.2 containing this change is available at https://epr.elastic.co/search?package=ti_opencti |
|
Package ti_otx - 1.25.1 containing this change is available at https://epr.elastic.co/search?package=ti_otx |
|
Package ti_rapid7_threat_command - 2.0.1 containing this change is available at https://epr.elastic.co/search?package=ti_rapid7_threat_command |
|
Package ti_recordedfuture - 1.26.1 containing this change is available at https://epr.elastic.co/search?package=ti_recordedfuture |
|
Package ti_threatconnect - 1.2.1 containing this change is available at https://epr.elastic.co/search?package=ti_threatconnect |
|
Package ti_threatq - 1.28.1 containing this change is available at https://epr.elastic.co/search?package=ti_threatq |
Fix ECS date mapping for threat fields.
ecs@mappings component template is missing threat fields
mapped as date. Example: fields such as first_seen, last_seen,
modified_at are being mapped as keyword in transform's source
datastream-backed indices. The transform's destination indices
are not effected as they are not datastream-backed and mappings
are explicitly defined as date. This causes field type conflicts.
- Explicitly add ECS threat fields that are of type date into
source data-stream backed fields.
- Ensure fields are correctly mapped using system tests.
Fix ECS date mapping for threat fields.
ecs@mappings component template is missing threat fields
mapped as date. Example: fields such as first_seen, last_seen,
modified_at are being mapped as keyword in transform's source
datastream-backed indices. The transform's destination indices
are not effected as they are not datastream-backed and mappings
are explicitly defined as date. This causes field type conflicts.
- Explicitly add ECS threat fields that are of type date into
source data-stream backed fields.
- Ensure fields are correctly mapped using system tests.
4 participants
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots
Before (Mapping Conflict)
After (No Mapping Conflict)