elastic · efd6 · Nov 29, 2022 · Nov 9, 2022
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.3.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: "1.3.0"
   changes:
     - description: Update package to ECS 8.5.0.

@@ -199,9 +199,6 @@
 - name: input.type
   type: keyword
   description: Input type.
-- name: log.offset
-  type: long
-  description: Offset of the entry in the log file.
 - name: log.source.address
   type: keyword
   description: Source address from which the log event was read / sent from.
@@ -46,8 +46,6 @@
   name: event.code
 - external: ecs
   name: event.created
-- external: ecs
-  name: event.created
 - external: ecs
   name: event.duration
 - external: ecs
@@ -202,8 +200,6 @@
   name: user.id
 - external: ecs
   name: user.name
-- external: ecs
-  name: server.domain
 - external: ecs
   name: server.address
 - external: ecs

@@ -130,13 +130,6 @@
       type: keyword
       ignore_above: 1024
       description: Host mac addresses.
-    - name: name
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the host.
-
-        It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.'
     - name: os.family
       level: extended
       type: keyword

@@ -12,8 +12,6 @@
   name: event.ingested
 - external: ecs
   name: event.kind
-- external: ecs
-  name: event.module
 - external: ecs
   name: event.outcome
 - external: ecs

@@ -559,7 +559,7 @@ An example event for `winlog` looks as following:
 | event.dataset | Event dataset. | constant_keyword |
 | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date |
 | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword |
-| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword |
+| event.module | Event module | constant_keyword |
 | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword |
 | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword |
 | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long |

@@ -1,6 +1,6 @@
 name: hid_bravura_monitor
 title: Hitachi ID Bravura Monitor
-version: "1.3.0"
+version: "1.3.1"
 categories: ["security"]
 release: ga
 description: Collect logs from Hitachi ID Security Fabric with Elastic Agent.

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.11.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: "0.11.0"
   changes:
     - description: Update package to ECS 8.5.0.

@@ -15,9 +15,6 @@
   type: constant_keyword
   description: Event dataset
   value: imperva.securesphere
-- name: '@timestamp'
-  type: date
-  description: Event timestamp.
 - name: container.id
   description: Unique container id.
   ignore_above: 1024

@@ -202,8 +202,6 @@
   name: source.subdomain
 - external: ecs
   name: source.top_level_domain
-- external: ecs
-  name: tags
 - external: ecs
   name: url.domain
 - external: ecs

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: imperva
 title: Imperva SecureSphere Logs
-version: "0.11.0"
+version: "0.11.1"
 description: Collect SecureSphere logs from Imperva devices with Elastic Agent.
 categories: ["network", "security"]
 release: experimental

@@ -1,4 +1,12 @@
 # newer versions go on top
+- version: "0.2.2"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
+    - description: Fix markdown syntax in `proxy_url` description.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: "0.2.1"
   changes:
     - description: Added Filter instead of KQL in visualizations and Update the pagination termination condition.

@@ -97,11 +97,6 @@
       description: 'Name of the domain of which the host is a member. For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.'
       example: CONTOSO
       default_field: false
-    - name: hostname
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.'
     - name: id
       level: core
       type: keyword
@@ -116,11 +111,6 @@
       type: keyword
       ignore_above: 1024
       description: Host mac addresses.
-    - name: name
-      level: core
-      type: keyword
-      ignore_above: 1024
-      description: 'Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.'
     - name: os.family
       level: extended
       type: keyword

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: infoblox_bloxone_ddi
 title: Infoblox BloxOne DDI
-version: "0.2.1"
+version: "0.2.2"
 license: basic
 description: Collect logs from Infoblox BloxOne DDI with Elastic Agent.
 type: integration
@@ -49,7 +49,7 @@ policy_templates:
             multi: false
             required: false
             show_user: false
-            description: URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.
+            description: URL to proxy connections in the form of http\[s\]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.
           - name: ssl
             type: yaml
             title: SSL Configuration

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: '1.4.2'
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: '1.4.1'
   changes:
     - description: Add support for a new type of log pattern for the categories DHCPACK, RELEASE and DHCPRELEASE.

@@ -107,10 +107,6 @@
       type: keyword
       ignore_above: 1024
       description: 'Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`.'
-    - name: ip
-      level: core
-      type: ip
-      description: Host ip addresses.
     - name: mac
       level: core
       type: keyword

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: infoblox_nios
 title: Infoblox NIOS
-version: '1.4.1'
+version: '1.4.2'
 license: basic
 description: Collect logs from Infoblox NIOS with Elastic Agent.
 type: integration

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.6.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: "2.6.0"
   changes:
     - description: Update Aggregation visualizations to Lens, Add an on_failure processor to the convert, geo_ip, uri_parts and date processors, remove unnecessary white spaces, mapped to related ecs field and convert double quotes to single quotes.

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: zscaler_zia
 title: Zscaler Internet Access
-version: 2.6.0
+version: 2.6.1
 license: basic
 description: Collect logs from Zscaler Internet Access (ZIA) with Elastic Agent.
 type: integration

@@ -1,4 +1,12 @@
 # newer versions go on top
+- version: "1.4.1"
+  changes:
+    - description: Remove duplicate fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
+    - description: Fix `x509.issuer.common_name` normalization.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4610
 - version: "1.4.0"
   changes:
     - description: Update Aggregation visualizations to Lens, Add an on_failure processor to the convert, geo_ip, uri_parts and date processors, remove unnecessary white spaces, mapped to related ecs field and convert double quotes to single quotes.

@@ -6,8 +6,6 @@
   name: client.geo.country_iso_code
 - external: ecs
   name: client.geo.continent_name
-- external: ecs
-  name: client.geo.country_iso_code
 - external: ecs
   name: client.geo.region_iso_code
 - external: ecs

@@ -60,7 +60,9 @@
             },
             "x509": {
                 "issuer": {
-                    "common_name": "loggerz2x.pde.zpabeta.net"
+                    "common_name": [
+                        "loggerz2x.pde.zpabeta.net"
+                    ]
                 }
             },
             "zscaler_zpa": {

@@ -106,9 +106,12 @@ processors:
       if: ctx.user?.name != null
       allow_duplicates: false
       ignore_failure: true
-  - rename:
+  - append: 
+      field: x509.issuer.common_name
+      value: '{{{json.CertificateCN}}}'
+      if: ctx.json?.CertificateCN != null
+  - remove:
       field: json.CertificateCN
-      target_field: x509.issuer.common_name
       ignore_missing: true
   - rename:
       field: json.SessionID

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: zscaler_zpa
 title: "Zscaler Private Access"
-version: "1.4.0"
+version: "1.4.1"
 license: basic
 description: Collect logs from Zscaler Private Access (ZPA) with Elastic Agent.
 type: integration