Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add vulnerability.scanner.reference field to VD and alerts indexes #689

Merged
merged 1 commit into from
Feb 20, 2025

Conversation

AlexRuiz7
Copy link
Member

@AlexRuiz7 AlexRuiz7 commented Feb 17, 2025

Description

This PR adds the vulnerability.scanner.reference field to VD index mappings.

index template

{
  "index_patterns": [
    "wazuh-states-vulnerabilities-*"
  ],
  "priority": 1,
  "template": {
    "settings": {
      "index": {
        "codec": "best_compression",
        "number_of_replicas": "0",
        "number_of_shards": "1",
        "query.default_field": [
          "agent.id",
          "host.os.full",
          "host.os.version",
          "package.name",
          "package.version",
          "vulnerability.id",
          "vulnerability.description",
          "vulnerability.severity",
          "wazuh.cluster.name"
        ],
        "refresh_interval": "5s"
      }
    },
    "mappings": {
      "date_detection": false,
      "dynamic": "strict",
      "properties": {
        "agent": {
          "properties": {
            "build": {
              "properties": {
                "original": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "ephemeral_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "host": {
          "properties": {
            "os": {
              "properties": {
                "full": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "kernel": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "platform": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "type": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        },
        "package": {
          "properties": {
            "architecture": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "build_version": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "checksum": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "description": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "install_scope": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "installed": {
              "type": "date"
            },
            "license": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "name": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "path": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "reference": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "size": {
              "type": "unsigned_long"
            },
            "type": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "version": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        },
        "vulnerability": {
          "properties": {
            "category": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "classification": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "description": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "detected_at": {
              "type": "date"
            },
            "enumeration": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "published_at": {
              "type": "date"
            },
            "reference": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "report_id": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "scanner": {
              "properties": {
                "condition": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "reference": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "source": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "vendor": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "score": {
              "properties": {
                "base": {
                  "type": "float"
                },
                "environmental": {
                  "type": "float"
                },
                "temporal": {
                  "type": "float"
                },
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "severity": {
              "ignore_above": 1024,
              "type": "keyword"
            },
            "under_evaluation": {
              "type": "boolean"
            }
          }
        },
        "wazuh": {
          "properties": {
            "cluster": {
              "properties": {
                "name": {
                  "ignore_above": 1024,
                  "type": "keyword"
                },
                "node": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            },
            "schema": {
              "properties": {
                "version": {
                  "ignore_above": 1024,
                  "type": "keyword"
                }
              }
            }
          }
        }
      }
    }
  }
}

Related Issues

Resolves #688

Check List

  • Functionality includes testing.
  • API changes companion pull request created, if applicable.
  • Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@AlexRuiz7 AlexRuiz7 self-assigned this Feb 17, 2025
@AlexRuiz7 AlexRuiz7 linked an issue Feb 17, 2025 that may be closed by this pull request
4 tasks
@AlexRuiz7 AlexRuiz7 merged commit de36723 into 4.12.0 Feb 20, 2025
6 checks passed
@AlexRuiz7 AlexRuiz7 deleted the 688-ecs-cti-link branch February 20, 2025 11:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Define new URL field for CTI reference on index templates
2 participants