-
Notifications
You must be signed in to change notification settings - Fork 472
Open
Labels
Integration:cloud_security_postureSecurity Posture ManagementSecurity Posture ManagementTeam:Cloud SecurityCloud Security team [elastic/cloud-security-posture]Cloud Security team [elastic/cloud-security-posture]Team:Sit-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]bugSomething isn't working, use only for issuesSomething isn't working, use only for issues
Description
The cloud_security_posture package declares vulnerability.published_date
as a keyword type which conflicts with several other packages that declare this field as a date
. We should align the data types to avoid conflicts in the logs-*
data view.
integrations/packages/cloud_security_posture/data_stream/vulnerabilities/fields/vulnerability.yml
Lines 25 to 26 in 032c9fd
- name: published_date | |
type: keyword |
The other usages as date
are in:
- packages/m365_defender/data_stream/vulnerability/fields/vulnerability.yml:4:7
- packages/microsoft_defender_endpoint/data_stream/vulnerability/fields/vulnerability.yml:4:7
- packages/nozomi_networks/data_stream/node_cve/fields/vulnerability.yml:4:7 date
- packages/rapid7_insightvm/data_stream/asset_vulnerability/fields/vulnerability.yml:4:7
- packages/rapid7_insightvm/elasticsearch/transform/latest_cdr_vulnerabilities/fields/vulnerability.yml:4:7
- packages/tenable_io/data_stream/vulnerability/fields/vulnerability.yml:6:7
- packages/tenable_io/elasticsearch/transform/latest_cdr_vulnerabilities/fields/vulnerability.yml:6:7
I recommend adding this field to ECS too. Packages should not generally create new fields under namespaces managed by ECS (e.g. vulnerability.*
) because of the potential for conflicting definitions.
Metadata
Metadata
Assignees
Labels
Integration:cloud_security_postureSecurity Posture ManagementSecurity Posture ManagementTeam:Cloud SecurityCloud Security team [elastic/cloud-security-posture]Cloud Security team [elastic/cloud-security-posture]Team:Sit-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]bugSomething isn't working, use only for issuesSomething isn't working, use only for issues