Skip to content

[cloud_security_posture] vulnerability.published_date is keyword while all other packages use date #14538

@andrewkroh

Description

@andrewkroh

The cloud_security_posture package declares vulnerability.published_date as a keyword type which conflicts with several other packages that declare this field as a date. We should align the data types to avoid conflicts in the logs-* data view.

The other usages as date are in:

  • packages/m365_defender/data_stream/vulnerability/fields/vulnerability.yml:4:7
  • packages/microsoft_defender_endpoint/data_stream/vulnerability/fields/vulnerability.yml:4:7
  • packages/nozomi_networks/data_stream/node_cve/fields/vulnerability.yml:4:7 date
  • packages/rapid7_insightvm/data_stream/asset_vulnerability/fields/vulnerability.yml:4:7
  • packages/rapid7_insightvm/elasticsearch/transform/latest_cdr_vulnerabilities/fields/vulnerability.yml:4:7
  • packages/tenable_io/data_stream/vulnerability/fields/vulnerability.yml:6:7
  • packages/tenable_io/elasticsearch/transform/latest_cdr_vulnerabilities/fields/vulnerability.yml:6:7

I recommend adding this field to ECS too. Packages should not generally create new fields under namespaces managed by ECS (e.g. vulnerability.*) because of the potential for conflicting definitions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Integration:cloud_security_postureSecurity Posture ManagementTeam:Cloud SecurityCloud Security team [elastic/cloud-security-posture]Team:Sit-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]bugSomething isn't working, use only for issues

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions