maxmustermann/kibana
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add ECS field for event.code. (#85109)

Browse source
This commit is contained in:
Pete Hampton 2020-12-09 08:33:10 +00:00 committed by GitHub
parent f2d961df6a
commit fc2673b8b0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts
View file

@ -129,6 +129,7 @@ describe('data generator', () => {
const alert = generator.generateAlert({ ts: timestamp });
expect(alert['@timestamp']).toEqual(timestamp);
expect(alert.event?.action).not.toBeNull();
expect(alert.event?.code).not.toBeNull();
expect(alert.Endpoint).not.toBeNull();
expect(alert.agent).not.toBeNull();
expect(alert.host).not.toBeNull();

1
x-pack/plugins/security_solution/common/endpoint/generate_data.ts
View file

@ -531,6 +531,7 @@ export class EndpointDocGenerator {
action: this.randomChoice(FILE_OPERATIONS),
kind: 'alert',
category: 'malware',
code: 'malicious_file',
id: this.seededUUIDv4(),
dataset: 'endpoint',
module: 'endpoint',

1
x-pack/plugins/security_solution/common/endpoint/types/index.ts
View file

@ -453,6 +453,7 @@ type DllFields = Partial<{
export type AlertEvent = Partial<{
event: Partial<{
action: ECSField<string>;
code: ECSField<string>;
dataset: ECSField<string>;
module: ECSField<string>;
}>;