Add ECS field for event.code. (#85109)
This commit is contained in:
parent
f2d961df6a
commit
fc2673b8b0
|
@ -129,6 +129,7 @@ describe('data generator', () => {
|
|||
const alert = generator.generateAlert({ ts: timestamp });
|
||||
expect(alert['@timestamp']).toEqual(timestamp);
|
||||
expect(alert.event?.action).not.toBeNull();
|
||||
expect(alert.event?.code).not.toBeNull();
|
||||
expect(alert.Endpoint).not.toBeNull();
|
||||
expect(alert.agent).not.toBeNull();
|
||||
expect(alert.host).not.toBeNull();
|
||||
|
|
|
@ -531,6 +531,7 @@ export class EndpointDocGenerator {
|
|||
action: this.randomChoice(FILE_OPERATIONS),
|
||||
kind: 'alert',
|
||||
category: 'malware',
|
||||
code: 'malicious_file',
|
||||
id: this.seededUUIDv4(),
|
||||
dataset: 'endpoint',
|
||||
module: 'endpoint',
|
||||
|
|
|
@ -453,6 +453,7 @@ type DllFields = Partial<{
|
|||
export type AlertEvent = Partial<{
|
||||
event: Partial<{
|
||||
action: ECSField<string>;
|
||||
code: ECSField<string>;
|
||||
dataset: ECSField<string>;
|
||||
module: ECSField<string>;
|
||||
}>;
|
||||
|
|
Loading…
Reference in a new issue