Repository navigation
[meta] ECS 8.3 Updates (Security External Integrations) #3200
Description
This is a meta issue to track ECS 8.3 updates to Fleet integrations maintained by the elastic/security-external-integrations team.
ECS 8.3 Changes
This is a summary of the changes in ECS 8.3. You can view the official changelog here.
Added
- Added
patternattribute to.macfields. - Add
orchestrator.cluster.id - Add
orchestrator.resource.id
SEI owned Integrations
All integrations are updated in #3353. Separate PRs were merged to correct packages that were not formatting MACs as expected and these could be merged since this was already part of ECS prior to 8.3.
Integrations SEI contributes to
I reviewed these to see if they were affected any changes to ECS. None of them were affected so I didn't open a PR.
- aws.cloudtrail
- aws.vpcflow
- system.application
- system.auth
- system.security
- system.system
- windows.forwarded
- windows.powershell
- windows.powershell_operational
- windows.sysmon_operational
Activity
elasticmachine commentedon Apr 26, 2022
Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
andrewkroh commentedon May 6, 2022
It's going to be difficult to implement the MAC address formatting because there are parts of Beats producing these fields.
Modify Beats to format the MACs before sending.
Add a processor to the Fleet final pipeline.
Have Agent inject a Beat processor into the Beat configuration to format the MAC.
Modify every integration that uses add_host_metadata to have an ingest node processor to format
host.mac.