Changed auditd fields for ECS #10195
Conversation
- Rename `process.cwd` to `process.working_directory` in auditd module. - Change data type of `process.pid` and `process.ppid` to number in JSON output. - Add user.id (same as UID) and user.name. - Add group.id (same as GID) and group.name. Issue elastic#10111
b2ac61c to
7f3c1dd
Compare
The JSON data type was number but ECS says it should be a keyword which is a JSON string. Fixes elastic#9607
|
My proposal in #10111 (comment) of a nested structure for |
There was a problem hiding this comment.
LGTM overall.
But as @cwurm is suggesting, what do you think about trying the proposed nesting for user/group? Most recent and clear example of it is in this comment
| |`process.pid` |string |number | ||
| |`process.ppid` |string |number | ||
| |====================== | ||
|
|
There was a problem hiding this comment.
Love this file. All Beats should have that!
cc @ruflin
There was a problem hiding this comment.
I'm hoping to generate something like this out of our migration file.
@cwurm Can you take on the additional user related changes? Thanks! |
process.cwdtoprocess.working_directoryin auditd module.process.pidandprocess.ppidto number in JSON output of auditd module.file.uidandfile.gidto string in JSON output for the FIM module.Issue #10111