[Security Solution] Missing ECS fields in alerts (.alerts-security.alerts-default) index mappings #153971
Labels
bug
Fixes for quality problems that affect the customer experience
Team:Detection Alerts
Security Detection Alerts Area Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
triage_needed
Describe the bug:
Missing ECS fields in alerts index
It was reported in internal SDH ticket
Kibana/Elasticsearch Stack version:
At least 8.6+
Steps to reproduce:
data_stream.namespace
data_stream.namespace
from alert viewAny additional context (logs, chat logs, magical formulas, etc.):
This field is not searchable, because
data_stream.namespace
is not in mapping of alerts index, even though its ECS field, because it is absent in a ECS fields map https://github.com/elastic/kibana/blob/8.7/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts, that is used to provision.alerts-security.alerts-default
index.The solution could be to update this list, so it would contain all missing ECS fields.
But it raises further questions, how changes in ECS can be tracked and how to keep ECS fields up to date.
Similar ticket for non ECS fields in alerts view: #131623
The text was updated successfully, but these errors were encountered: