Add tty char_device.major field to processes mapping

Update event generator to implement tty fields
wazuh · Dec 6, 2024 · 1537f13 · 1537f13
1 parent 1dd7be5
commit 1537f13
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/ecs/states-inventory-processes/event-generator/event_generator.py b/ecs/states-inventory-processes/event-generator/event_generator.py
@@ -152,6 +152,11 @@ def generate_random_process():
         },
         'user': {
             'id': f'userid{random.randint(0, 9999)}'
+        },
+        'tty': {
+            'char_device': {
+                'major': random.randint(0, 5)
+            }
         }
     }
     return process

diff --git a/ecs/states-inventory-processes/fields/subset.yml b/ecs/states-inventory-processes/fields/subset.yml
@@ -45,3 +45,8 @@ fields:
       thread:
         fields:
           id: ""
+      tty:
+        fields:
+          char_device:
+            fields:
+              major: ""
-Original file line number
+Diff line change
@@ Expand Up / @@ -45,3 +45,8 @@ fields: @@
           thread:
             fields:
               id: ""
+          tty:
+            fields:
+              char_device:
+                fields:
+                  major: ""