Add states-fim index template definition (#397)

* Add stateless index template definition Event generator is pending * Update to 8.11.0 * Adding ecs mapping files for FIM index * Fix indentation issue in subset.yml * Remove hidden flag and event_generator * Rename states-inventory-fim folder * Fix subset.yml names --------- Co-authored-by: Álex Ruiz <[email protected]>
wazuh · Nov 18, 2024 · a9e0303 · a9e0303
1 parent 68fd4ff
commit a9e0303
Show file tree

Hide file tree

Showing 6 changed files with 97 additions and 1 deletion.
diff --git a/ecs/states-fim/fields/custom/agent.yml b/ecs/states-fim/fields/custom/agent.yml
@@ -0,0 +1,12 @@
+---
+- name: agent
+  title: Wazuh Agents
+  short: Wazuh Inc. custom fields.
+  type: group
+  group: 2
+  fields:
+    - name: groups
+      type: keyword
+      level: custom
+      description: >
+        The groups the agent belongs to.
diff --git a/ecs/states-fim/fields/mapping-settings.json b/ecs/states-fim/fields/mapping-settings.json
@@ -0,0 +1,4 @@
+{
+    "dynamic": "strict",
+    "date_detection": false
+}
diff --git a/ecs/states-fim/fields/subset.yml b/ecs/states-fim/fields/subset.yml
@@ -0,0 +1,36 @@
+---
+name: wazuh-states-fim
+fields:
+  base:
+    fields:
+      tags: []
+  agent:
+    fields:
+      id: {}
+      groups: {}
+  file:
+    fields:
+      attributes: {}
+      name: {}
+      path: {}
+      gid: {}
+      group: {}
+      inode: {}
+      hash:
+        fields:
+          md5: {}
+          sha1: {}
+          sha256: {}
+      mtime: {}
+      mode: {}
+      size: {}
+      target_path: {}
+      type: {}
+      uid: {}
+      owner: {}
+  registry:
+    fields:
+      key: {}
+      value: {}
+
+
diff --git a/ecs/states-fim/fields/template-settings-legacy.json b/ecs/states-fim/fields/template-settings-legacy.json
@@ -0,0 +1,21 @@
+{
+  "index_patterns": ["wazuh-states-fim*"],
+  "order": 1,
+  "settings": {
+    "index": {
+      "number_of_shards": "1",
+      "number_of_replicas": "0",
+      "refresh_interval": "5s",
+      "query.default_field": [
+        "agent.id",
+        "agent.groups",
+        "file.name",
+        "file.path",
+        "file.target_path",
+        "file.group",
+        "file.uid",
+        "file.gid"
+      ]
+    }
+  }
+}
diff --git a/ecs/states-fim/fields/template-settings.json b/ecs/states-fim/fields/template-settings.json
@@ -0,0 +1,23 @@
+{
+  "index_patterns": ["wazuh-states-fim*"],
+  "priority": 1,
+  "template": {
+    "settings": {
+      "index": {
+        "number_of_shards": "1",
+        "number_of_replicas": "0",
+        "refresh_interval": "5s",
+        "query.default_field": [
+          "agent.id",
+          "agent.groups",
+          "file.name",
+          "file.path",
+          "file.target_path",
+          "file.group",
+          "file.uid",
+          "file.gid"
+        ]
+      }
+    }
+  }
+}
diff --git a/ecs/states-vulnerabilities/fields/subset.yml b/ecs/states-vulnerabilities/fields/subset.yml
@@ -1,5 +1,5 @@
 ---
-name: wazuh-inventory-vulnerabilities
+name: wazuh-states-vulnerabilities
 fields:
   base:
     fields: