Add interface fields at inventory-networks root level (#573)

* Add interface fields to the root level Expected at root level on the inventory-networks index * Update inventory-networks index events generator and docs * Add network interface custom fields to event generator * Fix event generator * Normalize --------- Signed-off-by: Kevin Ledesma <[email protected]> Co-authored-by: Alex Ruiz <[email protected]>
wazuh · Dec 2, 2024 · b9a8ff3 · b9a8ff3
1 parent a5b41a5
commit b9a8ff3
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 7 deletions.
diff --git a/ecs/states-inventory-networks/event-generator/event_generator.py b/ecs/states-inventory-networks/event-generator/event_generator.py
@@ -44,8 +44,8 @@ def generate_random_agent():
     return agent
 
 
-def generate_random_host(is_root_level=False):
-    if is_root_level:
+def generate_random_host(is_root_level_level=False):
+    if is_root_level_level:
         host = {
         'ip': f'{random.randint(1, 255)}.{random.randint(0, 255)}.{random.randint(0, 255)}.{random.randint(0, 255)}',
         'mac': f'{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}:{random.randint(0, 255):02x}',
@@ -158,14 +158,25 @@ def generate_random_network():
     }
     return network
 
+def generate_random_interface(is_root_level=False):
+    if is_root_level:
+        interface = {
+            'mtu': f'{random.randint(1000000, 99999999)}',
+            'state': random.choice(['Active', 'Inactive', 'Unknown']),
+            'type': random.choice(['wireless', 'ethernet'])
+        }
+    else:
+        interface = {
+            'alias': f'alias{random.randint(0, 9999)}',
+            'name': f'name{random.randint(0, 9999)}',
+        }
+
+    return interface
 
 def generate_random_observer():
     observer = {
         'ingress': {
-            'interface': {
-                'alias': f'alias{random.randint(0, 9999)}',
-                'name': f'name{random.randint(0, 9999)}'
-            }
+            'interface': generate_random_interface(False)
         }
     }
     return observer
@@ -179,7 +190,8 @@ def generate_random_data(number):
             'agent': generate_random_agent(),
             'host': generate_random_host(True),
             'network': generate_random_network(),
-            'observer': generate_random_observer()
+            'observer': generate_random_observer(),
+            'interface': generate_random_interface(True)
         }
         data.append(event_data)
     return data

diff --git a/ecs/states-inventory-networks/fields/custom/interface.yml b/ecs/states-inventory-networks/fields/custom/interface.yml
@@ -1,5 +1,9 @@
 ---
 - name: interface
+  reusable:
+    top_level: true
+    expected:
+      - { at: observer.egress.interface, as: observer.ingress.interface }
   title: Interface
   type: group
   group: 2