Add ECS docs

ecs/docs/inventory-hardware.md

@@ -0,0 +1,61 @@
+## `wazuh-states-inventory-hardware` index data model
+
+### Fields summary
+
+The fields are based on https://github.com/wazuh/wazuh-indexer/issues/282#issuecomment-2189837612
+
+Based on ECS:
+
+-   [Device Fields](https://www.elastic.co/guide/en/ecs/current/ecs-device.html).
+-   [Observer Fields](https://www.elastic.co/guide/en/ecs/current/ecs-device.html).
+
+|     | Field name   | ECS field name                | Data type | Description                      |
+| --- | ------------ | ----------------------------- | --------- | -------------------------------- |
+|     | scan_time    | @timestamp                    | date      | Timestamp of the scan            |
+|     | board_serial | observer.serial_number        | keyword   | Serial number of the motherboard |
+| *   | cpu_name     | device.cpu.name               | keyword   | Name of the CPU                  |
+| *   | cpu_cores    | device.cpu.cores              | long      | Number of CPU cores              |
+| *   | cpu_mhz      | device.cpu.speed              | long      | Speed of the CPU in MHz          |
+| *   | ram_total    | device.memory.total           | long      | Total RAM in the system          |
+| *   | ram_free     | device.memory.free            | long      | Free RAM in the system           |
+| *   | ram_usage    | device.memory.used.percentage | long      | RAM usage as a percentage        |
+
+\* Custom fields
+
+### ECS mapping
+
+```yml
+---
+name: wazuh-states-inventory-hardware
+fields:
+  base:
+    fields:
+      tags: []
+      "@timestamp": {}
+  observer:
+    fields:
+      serial_number: {}
+```
+
+### Index settings
+
+```json
+{
+  "index_patterns": [
+    "wazuh-states-inventory-hardware*"
+  ],
+  "priority": 1,
+  "template": {
+    "settings": {
+      "index": {
+        "number_of_shards": "1",
+        "number_of_replicas": "0",
+        "refresh_interval": "5s",
+        "query.default_field": [
+          "observer.board_serial"
+        ]
+      }
+    }
+  }
+}
+```

ecs/states-inventory-hardware/fields/custom/agent.yml

@@ -0,0 +1,12 @@
+---
+- name: agent
+  title: Wazuh Agents
+  short: Wazuh Inc. custom fields.
+  type: group
+  group: 2
+  fields:
+    - name: groups
+      type: keyword
+      level: custom
+      description: >
+        The groups the agent belongs to.

ecs/states-inventory-hardware/fields/custom/device.yml

@@ -0,0 +1,50 @@
+---
+- name: device
+  title: Device
+  type: group
+  group: 2
+  description: >
+    Device related data.
+  fields:
+    - name: cpu
+      type: group
+      group: 2
+      description: >
+        CPU related data.
+      fields:
+        - name: name
+          type: keyword
+          description: >
+            Name of the CPU.
+        - name: cores
+          type: long
+          description: >
+            Number of CPU cores.
+        - name: speed
+          type: long
+          description: >
+            Speed of the CPU in MHz.
+    - name: memory
+      type: group
+      group: 2
+      description: >
+        Memory related data.
+      fields:
+        - name: total
+          type: long
+          description: >
+            Total RAM in the system.
+        - name: free
+          type: long
+          description: >
+            Free RAM in the system.
+        - name: used
+          type: group
+          group: 2
+          description: >
+            Used memory data.
+          fields:
+          - name: percentage
+            type: long
+            description: >
+              Used RAM as a percentage.

ecs/states-inventory-hardware/fields/mapping-settings.json

@@ -0,0 +1,4 @@
+{
+    "dynamic": "strict",
+    "date_detection": false
+}

ecs/states-inventory-hardware/fields/subset.yml

@@ -0,0 +1,10 @@
+---
+name: wazuh-states-inventory-hardware
+fields:
+  base:
+    fields:
+      tags: []
+      "@timestamp": {}
+  observer:
+    fields:
+      serial_number: {}

ecs/states-inventory-hardware/fields/template-settings-legacy.json

@@ -0,0 +1,14 @@
+{
+  "index_patterns": ["wazuh-states-inventory-hardware*"],
+  "order": 1,
+  "settings": {
+    "index": {
+      "number_of_shards": "1",
+      "number_of_replicas": "0",
+      "refresh_interval": "5s",
+      "query.default_field": [
+        "observer.board_serial"
+      ]
+    }
+  }
+}

ecs/states-inventory-hardware/fields/template-settings.json

@@ -0,0 +1,18 @@
+{
+  "index_patterns": [
+    "wazuh-states-inventory-hardware*"
+  ],
+  "priority": 1,
+  "template": {
+    "settings": {
+      "index": {
+        "number_of_shards": "1",
+        "number_of_replicas": "0",
+        "refresh_interval": "5s",
+        "query.default_field": [
+          "observer.board_serial"
+        ]
+      }
+    }
+  }
+}