diff --git a/ecs/states-inventory-processes/fields/custom/agent.yml b/ecs/states-inventory-processes/fields/custom/agent.yml new file mode 100644 index 0000000000000..3482123af637a --- /dev/null +++ b/ecs/states-inventory-processes/fields/custom/agent.yml @@ -0,0 +1,12 @@ +--- +- name: agent + title: Wazuh Agents + short: Wazuh Inc. custom fields. + type: group + group: 2 + fields: + - name: groups + type: keyword + level: custom + description: > + The groups the agent belongs to. diff --git a/ecs/states-inventory-processes/fields/mapping-settings.json b/ecs/states-inventory-processes/fields/mapping-settings.json new file mode 100644 index 0000000000000..0ad2b48fcc1be --- /dev/null +++ b/ecs/states-inventory-processes/fields/mapping-settings.json @@ -0,0 +1,4 @@ +{ + "dynamic": "strict", + "date_detection": false +} \ No newline at end of file diff --git a/ecs/states-inventory-processes/fields/subset.yml b/ecs/states-inventory-processes/fields/subset.yml new file mode 100644 index 0000000000000..29e97c8969d86 --- /dev/null +++ b/ecs/states-inventory-processes/fields/subset.yml @@ -0,0 +1,42 @@ +--- +name: wazuh-states-inventory-processes +fields: + base: + fields: + "@timestamp": {} + tags: [] + agent: + fields: + id: {} + groups: {} + process: + fields: + pid: {} + name: "" + parent: + fields: + pid: {} + command_line: "" + args: "" + user: + fields: + id: "" + real_user: + fields: + id: "" + saved_user: + fields: + id: "" + group: + fields: + id: "" + real_group: + fields: + id: "" + saved_group: + fields: + id: "" + start: {} + thread: + fields: + id: "" diff --git a/ecs/states-inventory-processes/fields/template-settings-legacy.json b/ecs/states-inventory-processes/fields/template-settings-legacy.json new file mode 100644 index 0000000000000..0c5363d2feeb7 --- /dev/null +++ b/ecs/states-inventory-processes/fields/template-settings-legacy.json @@ -0,0 +1,18 @@ +{ + "index_patterns": ["wazuh-states-inventory-processes*"], + "order": 1, + "settings": { + "index": { + "number_of_shards": "1", + "number_of_replicas": "0", + "refresh_interval": "5s", + "query.default_field": [ + "agent.id", + "agent.groups", + "process.name", + "process.pid", + "process.command_line" + ] + } + } +} diff --git a/ecs/states-inventory-processes/fields/template-settings.json b/ecs/states-inventory-processes/fields/template-settings.json new file mode 100644 index 0000000000000..15c0bc58c58ba --- /dev/null +++ b/ecs/states-inventory-processes/fields/template-settings.json @@ -0,0 +1,20 @@ +{ + "index_patterns": ["wazuh-states-inventory-processes*"], + "priority": 1, + "template": { + "settings": { + "index": { + "number_of_shards": "1", + "number_of_replicas": "0", + "refresh_interval": "5s", + "query.default_field": [ + "agent.id", + "agent.groups", + "process.name", + "process.pid", + "process.command_line" + ] + } + } + } +}