diff --git a/ecs/alerts/event-generator/event_generator.py b/ecs/alerts/event-generator/event_generator.py deleted file mode 100644 index f676f0176d444..0000000000000 --- a/ecs/alerts/event-generator/event_generator.py +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/python3 - -import datetime -import random -import json -import requests -import warnings -import logging - -# Constants and Configuration -LOG_FILE = 'generate_data.log' -GENERATED_DATA_FILE = 'generatedData.json' -DATE_FORMAT = "%Y-%m-%dT%H:%M:%S.%fZ" - -# Configure logging -logging.basicConfig(filename=LOG_FILE, level=logging.INFO) - -# Suppress warnings -warnings.filterwarnings("ignore") - - -def generate_random_date(): - start_date = datetime.datetime.now() - end_date = start_date - datetime.timedelta(days=10) - random_date = start_date + (end_date - start_date) * random.random() - return random_date.strftime(DATE_FORMAT) - - -def generate_random_agent(): - agent = { - 'id': f'agent{random.randint(0, 99)}', - 'name': f'Agent{random.randint(0, 99)}', - 'type': random.choice(['filebeat', 'windows', 'linux', 'macos']), - 'version': f'v{random.randint(0, 9)}-stable', - 'is_connected': random.choice([True, False]), - 'last_login': generate_random_date(), - 'groups': [f'group{random.randint(0, 99)}', f'group{random.randint(0, 99)}'], - 'key': f'key{random.randint(0, 999)}' - } - return agent - - -def generate_random_host(): - family = random.choice(['debian', 'ubuntu', 'macos', 'ios', 'android', 'RHEL']) - version = f'{random.randint(0, 99)}.{random.randint(0, 99)}' - host = { - 'ip': f'{random.randint(1, 255)}.{random.randint(1, 255)}.{random.randint(1, 255)}.{random.randint(1, 255)}', - 'os': { - 'full': f'{family} {version}', - } - } - return host - - -def generate_random_data(number): - data = [] - for _ in range(number): - event_data = { - 'agent': generate_random_agent(), - 'host': generate_random_host(), - } - data.append(event_data) - return data - - -def inject_events(ip, port, index, username, password, data): - url = f'https://{ip}:{port}/{index}/_doc' - session = requests.Session() - session.auth = (username, password) - session.verify = False - headers = {'Content-Type': 'application/json'} - - try: - for event_data in data: - response = session.post(url, json=event_data, headers=headers) - if response.status_code != 201: - logging.error(f'Error: {response.status_code}') - logging.error(response.text) - break - logging.info('Data injection completed successfully.') - except Exception as e: - logging.error(f'Error: {str(e)}') - - -def main(): - try: - number = int(input("How many events do you want to generate? ")) - except ValueError: - logging.error("Invalid input. Please enter a valid number.") - return - - logging.info(f"Generating {number} events...") - data = generate_random_data(number) - - with open(GENERATED_DATA_FILE, 'a') as outfile: - for event_data in data: - json.dump(event_data, outfile) - outfile.write('\n') - - logging.info('Data generation completed.') - - inject = input( - "Do you want to inject the generated data into your indexer? (y/n) ").strip().lower() - if inject == 'y': - ip = input("Enter the IP of your Indexer: ") - port = input("Enter the port of your Indexer: ") - index = input("Enter the index name: ") - username = input("Username: ") - password = input("Password: ") - inject_events(ip, port, index, username, password, data) - - -if __name__ == "__main__": - main() diff --git a/ecs/generate.sh b/ecs/generate.sh index 1409404d4e6f5..7b860256f0936 100755 --- a/ecs/generate.sh +++ b/ecs/generate.sh @@ -57,14 +57,6 @@ generate_mappings() { echo "Removing scaling_factor lines" find "$OUT_DIR" -type f -exec sed -i '/scaling_factor/d' {} \; - # Replace "constant_keyword" type (not supported by OpenSearch) with "keyword" - echo "Replacing \"constant_keyword\" type with \"keyword\"" - find "$OUT_DIR" -type f -exec sed -i 's/constant_keyword/keyword/g' {} \; - - # Replace "flattened" type (not supported by OpenSearch) with "flat_object" - echo "Replacing \"flattened\" type with \"flat_object\"" - find "$OUT_DIR" -type f -exec sed -i 's/flattened/flat_object/g' {} \; - local IN_FILE="$OUT_DIR/generated/elasticsearch/legacy/template.json" local OUT_FILE="$OUT_DIR/generated/elasticsearch/legacy/template-tmp.json" diff --git a/ecs/states-inventory-system/fields/custom/wazuh-agent.yml b/ecs/states-inventory-system/fields/custom/agent.yml similarity index 100% rename from ecs/states-inventory-system/fields/custom/wazuh-agent.yml rename to ecs/states-inventory-system/fields/custom/agent.yml