Add process.tty as a custom field

wazuh · Sep 12, 2024 · f15fee0 · f15fee0
1 parent fe1751a
commit f15fee0
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 37 deletions.
diff --git a/ecs/states-inventory-processes/fields/custom/tty.yml b/ecs/states-inventory-processes/fields/custom/tty.yml
@@ -0,0 +1,12 @@
+---
+- name: process
+  title: Wazuh Agents
+  short: Wazuh Inc. custom fields.
+  type: group
+  group: 2
+  fields:
+    - name: tty
+      type: keyword
+      level: custom
+      description: >
+        The groups the agent belongs to.
diff --git a/ecs/states-inventory-processes/fields/subset.yml b/ecs/states-inventory-processes/fields/subset.yml
@@ -5,40 +5,39 @@ fields:
     fields:
       "@timestamp": {}
       tags: []
-    agent:
-      fields:
-        id: {}
-        groups: {}
-    process:
-      fields:
-        pid: {}
-        name: ""
-        parent:
-          fields:
-            pid: {}
-            command_line: ""
-            args: ""
-            user:
-              fields:
-                id: ""
-            real_user:
-              fields:
-                id: ""
-            saved_user:
-              fields:
-                id: ""
-            group:
-              fields:
-                id: ""
-            real_group:
-              fields:
-                id: ""
-            saved_group:
-              fields:
-                id: ""
-            start: {}
-            thread:
-              fields:
-                id: ""
-            tty: {}
-
+  agent:
+    fields:
+      id: {}
+      groups: {}
+  process:
+    fields:
+      pid: {}
+      name: ""
+      parent:
+        fields:
+          pid: {}
+      command_line: ""
+      args: ""
+      user:
+        fields:
+          id: ""
+      real_user:
+        fields:
+          id: ""
+      saved_user:
+        fields:
+          id: ""
+      group:
+        fields:
+          id: ""
+      real_group:
+        fields:
+          id: ""
+      saved_group:
+        fields:
+          id: ""
+      start: {}
+      thread:
+        fields:
+          id: ""
+      tty: ""