os.yml

- name: os
  title: Operating System
  group: 2
  short: OS fields contain information about the operating system.
  description: >
    The OS fields contain information about the operating system.
  reusable:
    top_level: false
    expected:
      - observer
      - host
      - user_agent
  type: group
  fields:

    - name: platform
      level: extended
      type: keyword
      description: >
        Operating system platform (such centos, ubuntu, windows).
      example: darwin

    - name: name
      level: extended
      type: keyword
      example: "Mac OS X"
      description: >
        Operating system name, without the version.

    - name: full
      level: extended
      type: keyword
      example: "Mac OS Mojave"
      description: >
        Operating system name, including the version or code name.

    - name: family
      level: extended
      type: keyword
      example: "debian"
      description: >
        OS family (such as redhat, debian, freebsd, windows).

    - name: version
      level: extended
      type: keyword
      example: "10.14.1"
      description: >
        Operating system version as a raw string.

    - name: kernel
      level: extended
      type: keyword
      example: "4.4.0-112-generic"
      description: >
        Operating system kernel version as a raw string.