ti_*: Add missing fields in transform destination indices (2)

packages/ti_misp/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.33.1"
+  changes:
+    - description: Adjust field mappings for transform destination index.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/10066
 - version: "1.33.0"
   changes:
     - description: Improve handling of empty responses.

packages/ti_misp/elasticsearch/transform/latest_ioc/fields/base-fields.yml

@@ -7,22 +7,6 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: event.module
-  type: constant_keyword
-  description: Event module
-  value: ti_misp
-- name: event.dataset
-  type: constant_keyword
-  description: Event dataset
-  value: ti_misp.threat_attributes
-- name: threat.feed.name
-  type: constant_keyword
-  description: Display friendly feed name
-  value: MISP
-- name: threat.feed.dashboard_id
-  type: constant_keyword
-  description: Dashboard ID used for Kibana CTI UI
-  value: ti_misp-56ed8040-6c7d-11ec-9bce-f7a4dc94c294
 - name: "@timestamp"
   type: date
   description: Event timestamp.

packages/ti_misp/elasticsearch/transform/latest_ioc/fields/ecs.yml

@@ -80,3 +80,21 @@
   name: labels
 - name: threat.indicator.email.subject
   type: keyword
+# Below fields to be moved into base-fields.yml after kibana.version changed to >= 8.14 
+# Related to fix: https://github.com/elastic/kibana/pull/177608
+- name: event.module
+  type: constant_keyword
+  description: Event module
+  value: ti_misp
+- name: event.dataset
+  type: constant_keyword
+  description: Event dataset
+  value: ti_misp.threat_attributes
+- name: threat.feed.name
+  type: constant_keyword
+  description: Display friendly feed name
+  value: MISP
+- name: threat.feed.dashboard_id
+  type: constant_keyword
+  description: Dashboard ID used for Kibana CTI UI
+  value: ti_misp-56ed8040-6c7d-11ec-9bce-f7a4dc94c294

packages/ti_misp/elasticsearch/transform/latest_ioc/transform.yml

@@ -9,7 +9,7 @@ source:
 # us that ability in order to prevent having duplicate IoC data and prevent query
 # time field type conflicts.
 dest:
-  index: "logs-ti_misp_latest.dest_threat_attributes-1"
+  index: "logs-ti_misp_latest.dest_threat_attributes-2"
   aliases:
     - alias: "logs-ti_misp_latest.threat_attributes"
       move_on_creation: true
@@ -33,4 +33,4 @@ retention_policy:
 _meta:
   managed: true
   # Bump this version to delete, reinstall, and restart the transform during package.
-  fleet_transform_version: 0.1.1
+  fleet_transform_version: 0.2.0

packages/ti_misp/manifest.yml

@@ -1,6 +1,6 @@
 name: ti_misp
 title: MISP
-version: "1.33.0"
+version: "1.33.1"
 description: Ingest threat intelligence indicators from MISP platform with Elastic Agent.
 type: integration
 format_version: "3.0.2"

packages/ti_opencti/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.1.1"
+  changes:
+    - description: Adjust field mappings for transform destination index.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/10066
 - version: "2.1.0"
   changes:
     - description: Set sensitive values as secret.

packages/ti_opencti/data_stream/indicator/fields/ecs.yml

@@ -173,3 +173,7 @@
   name: threat.indicator.x509.subject.common_name
 - external: ecs
   name: threat.indicator.x509.version_number
+- name: event.module
+  type: constant_keyword
+  description: Event module
+  value: ti_misp

packages/ti_opencti/docs/README.md

@@ -201,6 +201,7 @@ The documentation for ECS fields can be found at:
 | event.id | Unique ID to describe the event. | keyword |
 | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date |
 | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword |
+| event.module | Event module | constant_keyword |
 | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword |
 | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword |
 | input.type | Input type. | keyword |

packages/ti_opencti/elasticsearch/transform/latest_ioc/fields/ecs.yml

@@ -173,3 +173,9 @@
   name: threat.indicator.x509.subject.common_name
 - external: ecs
   name: threat.indicator.x509.version_number
+# Below fields to be moved into base-fields.yml after kibana.version changed to >= 8.14 
+# Related to fix: https://github.com/elastic/kibana/pull/177608
+- name: event.module
+  type: constant_keyword
+  description: Event module
+  value: ti_misp

packages/ti_opencti/elasticsearch/transform/latest_ioc/transform.yml

@@ -10,7 +10,7 @@ source:
 # that ability in order to prevent having duplicate IoC data and prevent query
 # time field type conflicts.
 dest:
-  index: "logs-ti_opencti_latest.dest_indicator-1"
+  index: "logs-ti_opencti_latest.dest_indicator-2"
   aliases:
     - alias: "logs-ti_opencti_latest.indicator"
       move_on_creation: true
@@ -34,4 +34,4 @@ _meta:
   managed: true
   # Bump this version to delete, reinstall, and restart the transform during
   # package installation.
-  fleet_transform_version: 0.1.0
+  fleet_transform_version: 0.2.0

packages/ti_opencti/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: ti_opencti
 title: OpenCTI
-version: "2.1.0"
+version: "2.1.1"
 description: "Ingest threat intelligence indicators from OpenCTI with Elastic Agent."
 type: integration
 source:

packages/ti_recordedfuture/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.25.1"
+  changes:
+    - description: Adjust field mappings for transform destination index.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/10066
 - version: "1.25.0"
   changes:
     - description: Decode Evidence_Details field. This is a breaking change since the mapping is changed.

packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/fields/base-fields.yml

@@ -7,18 +7,6 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: event.module
-  type: constant_keyword
-  description: Event module
-  value: ti_recordedfuture
-- name: event.dataset
-  type: constant_keyword
-  description: Event dataset
-  value: ti_recordedfuture.threat
-- name: threat.feed.name
-  type: constant_keyword
-  description: Display friendly feed name
-  value: Recorded Future
 #
 # TODO: Add dashboard
 #

packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/fields/ecs.yml

@@ -72,3 +72,17 @@
   name: threat.indicator.sightings
 - external: ecs
   name: threat.indicator.geo.country_iso_code
+# Below fields to be moved into base-fields.yml after kibana.version changed to >= 8.14 
+# Related to fix: https://github.com/elastic/kibana/pull/177608
+- name: event.module
+  type: constant_keyword
+  description: Event module
+  value: ti_recordedfuture
+- name: event.dataset
+  type: constant_keyword
+  description: Event dataset
+  value: ti_recordedfuture.threat
+- name: threat.feed.name
+  type: constant_keyword
+  description: Display friendly feed name
+  value: Recorded Future

packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/fields/fields.yml

@@ -1,12 +1,3 @@
-- name: "event.created"
-  type: date
-  description: Time when event got created.
-- name: "event.ingested"
-  type: date
-  description: Time when event gets ingested into Elasticsearch.
-- name: "@timestamp"
-  type: date
-  description: Event timestamp.
 - name: recordedfuture
   type: group
   description: >

packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/transform.yml

@@ -9,7 +9,7 @@ source:
 # us that ability in order to prevent having duplicate IoC data and prevent query
 # time field type conflicts.
 dest:
-  index: "logs-ti_recordedfuture_latest.threat-1"
+  index: "logs-ti_recordedfuture_latest.threat-2"
   aliases:
     - alias: "logs-ti_recordedfuture_latest.threat"
       move_on_creation: true
@@ -35,4 +35,4 @@ _meta:
   managed: true
   # Bump this version to delete, reinstall, and restart the transform during package.
   # Version bump is needed if there is any code change in transform.
-  fleet_transform_version: 0.2.0
+  fleet_transform_version: 0.3.0

packages/ti_recordedfuture/manifest.yml

@@ -1,6 +1,6 @@
 name: ti_recordedfuture
 title: Recorded Future
-version: "1.25.0"
+version: "1.25.1"
 description: Ingest threat intelligence indicators from Recorded Future risk lists with Elastic Agent.
 type: integration
 format_version: 3.0.2

packages/ti_threatconnect/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.0.1"
+  changes:
+    - description: Adjust field mappings for transform destination index.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/10066
 - version: "1.0.0"
   changes:
     - description: Release package as GA.

packages/ti_threatconnect/elasticsearch/transform/latest/fields/base-fields.yml

@@ -10,7 +10,3 @@
 - name: '@timestamp'
   type: date
   description: Event timestamp.
-- name: threat.feed.name
-  type: constant_keyword
-  description: Display friendly feed name.
-  value: ThreatConnect Indicator

packages/ti_threatconnect/elasticsearch/transform/latest/fields/ecs.yml

@@ -62,3 +62,17 @@
   type: keyword
 - name: user_agent.original
   type: keyword
+# Below fields to be moved into base-fields.yml after kibana.version changed to >= 8.14 
+# Related to fix: https://github.com/elastic/kibana/pull/177608
+- name: event.module
+  type: constant_keyword
+  description: Event module.
+  value: ti_threatconnect
+- name: event.dataset
+  type: constant_keyword
+  description: Event dataset.
+  value: ti_threatconnect.indicator
+- name: threat.feed.name
+  type: constant_keyword
+  description: Display friendly feed name.
+  value: ThreatConnect Indicator

packages/ti_threatconnect/elasticsearch/transform/latest/transform.yml

@@ -9,7 +9,7 @@ source:
 # us that ability in order to prevent having duplicate IoC data and prevent query
 # time field type conflicts.
 dest:
-  index: "logs-ti_threatconnect_latest.dest_indicator-1"
+  index: "logs-ti_threatconnect_latest.dest_indicator-2"
   aliases:
     - alias: "logs-ti_threatconnect_latest.indicator"
       move_on_creation: true
@@ -32,4 +32,4 @@ _meta:
   managed: true
   # Bump this version to delete, reinstall, and restart the transform during package.
   # Version bump is needed if there is any code change in transform.
-  fleet_transform_version: 0.1.0
+  fleet_transform_version: 0.2.0

packages/ti_threatconnect/manifest.yml

@@ -2,7 +2,7 @@
 format_version: 3.0.3
 name: ti_threatconnect
 title: ThreatConnect
-version: 1.0.0
+version: 1.0.1
 description: Collects Indicators from ThreatConnect using the Elastic Agent and saves them as logs inside Elastic
 type: integration
 categories:

packages/ti_threatq/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.27.1"
+  changes:
+    - description: Adjust field mappings for transform destination index.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/10066
 - version: "1.27.0"
   changes:
     - description: Improve handling of empty responses.

packages/ti_threatq/elasticsearch/transform/latest_ioc/fields/base-fields.yml

@@ -7,18 +7,6 @@
 - name: data_stream.namespace
   type: constant_keyword
   description: Data stream namespace.
-- name: event.module
-  type: constant_keyword
-  description: Event module
-  value: ti_threatq
-- name: threat.feed.dashboard_id
-  type: constant_keyword
-  description: Dashboard ID used for Kibana CTI UI
-  value: ti_threatq-a05fd810-78f1-11ec-a97c-7db1518ab848
-- name: event.dataset
-  type: constant_keyword
-  description: Event dataset
-  value: ti_threatq.threat
 - name: "@timestamp"
   type: date
   description: Event timestamp.

packages/ti_threatq/elasticsearch/transform/latest_ioc/fields/ecs.yml

@@ -62,3 +62,18 @@
   name: threat.indicator.file.hash.sha512
 - external: ecs
   name: threat.indicator.marking.tlp
+# Below fields to be moved into base-fields.yml after kibana.version changed to >= 8.14 
+# Related to fix: https://github.com/elastic/kibana/pull/177608
+- name: event.module
+  type: constant_keyword
+  description: Event module
+  value: ti_threatq
+- name: threat.feed.dashboard_id
+  type: constant_keyword
+  description: Dashboard ID used for Kibana CTI UI
+  value: ti_threatq-a05fd810-78f1-11ec-a97c-7db1518ab848
+- name: event.dataset
+  type: constant_keyword
+  description: Event dataset
+  value: ti_threatq.threat
+

packages/ti_threatq/elasticsearch/transform/latest_ioc/transform.yml

@@ -9,7 +9,7 @@ source:
 # us that ability in order to prevent having duplicate IoC data and prevent query
 # time field type conflicts.
 dest:
-  index: "logs-ti_threatq_latest.dest_threat-1"
+  index: "logs-ti_threatq_latest.dest_threat-2"
   aliases:
     - alias: "logs-ti_threatq_latest.threat"
       move_on_creation: true
@@ -32,4 +32,4 @@ retention_policy:
 _meta:
   managed: true
   # Bump this version to delete, reinstall, and restart the transform during package.
-  fleet_transform_version: 0.1.0
+  fleet_transform_version: 0.2.0

packages/ti_threatq/manifest.yml

@@ -1,6 +1,6 @@
 name: ti_threatq
 title: ThreatQuotient
-version: "1.27.0"
+version: "1.27.1"
 description: Ingest threat intelligence indicators from ThreatQuotient with Elastic Agent.
 type: integration
 format_version: "3.0.2"