Update Network Inventory Format

[vikman90]

Parent Issue: #292

Description

Update the network inventory format to comply with the Elastic Common Schema (ECS).

Data Fields

Field	Type	Example
agent.groups	keyword
agent.id	keyword
host.ip	ip
host.mac	keyword
host.network.egress.bytes	long
host.network.egress.drops	long
host.network.egress.errors	long
host.network.egress.packets	long
host.network.ingress.bytes	long
host.network.ingress.drops	long
host.network.ingress.errors	long
host.network.ingress.packets	long
network.broadcast	ip
network.dhcp	keyword
network.gateway	ip
network.metric	long
network.netmask	ip
network.protocol	keyword
network.type	keyword
observer.ingress.interface.alias	keyword
observer.ingress.interface.name	keyword

Tasks

• Update the unified network inventory structure (interface, protocol, and address) according to ECS.

Dependencies

• Refactor network interfaces and protocols inventory tables #284

References

• Common schema definitions: Wazuh Indexer Plugins
• ECS documentation: Elastic ECS Documentation

[cborla]

Work report

November 21

• PR created.
• Adapt configuration tables names wazuh-agent.yml file.

November 21

• Rebased to Refactor network interfaces and protocols inventory tables
  Refactor network interfaces and protocols inventory tables #284
• fixing UT.

[cborla]

Tables Documentation

[cborla]

Adapted table

{
    "id": "aW52ZW50b3J5Om5ldHdvcmtzOmVucDBzMzo6aXB2Njo6ZmU4MDo6MTVjMDo5MzQ4OjNlOTQ6Y2NjNA==",
    "module": "inventory",
    "operation": "create",
    "type": "networks"
}
{
    "@timestamp": "2024/11/27 01:48:43",
    "host":
    {
        "ip":
        [
            "fe80::15c0:9348:3e94:ccc4"
        ],
        "mac": "08:00:27:66:be:1e",
        "network":
        {
            "egress":
            {
                "bytes": 7163859,
                "drops": 0,
                "errors": 0,
                "packets": 81982
            },
            "ingress":
            {
                "bytes": 367712532,
                "drops": 0,
                "errors": 0,
                "packets": 269344
            }
        }
    },
    "interface":
    {
        "mtu": 1500,
        "state": "up",
        "type": "ethernet"
    },
    "network":
    {
        "broadcast":
        [
            ""
        ],
        "dhcp": "unknown",
        "gateway":
        [
            "10.0.2.1"
        ],
        "metric": "",
        "netmask":
        [
            "ffff:ffff:ffff:ffff::"
        ],
        "protocol": "",
        "type": "ipv6"
    },
    "observer":
    {
        "ingress":
        {
            "interface":
            {
                "alias": "",
                "name": "enp0s3"
            }
        }
    }
}