Comms API - Stateful endpoint with ECS compliant models

[fdalmaup]

Description

As part of the 5.0 MVP refinement, we need to make adjustments to the POST /events/stateful endpoint, specifically to the expected fields in the request body. In wazuh/wazuh-indexer#270, the Indexer team has defined the index data model (template) for the following stateful indices that can already be checked in the ecs/docs folder:

• System Inventory
• Processes Inventory
• Packages Inventory
• Network Inventory
• Ports Inventory
• Hardware Inventory
• Hotfixes Inventory
• Vulnerabilities
• FIM

Taking into account the streaming protocol we have established for the stateful events in #26709 (comment), which has the following structure:

{
# Agent Metadata
}
{
# Module information
}
{
# Event
}
{
# Module information
}
{
# Event
}

Note

For the "operation": "delete" type we do not expect an Event.

The requirement is to only validate the information related to the Agent Metadata and the Module information since it is required for the query to the indexer and pass the Event without validating its fields.

Tasks

• Make the necessary modifications to the StatefulEvent model.
• Check that every module is mapped to its correspondent index name.
• Test against a deployed indexer that the received bulk is correctly sent and indexed.

[GGP1]

Update

Fixed various bugs in the batcher when sending and receiving multiple events and removed the events classes, moving the validation layer to the indexer.