Add new custom field to the vulnerability detector index (#141)

* Add new custom field to the vulnerability detector index

* Update event generator tool

* Remove base.labels ECS field from wazuh-states-vulnerabilities index mappings

Author: AlexRuiz7

.gitignore

@@ -1,6 +1,9 @@
 # build files
 artifacts/
 
+.java
+.m2
+
 # intellij files
 .idea/
 *.iml

ecs/generate.sh

@@ -27,6 +27,7 @@ generate_mappings() {
     --subset "$IN_FILES_DIR/subset.yml" \
     --template-settings "$IN_FILES_DIR/template-settings.json" \
     --template-settings-legacy "$IN_FILES_DIR/template-settings-legacy.json" \
+    --mapping-settings "$IN_FILES_DIR/mapping-settings.json" \
     --out "$OUT_DIR" || exit 1
 
   # Replace "match_only_text" type (not supported by OpenSearch) with "text"

ecs/vulnerability-detector/event-generator/event_generator.py

@@ -163,15 +163,16 @@ def generate_random_vulnerability():
             'temporal': round(random.uniform(0, 10), 1),
             'version': round(random.uniform(0, 10), 1)
         },
-        'severity': random.choice(['low', 'medium', 'high', 'critical'])
+        'severity': random.choice(['Low', 'Medium', 'High', 'Critical'])
     }
     return vulnerability
 
 
 def generate_random_wazuh():
     wazuh = {
         'cluster': {
-            'name': f'wazuh-cluster-{random.randint(0,10)}'
+            'name': f'wazuh-cluster-{random.randint(0,10)}',
+            'node': f'wazuh-cluster-node-{random.randint(0,10)}'
         }
     }
     return wazuh
@@ -186,7 +187,7 @@ def generate_random_data(number):
             'ecs': {'version': '1.7.0'},
             # 'event': generate_random_event(),
             'host': generate_random_host(),
-            'labels': generate_random_labels(),
+            # 'labels': generate_random_labels(),
             'message': f'message{random.randint(0, 99999)}',
             'package': generate_random_package(),
             'tags': generate_random_tags(),

ecs/vulnerability-detector/fields/custom/wazuh.yml

@@ -8,4 +8,9 @@
       type: keyword
       level: custom
       description: >
-        Wazuh cluster name.
+        Wazuh cluster name.
+    - name: cluster.node
+      type: keyword
+      level: custom
+      description: >
+        Wazuh cluster node name.

ecs/vulnerability-detector/fields/mapping-settings.json

@@ -0,0 +1,4 @@
+{
+    "dynamic": "strict",
+    "date_detection": false
+}

ecs/vulnerability-detector/fields/subset.yml

@@ -2,7 +2,10 @@
 name: vulnerability_detector
 fields:
   base:
-    fields: "*"
+    fields: 
+      "@timestamp": {}
+      tags: []
+      message: ""
   agent:
     fields: "*"
   ecs: