Fix template-settings fields (#490)

* Update vulnerabilities template-settings fields * Update ecs templates definitions
wazuh · Oct 23, 2024 · 4fad7ba · 4fad7ba
1 parent 62e4d4b
commit 4fad7ba
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 3 deletions.
diff --git a/ecs/alerts/fields/custom/agent.yml b/ecs/alerts/fields/custom/agent.yml
@@ -0,0 +1,12 @@
+---
+- name: agent
+  title: Wazuh Agents
+  short: Wazuh Inc. custom fields.
+  type: group
+  group: 2
+  fields:
+    - name: groups
+      type: keyword
+      level: custom
+      description: >
+        The groups the agent belongs to.
diff --git a/ecs/states-vulnerabilities/fields/custom/agent.yml b/ecs/states-vulnerabilities/fields/custom/agent.yml
@@ -0,0 +1,12 @@
+---
+- name: agent
+  title: Wazuh Agents
+  short: Wazuh Inc. custom fields.
+  type: group
+  group: 2
+  fields:
+    - name: groups
+      type: keyword
+      level: custom
+      description: >
+        The groups the agent belongs to.
diff --git a/ecs/states-vulnerabilities/fields/template-settings-legacy.json b/ecs/states-vulnerabilities/fields/template-settings-legacy.json
@@ -8,7 +8,7 @@
       "refresh_interval": "5s",
       "query.default_field": [
         "agent.id",
-        "agent.group",
+        "agent.groups",
         "host.os.full",
         "host.os.version",
         "package.name",
@@ -20,4 +20,4 @@
       ]
     }
   }
-}
+}
diff --git a/ecs/states-vulnerabilities/fields/template-settings.json b/ecs/states-vulnerabilities/fields/template-settings.json
@@ -9,7 +9,7 @@
         "refresh_interval": "5s",
         "query.default_field": [
           "agent.id",
-          "agent.group",
+          "agent.groups",
           "host.os.full",
           "host.os.version",
           "package.name",