4 Commits

Author SHA1 Message Date
Álex Ruiz Becerra
b8879394b8
Replace time-series indices with data streams (#652)
* Use v2 index templates

* Replace stateless indices with data streams

Replace legacy index template with v2 index templates

* Clean-up and document code

* Update 5_builderpackage_plugins_onpush.yml

Signed-off-by: Álex Ruiz Becerra <alejandro.ruiz.becerra@wazuh.com>

* Downgrade jackson to 2.18.2 to match OpenSearch's version

* Adapt tests

* Divide testClusters into two separates one to fix the test and allow the run

* Format files

* Fix index patterns and data streams creation

---------

Signed-off-by: Álex Ruiz Becerra <alejandro.ruiz.becerra@wazuh.com>
Co-authored-by: Jorge Sanchez <jorge.sanchez@wazuh.com>
2025-11-14 11:58:26 +01:00
Jorge Sánchez
9210a1e07c
Add Security Compliance fields to the WCS (#643)
* Add Security Compliance fields to the WCS

* Add CHANGELOG entry

* Apply changes from code review

* Fix double compliance field
2025-11-05 14:43:35 +01:00
Kevin Ledesma
9de219fd97
Implement pre-processing ECS sources types sanitization (#628)
* Add ECS source files sanitizer script

* Simplify sanitizer and improve logging

* Update schema_sanitizer to handle specific fields removal

* Update the ecs generator Dockerfile to use the sanitizer

* Improve sanitizer filtering

* Remove --ref flag from ECS generator to force the tool to use local source

* Update the Wazuh Common Schema

* Fix multi-fields deletion on sanitizer script

* Update the Wazuh Common Schema

* Fix nested fields sanitization and remove multi-fields specific fields list

* Update the Wazuh Common Schema

* Update documentation from README and scripts

Remove commented-out code

Improve methods docstrings

Add new script to README

* Restore WCS mappings modification

* Rename constants and fix styling

* Update CHANGELOG

* Revert changes on cloud-services-azure module

* Re-build WCS mappings using sanitized ECS definitions (#636)

* Re-build all the WCS index templates using the sanitized ECS

* Do not remove @timestamp on stateless modules

---------

Co-authored-by: Alex Ruiz <alejandro.ruiz.becerra@wazuh.com>

* Replace leftovers from ecs folder restructuring

Replace occurences of 'stateless-' with 'stateless/'

---------

Co-authored-by: Wazuh Indexer Bot <github_devel_xdrsiem_indexer@wazuh.com>
Co-authored-by: Alex Ruiz <alejandro.ruiz.becerra@wazuh.com>
2025-11-03 18:51:58 +01:00
Jorge Sánchez
e585189e7d
Restructure WCS files (#629)
* Initial renaming of the WCS files

Yet to be tested

* Fix scripts and generate the templates

* Fix broken links

* Format files

* Update the Wazuh Common Schema

* Apply changes from code review

* Fix IndexStateManagement

* Fix gen_ai data types replacements

* Disable nested fields actualization if the nested_fields.limit is less than 50

* Fix typo

* Actually fix gen_ai nested fields patching

* Fix IndexStateManagement tests

---------

Signed-off-by: Jorge Sánchez <jorge.sanchez@wazuh.com>
Co-authored-by: Alex Ruiz <alejandro.ruiz.becerra@wazuh.com>
Co-authored-by: Wazuh Indexer Bot <github_devel_xdrsiem_indexer@wazuh.com>
2025-10-31 17:30:09 +01:00