From 4c87bc46feb9897c02e8fef8f04e3ebe82dc4974 Mon Sep 17 00:00:00 2001
From: Marshall Main <marshall.main@elastic.co>
Date: Thu, 7 May 2020 12:41:54 -0400
Subject: [PATCH 1/4] update ECS schema to 1.6-dev, add endpoint alert fields

---
 .../routes/index/ecs_mapping.json             | 1962 +++++++++++++++--
 1 file changed, 1819 insertions(+), 143 deletions(-)

diff --git a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
index 5faa53db51101d..e356e195226fc4 100644
--- a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
+++ b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
@@ -7,6 +7,14 @@
       },
       "agent": {
         "properties": {
+          "build": {
+            "properties": {
+              "original": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
           "ephemeral_id": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -29,27 +37,6 @@
           }
         }
       },
-      "as": {
-        "properties": {
-          "number": {
-            "type": "long"
-          },
-          "organization": {
-            "properties": {
-              "name": {
-                "fields": {
-                  "text": {
-                    "norms": false,
-                    "type": "text"
-                  }
-                },
-                "ignore_above": 1024,
-                "type": "keyword"
-              }
-            }
-          }
-        }
-      },
       "client": {
         "properties": {
           "address": {
@@ -215,6 +202,10 @@
               "id": {
                 "ignore_above": 1024,
                 "type": "keyword"
+              },
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
               }
             }
           },
@@ -242,6 +233,18 @@
               }
             }
           },
+          "project": {
+            "properties": {
+              "id": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
           "provider": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -441,6 +444,141 @@
           }
         }
       },
+      "dll": {
+        "properties": {
+          "code_signature": {
+            "properties": {
+              "exists": {
+                "type": "boolean"
+              },
+              "status": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "subject_name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "trusted": {
+                "type": "boolean"
+              },
+              "valid": {
+                "type": "boolean"
+              }
+            }
+          },
+          "compile_time": {
+            "type": "date"
+          },
+          "hash": {
+            "properties": {
+              "md5": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "sha1": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "sha256": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "sha512": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
+          "malware_classification": {
+            "properties": {
+              "features": {
+                "properties": {
+                  "data": {
+                    "properties": {
+                      "buffer": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "decompressed_size": {
+                        "type": "integer"
+                      },
+                      "encoding": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  }
+                }
+              },
+              "identifier": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "score": {
+                "type": "double"
+              },
+              "threshold": {
+                "type": "double"
+              },
+              "upx_packed": {
+                "type": "boolean"
+              },
+              "version": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
+          "mapped_address": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
+          "mapped_size": {
+            "type": "long"
+          },
+          "name": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
+          "path": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
+          "pe": {
+            "properties": {
+              "architecture": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "company": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "description": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "file_version": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "imphash": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "original_file_name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "product": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          }
+        }
+      },
       "dns": {
         "properties": {
           "answers": {
@@ -528,6 +666,34 @@
           }
         }
       },
+      "endpoint": {
+        "properties": {
+          "artifact": {
+            "properties": {
+              "hash": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "version": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
+          "policy": {
+            "properties": {
+              "id": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          }
+        }
+      },
       "error": {
         "properties": {
           "code": {
@@ -620,6 +786,10 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "reference": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
           "risk_score": {
             "type": "float"
           },
@@ -642,6 +812,10 @@
           "type": {
             "ignore_above": 1024,
             "type": "keyword"
+          },
+          "url": {
+            "ignore_above": 1024,
+            "type": "keyword"
           }
         }
       },
@@ -654,6 +828,27 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "code_signature": {
+            "properties": {
+              "exists": {
+                "type": "boolean"
+              },
+              "status": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "subject_name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "trusted": {
+                "type": "boolean"
+              },
+              "valid": {
+                "type": "boolean"
+              }
+            }
+          },
           "created": {
             "type": "date"
           },
@@ -672,6 +867,9 @@
             "ignore_above": 1,
             "type": "keyword"
           },
+          "entry_modified": {
+            "type": "double"
+          },
           "extension": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -708,6 +906,159 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "macro": {
+            "properties": {
+              "code_page": {
+                "type": "long"
+              },
+              "collection": {
+                "properties": {
+                  "hash": {
+                    "properties": {
+                      "md5": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha1": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha256": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha512": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  }
+                },
+                "type": "object"
+              },
+              "errors": {
+                "properties": {
+                  "count": {
+                    "type": "long"
+                  },
+                  "error_type": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                },
+                "type": "nested"
+              },
+              "file_extension": {
+                "type": "long"
+              },
+              "project_file": {
+                "properties": {
+                  "hash": {
+                    "properties": {
+                      "md5": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha1": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha256": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha512": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  }
+                },
+                "type": "object"
+              },
+              "stream": {
+                "properties": {
+                  "hash": {
+                    "properties": {
+                      "md5": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha1": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha256": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha512": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "raw_code": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "raw_code_size": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                },
+                "type": "nested"
+              }
+            }
+          },
+          "malware_classification": {
+            "properties": {
+              "features": {
+                "properties": {
+                  "data": {
+                    "properties": {
+                      "buffer": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "decompressed_size": {
+                        "type": "integer"
+                      },
+                      "encoding": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  }
+                }
+              },
+              "identifier": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "score": {
+                "type": "double"
+              },
+              "threshold": {
+                "type": "double"
+              },
+              "upx_packed": {
+                "type": "boolean"
+              },
+              "version": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
+          "mime_type": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
           "mode": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -733,61 +1084,168 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
-          "size": {
-            "type": "long"
-          },
-          "target_path": {
-            "fields": {
-              "text": {
-                "norms": false,
-                "type": "text"
-              }
-            },
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "type": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "uid": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          }
-        }
-      },
-      "geo": {
-        "properties": {
-          "city_name": {
-            "ignore_above": 1024,
-            "type": "keyword"
+          "pe": {
+            "properties": {
+              "architecture": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "company": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "description": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "file_version": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "imphash": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "original_file_name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "product": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
           },
-          "continent_name": {
-            "ignore_above": 1024,
-            "type": "keyword"
+          "size": {
+            "type": "long"
           },
-          "country_iso_code": {
+          "target_path": {
+            "fields": {
+              "text": {
+                "norms": false,
+                "type": "text"
+              }
+            },
             "ignore_above": 1024,
             "type": "keyword"
           },
-          "country_name": {
+          "temp_file_path": {
             "ignore_above": 1024,
             "type": "keyword"
           },
-          "location": {
-            "type": "geo_point"
-          },
-          "name": {
+          "type": {
             "ignore_above": 1024,
             "type": "keyword"
           },
-          "region_iso_code": {
+          "uid": {
             "ignore_above": 1024,
             "type": "keyword"
           },
-          "region_name": {
-            "ignore_above": 1024,
-            "type": "keyword"
+          "x509": {
+            "properties": {
+              "alternative_names": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "issuer": {
+                "properties": {
+                  "common_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "country": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "distinguished_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "locality": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "organization": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "organizational_unit": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "state_or_province": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "not_after": {
+                "type": "date"
+              },
+              "not_before": {
+                "type": "date"
+              },
+              "public_key_algorithm": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "public_key_curve": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "public_key_exponent": {
+                "doc_values": false,
+                "index": false,
+                "type": "long"
+              },
+              "public_key_size": {
+                "type": "long"
+              },
+              "serial_number": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "signature_algorithm": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "subject": {
+                "properties": {
+                  "common_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "country": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "distinguished_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "locality": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "organization": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "organizational_unit": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "state_or_province": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "version_number": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
           }
         }
       },
@@ -807,26 +1265,6 @@
           }
         }
       },
-      "hash": {
-        "properties": {
-          "md5": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "sha1": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "sha256": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "sha512": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          }
-        }
-      },
       "host": {
         "properties": {
           "architecture": {
@@ -1068,6 +1506,14 @@
       },
       "log": {
         "properties": {
+          "file": {
+            "properties": {
+              "path": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
           "level": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -1161,6 +1607,23 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "inner": {
+            "properties": {
+              "vlan": {
+                "properties": {
+                  "id": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              }
+            },
+            "type": "object"
+          },
           "name": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -1179,11 +1642,60 @@
           "type": {
             "ignore_above": 1024,
             "type": "keyword"
+          },
+          "vlan": {
+            "properties": {
+              "id": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
           }
         }
       },
       "observer": {
         "properties": {
+          "egress": {
+            "properties": {
+              "interface": {
+                "properties": {
+                  "alias": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "id": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "vlan": {
+                "properties": {
+                  "id": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "zone": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            },
+            "type": "object"
+          },
           "geo": {
             "properties": {
               "city_name": {
@@ -1223,6 +1735,43 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "ingress": {
+            "properties": {
+              "interface": {
+                "properties": {
+                  "alias": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "id": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "vlan": {
+                "properties": {
+                  "id": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "zone": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            },
+            "type": "object"
+          },
           "ip": {
             "type": "ip"
           },
@@ -1314,57 +1863,17 @@
           }
         }
       },
-      "os": {
+      "package": {
         "properties": {
-          "family": {
+          "architecture": {
             "ignore_above": 1024,
             "type": "keyword"
           },
-          "full": {
-            "fields": {
-              "text": {
-                "norms": false,
-                "type": "text"
-              }
-            },
+          "build_version": {
             "ignore_above": 1024,
             "type": "keyword"
           },
-          "kernel": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "name": {
-            "fields": {
-              "text": {
-                "norms": false,
-                "type": "text"
-              }
-            },
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "platform": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "version": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          }
-        }
-      },
-      "package": {
-        "properties": {
-          "architecture": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "build_version": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "checksum": {
+          "checksum": {
             "ignore_above": 1024,
             "type": "keyword"
           },
@@ -1417,6 +1926,27 @@
           "args_count": {
             "type": "long"
           },
+          "code_signature": {
+            "properties": {
+              "exists": {
+                "type": "boolean"
+              },
+              "status": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "subject_name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "trusted": {
+                "type": "boolean"
+              },
+              "valid": {
+                "type": "boolean"
+              }
+            }
+          },
           "command_line": {
             "fields": {
               "text": {
@@ -1427,6 +1957,10 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "entity_id": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
           "executable": {
             "fields": {
               "text": {
@@ -1460,6 +1994,46 @@
               }
             }
           },
+          "malware_classification": {
+            "properties": {
+              "features": {
+                "properties": {
+                  "data": {
+                    "properties": {
+                      "buffer": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "decompressed_size": {
+                        "type": "integer"
+                      },
+                      "encoding": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  }
+                }
+              },
+              "identifier": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "score": {
+                "type": "double"
+              },
+              "threshold": {
+                "type": "double"
+              },
+              "upx_packed": {
+                "type": "boolean"
+              },
+              "version": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
           "name": {
             "fields": {
               "text": {
@@ -1479,6 +2053,27 @@
               "args_count": {
                 "type": "long"
               },
+              "code_signature": {
+                "properties": {
+                  "exists": {
+                    "type": "boolean"
+                  },
+                  "status": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "subject_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "trusted": {
+                    "type": "boolean"
+                  },
+                  "valid": {
+                    "type": "boolean"
+                  }
+                }
+              },
               "command_line": {
                 "fields": {
                   "text": {
@@ -1489,6 +2084,10 @@
                 "ignore_above": 1024,
                 "type": "keyword"
               },
+              "entity_id": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
               "executable": {
                 "fields": {
                   "text": {
@@ -1502,6 +2101,26 @@
               "exit_code": {
                 "type": "long"
               },
+              "hash": {
+                "properties": {
+                  "md5": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha1": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha256": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha512": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
               "name": {
                 "fields": {
                   "text": {
@@ -1560,6 +2179,38 @@
               }
             }
           },
+          "pe": {
+            "properties": {
+              "architecture": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "company": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "description": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "file_version": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "imphash": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "original_file_name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "product": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
           "pgid": {
             "type": "long"
           },
@@ -1569,17 +2220,125 @@
           "ppid": {
             "type": "long"
           },
+          "services": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
           "start": {
             "type": "date"
           },
           "thread": {
             "properties": {
+              "call_stack": {
+                "properties": {
+                  "instruction_pointer": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "memory_section": {
+                    "properties": {
+                      "address": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "protection": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "size": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "module_path": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "rva": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "symbol_info": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
               "id": {
                 "type": "long"
               },
               "name": {
                 "ignore_above": 1024,
                 "type": "keyword"
+              },
+              "service": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "start": {
+                "type": "date"
+              },
+              "start_address": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "start_address_module": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "token": {
+                "properties": {
+                  "domain": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "impersonation_level": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "integrity_level": {
+                    "type": "long"
+                  },
+                  "integrity_level_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "is_appcontainer": {
+                    "type": "boolean"
+                  },
+                  "privileges": {
+                    "properties": {
+                      "description": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "enabled": {
+                        "type": "boolean"
+                      },
+                      "name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    },
+                    "type": "nested"
+                  },
+                  "sid": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "type": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "user": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "uptime": {
+                "type": "long"
               }
             }
           },
@@ -1593,9 +2352,63 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "token": {
+            "properties": {
+              "domain": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "impersonation_level": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "integrity_level": {
+                "type": "long"
+              },
+              "integrity_level_name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "is_appcontainer": {
+                "type": "boolean"
+              },
+              "privileges": {
+                "properties": {
+                  "description": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "enabled": {
+                    "type": "boolean"
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                },
+                "type": "nested"
+              },
+              "sid": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "type": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "user": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          },
           "uptime": {
             "type": "long"
           },
+          "user": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
           "working_directory": {
             "fields": {
               "text": {
@@ -1661,6 +2474,10 @@
       },
       "rule": {
         "properties": {
+          "author": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
           "category": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -1673,6 +2490,10 @@
             "ignore_above": 1024,
             "type": "keyword"
           },
+          "license": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
           "name": {
             "ignore_above": 1024,
             "type": "keyword"
@@ -2051,26 +2872,669 @@
         "ignore_above": 1024,
         "type": "keyword"
       },
-      "threat": {
+      "target": {
         "properties": {
-          "framework": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "tactic": {
+          "dll": {
             "properties": {
-              "id": {
-                "ignore_above": 1024,
-                "type": "keyword"
+              "code_signature": {
+                "properties": {
+                  "exists": {
+                    "type": "boolean"
+                  },
+                  "status": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "subject_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "trusted": {
+                    "type": "boolean"
+                  },
+                  "valid": {
+                    "type": "boolean"
+                  }
+                }
               },
-              "name": {
-                "ignore_above": 1024,
-                "type": "keyword"
+              "compile_time": {
+                "type": "date"
               },
-              "reference": {
-                "ignore_above": 1024,
-                "type": "keyword"
-              }
+              "hash": {
+                "properties": {
+                  "md5": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha1": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha256": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha512": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "malware_classification": {
+                "properties": {
+                  "features": {
+                    "properties": {
+                      "data": {
+                        "properties": {
+                          "buffer": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          },
+                          "decompressed_size": {
+                            "type": "integer"
+                          },
+                          "encoding": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "identifier": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "score": {
+                    "type": "double"
+                  },
+                  "threshold": {
+                    "type": "double"
+                  },
+                  "upx_packed": {
+                    "type": "boolean"
+                  },
+                  "version": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "mapped_address": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "mapped_size": {
+                "type": "long"
+              },
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "path": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "pe": {
+                "properties": {
+                  "architecture": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "company": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "description": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "file_version": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "imphash": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "original_file_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "product": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              }
+            }
+          },
+          "process": {
+            "properties": {
+              "args": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "args_count": {
+                "type": "long"
+              },
+              "code_signature": {
+                "properties": {
+                  "exists": {
+                    "type": "boolean"
+                  },
+                  "status": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "subject_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "trusted": {
+                    "type": "boolean"
+                  },
+                  "valid": {
+                    "type": "boolean"
+                  }
+                }
+              },
+              "command_line": {
+                "fields": {
+                  "text": {
+                    "norms": false,
+                    "type": "text"
+                  }
+                },
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "entity_id": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "executable": {
+                "fields": {
+                  "text": {
+                    "norms": false,
+                    "type": "text"
+                  }
+                },
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "exit_code": {
+                "type": "long"
+              },
+              "hash": {
+                "properties": {
+                  "md5": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha1": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha256": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "sha512": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "malware_classification": {
+                "properties": {
+                  "features": {
+                    "properties": {
+                      "data": {
+                        "properties": {
+                          "buffer": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          },
+                          "decompressed_size": {
+                            "type": "integer"
+                          },
+                          "encoding": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "identifier": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "score": {
+                    "type": "double"
+                  },
+                  "threshold": {
+                    "type": "double"
+                  },
+                  "upx_packed": {
+                    "type": "boolean"
+                  },
+                  "version": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "name": {
+                "fields": {
+                  "text": {
+                    "norms": false,
+                    "type": "text"
+                  }
+                },
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "parent": {
+                "properties": {
+                  "args": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "args_count": {
+                    "type": "long"
+                  },
+                  "code_signature": {
+                    "properties": {
+                      "exists": {
+                        "type": "boolean"
+                      },
+                      "status": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "subject_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "trusted": {
+                        "type": "boolean"
+                      },
+                      "valid": {
+                        "type": "boolean"
+                      }
+                    }
+                  },
+                  "command_line": {
+                    "fields": {
+                      "text": {
+                        "norms": false,
+                        "type": "text"
+                      }
+                    },
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "entity_id": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "executable": {
+                    "fields": {
+                      "text": {
+                        "norms": false,
+                        "type": "text"
+                      }
+                    },
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "exit_code": {
+                    "type": "long"
+                  },
+                  "hash": {
+                    "properties": {
+                      "md5": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha1": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha256": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "sha512": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "name": {
+                    "fields": {
+                      "text": {
+                        "norms": false,
+                        "type": "text"
+                      }
+                    },
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "pgid": {
+                    "type": "long"
+                  },
+                  "pid": {
+                    "type": "long"
+                  },
+                  "ppid": {
+                    "type": "long"
+                  },
+                  "start": {
+                    "type": "date"
+                  },
+                  "thread": {
+                    "properties": {
+                      "id": {
+                        "type": "long"
+                      },
+                      "name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "title": {
+                    "fields": {
+                      "text": {
+                        "norms": false,
+                        "type": "text"
+                      }
+                    },
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "uptime": {
+                    "type": "long"
+                  },
+                  "working_directory": {
+                    "fields": {
+                      "text": {
+                        "norms": false,
+                        "type": "text"
+                      }
+                    },
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "pe": {
+                "properties": {
+                  "architecture": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "company": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "description": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "file_version": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "imphash": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "original_file_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "product": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "pgid": {
+                "type": "long"
+              },
+              "pid": {
+                "type": "long"
+              },
+              "ppid": {
+                "type": "long"
+              },
+              "services": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "start": {
+                "type": "date"
+              },
+              "thread": {
+                "properties": {
+                  "call_stack": {
+                    "properties": {
+                      "instruction_pointer": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "memory_section": {
+                        "properties": {
+                          "address": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          },
+                          "protection": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          },
+                          "size": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          }
+                        }
+                      },
+                      "module_path": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "rva": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "symbol_info": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "id": {
+                    "type": "long"
+                  },
+                  "name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "service": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "start": {
+                    "type": "date"
+                  },
+                  "start_address": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "start_address_module": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "token": {
+                    "properties": {
+                      "domain": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "impersonation_level": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "integrity_level": {
+                        "type": "long"
+                      },
+                      "integrity_level_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "is_appcontainer": {
+                        "type": "boolean"
+                      },
+                      "privileges": {
+                        "properties": {
+                          "description": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          },
+                          "enabled": {
+                            "type": "boolean"
+                          },
+                          "name": {
+                            "ignore_above": 1024,
+                            "type": "keyword"
+                          }
+                        },
+                        "type": "nested"
+                      },
+                      "sid": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "type": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "user": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "uptime": {
+                    "type": "long"
+                  }
+                }
+              },
+              "title": {
+                "fields": {
+                  "text": {
+                    "norms": false,
+                    "type": "text"
+                  }
+                },
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "token": {
+                "properties": {
+                  "domain": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "impersonation_level": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "integrity_level": {
+                    "type": "long"
+                  },
+                  "integrity_level_name": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "is_appcontainer": {
+                    "type": "boolean"
+                  },
+                  "privileges": {
+                    "properties": {
+                      "description": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "enabled": {
+                        "type": "boolean"
+                      },
+                      "name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    },
+                    "type": "nested"
+                  },
+                  "sid": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "type": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "user": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
+              },
+              "uptime": {
+                "type": "long"
+              },
+              "user": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "working_directory": {
+                "fields": {
+                  "text": {
+                    "norms": false,
+                    "type": "text"
+                  }
+                },
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
+            }
+          }
+        }
+      },
+      "threat": {
+        "properties": {
+          "framework": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
+          "tactic": {
+            "properties": {
+              "id": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "name": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
+              "reference": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              }
             }
           },
           "technique": {
@@ -2154,6 +3618,112 @@
               "supported_ciphers": {
                 "ignore_above": 1024,
                 "type": "keyword"
+              },
+              "x509": {
+                "properties": {
+                  "alternative_names": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "issuer": {
+                    "properties": {
+                      "common_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "country": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "distinguished_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "locality": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organization": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organizational_unit": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "state_or_province": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "not_after": {
+                    "type": "date"
+                  },
+                  "not_before": {
+                    "type": "date"
+                  },
+                  "public_key_algorithm": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "public_key_curve": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "public_key_exponent": {
+                    "doc_values": false,
+                    "index": false,
+                    "type": "long"
+                  },
+                  "public_key_size": {
+                    "type": "long"
+                  },
+                  "serial_number": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "signature_algorithm": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "subject": {
+                    "properties": {
+                      "common_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "country": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "distinguished_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "locality": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organization": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organizational_unit": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "state_or_province": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "version_number": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
               }
             }
           },
@@ -2214,6 +3784,112 @@
               "subject": {
                 "ignore_above": 1024,
                 "type": "keyword"
+              },
+              "x509": {
+                "properties": {
+                  "alternative_names": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "issuer": {
+                    "properties": {
+                      "common_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "country": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "distinguished_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "locality": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organization": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organizational_unit": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "state_or_province": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "not_after": {
+                    "type": "date"
+                  },
+                  "not_before": {
+                    "type": "date"
+                  },
+                  "public_key_algorithm": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "public_key_curve": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "public_key_exponent": {
+                    "doc_values": false,
+                    "index": false,
+                    "type": "long"
+                  },
+                  "public_key_size": {
+                    "type": "long"
+                  },
+                  "serial_number": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "signature_algorithm": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
+                  "subject": {
+                    "properties": {
+                      "common_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "country": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "distinguished_name": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "locality": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organization": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "organizational_unit": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
+                      "state_or_province": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "version_number": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                }
               }
             }
           },
@@ -2516,4 +4192,4 @@
       "refresh_interval": "5s"
     }
   }
-}
+}
\ No newline at end of file

From b428d0b2fcc4686f21640de0c2ff4fb29d9f079d Mon Sep 17 00:00:00 2001
From: Marshall Main <marshall.main@elastic.co>
Date: Fri, 8 May 2020 16:10:03 -0400
Subject: [PATCH 2/4] use updated endpoint team schemas

---
 .../routes/index/ecs_mapping.json             | 90 ++++++++++++++++++-
 1 file changed, 87 insertions(+), 3 deletions(-)

diff --git a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
index e356e195226fc4..35d0f170742414 100644
--- a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
+++ b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
@@ -1,6 +1,23 @@
 {
+  "index_patterns": [
+    "ecs-*"
+  ],
   "mappings": {
-    "dynamic": false,
+    "_meta": {
+      "version": "1.6.0-dev"
+    },
+    "date_detection": false,
+    "dynamic_templates": [
+      {
+        "strings_as_keyword": {
+          "mapping": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
+          "match_mapping_type": "string"
+        }
+      }
+    ],
     "properties": {
       "@timestamp": {
         "type": "date"
@@ -684,13 +701,28 @@
               }
             }
           },
+          "event": {
+            "properties": {
+              "process": {
+                "properties": {
+                  "ancestry": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  }
+                },
+                "type": "object"
+              }
+            },
+            "type": "object"
+          },
           "policy": {
             "properties": {
               "id": {
                 "ignore_above": 1024,
                 "type": "keyword"
               }
-            }
+            },
+            "type": "object"
           }
         }
       },
@@ -949,7 +981,8 @@
                 "type": "nested"
               },
               "file_extension": {
-                "type": "long"
+                "ignore_above": 1024,
+                "type": "keyword"
               },
               "project_file": {
                 "properties": {
@@ -1116,6 +1149,13 @@
               }
             }
           },
+          "quarantine_path": {
+            "ignore_above": 1024,
+            "type": "keyword"
+          },
+          "quarantine_result": {
+            "type": "boolean"
+          },
           "size": {
             "type": "long"
           },
@@ -1363,6 +1403,10 @@
                 "ignore_above": 1024,
                 "type": "keyword"
               },
+              "variant": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
               "version": {
                 "ignore_above": 1024,
                 "type": "keyword"
@@ -1492,6 +1536,10 @@
               },
               "status_code": {
                 "type": "long"
+              },
+              "version": {
+                "ignore_above": 1024,
+                "type": "keyword"
               }
             }
           },
@@ -1817,6 +1865,10 @@
                 "ignore_above": 1024,
                 "type": "keyword"
               },
+              "variant": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
               "version": {
                 "ignore_above": 1024,
                 "type": "keyword"
@@ -2293,6 +2345,13 @@
                     "ignore_above": 1024,
                     "type": "keyword"
                   },
+                  "elevation": {
+                    "type": "boolean"
+                  },
+                  "elevation_type": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
                   "impersonation_level": {
                     "ignore_above": 1024,
                     "type": "keyword"
@@ -2358,6 +2417,13 @@
                 "ignore_above": 1024,
                 "type": "keyword"
               },
+              "elevation": {
+                "type": "boolean"
+              },
+              "elevation_type": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
               "impersonation_level": {
                 "ignore_above": 1024,
                 "type": "keyword"
@@ -3385,6 +3451,13 @@
                         "ignore_above": 1024,
                         "type": "keyword"
                       },
+                      "elevation": {
+                        "type": "boolean"
+                      },
+                      "elevation_type": {
+                        "ignore_above": 1024,
+                        "type": "keyword"
+                      },
                       "impersonation_level": {
                         "ignore_above": 1024,
                         "type": "keyword"
@@ -3450,6 +3523,13 @@
                     "ignore_above": 1024,
                     "type": "keyword"
                   },
+                  "elevation": {
+                    "type": "boolean"
+                  },
+                  "elevation_type": {
+                    "ignore_above": 1024,
+                    "type": "keyword"
+                  },
                   "impersonation_level": {
                     "ignore_above": 1024,
                     "type": "keyword"
@@ -4100,6 +4180,10 @@
                 "ignore_above": 1024,
                 "type": "keyword"
               },
+              "variant": {
+                "ignore_above": 1024,
+                "type": "keyword"
+              },
               "version": {
                 "ignore_above": 1024,
                 "type": "keyword"

From 85e5dd516c23bed45faf4e3effeeb96bbada25f4 Mon Sep 17 00:00:00 2001
From: Marshall Main <marshall.main@elastic.co>
Date: Mon, 11 May 2020 09:47:34 -0400
Subject: [PATCH 3/4] add newline

---
 .../server/lib/detection_engine/routes/index/ecs_mapping.json   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
index 35d0f170742414..a41fa8abae143a 100644
--- a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
+++ b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
@@ -4276,4 +4276,4 @@
       "refresh_interval": "5s"
     }
   }
-}
\ No newline at end of file
+}

From 88dd77816a39d0dadd0011a21c16a79b1e76fd0d Mon Sep 17 00:00:00 2001
From: Marshall Main <marshall.main@elastic.co>
Date: Mon, 11 May 2020 09:54:05 -0400
Subject: [PATCH 4/4] remove extra options

---
 .../routes/index/ecs_mapping.json             | 19 +------------------
 1 file changed, 1 insertion(+), 18 deletions(-)

diff --git a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
index a41fa8abae143a..6a404e390bd145 100644
--- a/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
+++ b/x-pack/plugins/siem/server/lib/detection_engine/routes/index/ecs_mapping.json
@@ -1,23 +1,6 @@
 {
-  "index_patterns": [
-    "ecs-*"
-  ],
   "mappings": {
-    "_meta": {
-      "version": "1.6.0-dev"
-    },
-    "date_detection": false,
-    "dynamic_templates": [
-      {
-        "strings_as_keyword": {
-          "mapping": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "match_mapping_type": "string"
-        }
-      }
-    ],
+    "dynamic": false,
     "properties": {
       "@timestamp": {
         "type": "date"