Network Inventory Fields Do Not Fully Adhere to ECS

[vikman90]

Parent Issue: #241

Description

The network inventory messages in the Wazuh Agent include fields that are not compliant with the Elastic Common Schema (ECS). Specifically, there is an interface field in the inventory data that is not aligned with the ECS proposal (#294):

Example of the current network inventory message:

{
  "@timestamp": "2024/11/29 12:44:16",
  "host": {
    "ip": ["172.28.54.98"],
    "mac": "00:15:5d:b2:93:68",
    "network": {
      "egress": {
        "bytes": 3863215,
        "drops": 0,
        "errors": 0,
        "packets": 18423
      },
      "ingress": {
        "bytes": 10916732,
        "drops": 0,
        "errors": 0,
        "packets": 24630
      }
    }
  },
  "interface": {
    "mtu": 1500,
    "state": "up",
    "type": "ethernet"
  },
  "network": {
    "broadcast": ["172.28.63.255"],
    "dhcp": "unknown",
    "gateway": ["172.28.48.1"],
    "metric": "0",
    "netmask": ["255.255.240.0"],
    "protocol": "",
    "type": "ipv4"
  },
  "observer": {
    "ingress": {
      "interface": {
        "alias": "",
        "name": "eth0"
      }
    }
  }
}

• The interface field contains information such as mtu, state, and type, which may either need to be mapped to existing ECS fields or moved to a different structure.
• This raises the question of whether the ECS indexer lacks fields for such data, or whether these fields are being incorrectly placed in the Agent's message structure.

Expected Behavior

• Ensure that all fields in network inventory messages are compliant with ECS.
• If ECS does not currently support certain fields (e.g., interface.mtu, interface.state), propose updates to the ECS schema or provide an alternate mapping.

[cborla]

According to the indexer documentation we followed to complete the issue #294, the interface object is part of the network table.

[davidjiglesias]

The fix on indexer side should be enough.