Skip to content

[Asset Inventory] Add event.category and event.module to all events#4053

Merged
kubasobon merged 5 commits intoelastic:mainfrom
kubasobon:ecs-event-category
Mar 24, 2026
Merged

[Asset Inventory] Add event.category and event.module to all events#4053
kubasobon merged 5 commits intoelastic:mainfrom
kubasobon:ecs-event-category

Conversation

@kubasobon
Copy link
Member

@kubasobon kubasobon commented Mar 18, 2026

Summary of your changes

  • Adds event.category to all Events published by Asset Inventory. The values are compliant with the ECS.
  • Adds event.module: asset discovery to all Events

Related Issues

Closes #3890

@kubasobon kubasobon requested a review from a team as a code owner March 18, 2026 13:32
@mergify
Copy link

mergify bot commented Mar 18, 2026

This pull request does not have a backport label. Could you fix it @kubasobon? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-v./d./d./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

@kubasobon kubasobon requested a review from JordanSh March 18, 2026 15:18
Copy link
Contributor

@JordanSh JordanSh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👑

@kubasobon
Copy link
Member Author

kubasobon commented Mar 19, 2026

@uri-weisman Added event.module: asset discovery as well, just like we talked.

@kubasobon kubasobon changed the title [Asset Inventory] Add event.category to all events [Asset Inventory] Add event.category and event.module to all events Mar 19, 2026
},
Event: Event{
Kind: "asset",
Module: "asset discovery",
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

99% sure we should use an underscore for ECS field value, so - asset_discovery
In addition, we need to check the dataset naming because it should start with the module name.

"It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. "

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, we don't publish dataset names. I think provider makes sense? As in asset_discovery.aws, asset_discovery.gcp, etc. WDYT?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💯
Just @caitlinbetz validating with you before pushing this.
We plan to add event.module: asset_discovery and event.dataset: asset_discovery.<CLOUD_PROVIDER> to the asset discovery integration.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whatever we decide on, let's move it to a separate PR. No reason to delay merging these changes.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

apologies for the delay. that sounds good - thank you for the heads up.

@kubasobon kubasobon enabled auto-merge (squash) March 24, 2026 10:06
@kubasobon kubasobon merged commit daacebb into elastic:main Mar 24, 2026
10 checks passed
@kubasobon kubasobon deleted the ecs-event-category branch March 24, 2026 10:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Asset Discovery] Add event.category and event.kind to published events

4 participants