Osquery manager: ECS mapping support #1318

aleksmaus · 2021-07-10T01:13:58Z

What does this PR do?

Adds ECS mapping settings support for each query/stream.
Bumps up version to 0.4.0 and minimum kibana version to 7.15.0

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.15.0).

The integration settings update payload with ecs_mapping (using /api/fleet/package_policies kibana API) example:

{
    "version": "WzE3MjUsM10=",
    "name": "osquery_manager-1",
    "description": "",
    "namespace": "default",
    "policy_id": "548a3940-df4e-11eb-8fdd-b98cebb63257",
    "enabled": true,
    "output_id": "",
    "package": {
        "name": "osquery_manager",
        "title": "Osquery Manager",
        "version": "0.4.0"
    },
    "inputs": [
        {
            "policy_template": "osquery_manager",
            "type": "osquery",
            "enabled": true,
            "streams": [
                {
                    "data_stream": {
                        "type": "logs",
                        "dataset": "osquery_manager.result"
                    },
                    "id": "osquery-osquery_manager.result-1b63ffff-c050-4bef-98d9-fc8507fd1406",
                    "vars": {
                        "query": {
                            "type": "text",
                            "value": "select * from users limit 6"
                        },
                        "interval": {
                            "type": "integer",
                            "value": 60
                        },
                        "id": {
                            "type": "text",
                            "value": "users"
                        },
                        "ecs_mapping": {
                            "value": {
                                "uid" : "user.id",
                                "gid" : "user.group.id",
                                "username" : "user.name"
                            }
                        }
                    },
                    "enabled": true
                }
            ]
        }
    ]
}