Missing host.os.type field mapping #232

Activity

1. ebeahan commented on Feb 22, 2022

   

   ebeahan

   on Feb 22, 2022

   MemberAuthor

   More actions

   CC @randomuserid, who initially spotted the missing mapping.
2. pzl commented on Apr 5, 2022

   

   pzl

   on Apr 5, 2022

   Member

   More actions

   I'm not sure the Endpoint sends any data with host.os.type. Here is an example of what Endpoint sends to those indices:

     "host" : {
       "hostname" : "security-win-1",
       "os" : {
         "Ext" : {
           "variant" : "Windows Server 2019 Datacenter"
         },
         "kernel" : "1809 (10.0.17763.2686)",
         "name" : "Windows",
         "family" : "windows",
         "type" : "windows",
         "version" : "1809 (10.0.17763.2686)",
         "platform" : "windows",
         "full" : "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
       },
       "ip" : [
         "10.201.0.34",
         "fe80::4850:4f4f:4b53:8103",
         "127.0.0.1",
         "::1"
       ],
       "name" : "security-win-1",
       "id" : "bbea673e-eae6-4b03-8724-2183f79da331",
       "mac" : [
         "42:01:0a:c9:00:22"
       ],
       "architecture" : "x86_64"
     },
3. ferullo commented on Apr 5, 2022

   

   ferullo

   on Apr 5, 2022

   Contributor

   More actions

   host.os.type is in that example document.