Repository navigation
[Integration Name]: Elastic Defend reports OS information differently than non-Defend integrations #772
Description
Integration Name
Elastic Security [elastic_security]
Dataset Name
endpoint.events.file, endpoint.events.device, endpoint.events.network, endpoint.events.process
Integration Version
9.2.0
Agent Version
9.2.1
Agent Output Type
elasticsearch
Elasticsearch Version
9.2.3
OS Version and Architecture
All (Windows, Ubuntu, RHEL, macOS)
Software/API Version
No response
Error Message
No response
Event Original
No response
What did you do?
Collected logs from various OSes using Defend and other integrations (system, auditd manager, etc).
What did you see?
Logs collected from Defend report different OS values for the following fields:
- host.os.family
- host.os.name
- host.os.platform
- host.os.version
For macOS, the fields are all null.
What did you expect to see?
I expect to see the same host OS values across all integrations.
Anything else?
No response
Activity
elasticmachine commentedon Jan 26, 2026
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
kcreddy commentedon Jul 22, 2026
The package "Elastic Security [elastic_security]" has nothing to do with the
endpoint.events.*data or Defend's host OS fields. This likely belongs in the elastic/endpoint-package. Routing.ferullo commentedon Jul 23, 2026
@roxana-gheorghe for visibility/priority decision. Making a change is easy, the hard part is how breaking this could be for some users.
chais0n commentedon Jul 23, 2026
From the customer side it's equal parts a breaking change and a major frustration that they have to use different values for fields. I would like to highlight that the fact that our integrations use completely different values for the same thing itself breaks our philosophy of ECS.
I also don't believe it's as breaking of a change as you might think. Most of my customers already have to put multiple values for host.os since the integrations aren't consistent. In those cases they would still get the data they want when it gets fixed. There will definitely be customers that this impacts and are required to update their searches, though.
From the perspective of all of my customers that have to deal with this issue, that is a welcome break/fix.