artifacts manifest update age, snapshot date (#440)

custom_schemas/custom_endpoint.yml

@@ -336,6 +336,16 @@
       type: object
       description: information about global protection artifacts applied.
 
+    - name: policy.applied.artifacts.global.update_age
+      level: custom
+      type: unsigned_long
+      description: number of days since global artifacts were made up-to-date
+
+    - name: policy.applied.artifacts.global.snapshot
+      level: custom
+      type: keyword
+      description: the snapshot date of applied global artifacts or 'latest'
+
     - name: policy.applied.artifacts.global.version
       level: custom
       type: keyword

package/endpoint/data_stream/alerts/fields/fields.yml

@@ -70,6 +70,17 @@
       ignore_above: 1024
       description: the sha256 of global artifacts applied.
       default_field: false
+    - name: policy.applied.artifacts.global.snapshot
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: the snapshot date of applied global artifacts or 'latest'
+      default_field: false
+    - name: policy.applied.artifacts.global.update_age
+      level: custom
+      type: unsigned_long
+      description: number of days since global artifacts were made up-to-date
+      default_field: false
     - name: policy.applied.artifacts.global.version
       level: custom
       type: keyword

package/endpoint/data_stream/alerts/sample_event.json

@@ -449,6 +449,8 @@
                                 "name": "production-rules-windows-v1"
                             }
                         ],
+                        "update_age": 0,
+                        "snapshot": "2023-09-26",
                         "version": "1.0.260"
                     },
                     "user": {

package/endpoint/data_stream/policy/fields/fields.yml

@@ -100,6 +100,17 @@
       ignore_above: 1024
       description: the sha256 of global artifacts applied.
       default_field: false
+    - name: policy.applied.artifacts.global.snapshot
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: the snapshot date of applied global artifacts or 'latest'
+      default_field: false
+    - name: policy.applied.artifacts.global.update_age
+      level: custom
+      type: unsigned_long
+      description: number of days since global artifacts were made up-to-date
+      default_field: false
     - name: policy.applied.artifacts.global.version
       level: custom
       type: keyword

package/endpoint/data_stream/policy/sample_event.json

@@ -525,6 +525,8 @@
                                 "name": "production-rules-windows-v1"
                             }
                         ],
+                        "update_age": 0,
+                        "snapshot": "2023-09-26",
                         "version": "1.0.261"
                     },
                     "user": {