You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Most security tooling that captures installed software/packages at minimum includes Software/Package Name, Software/Package Vendor, and Package/Software Version. While having package.name and package.version is really helpful that we can map too, it would be beneficial to include a field called package.vendor too since it's a very common data point.
The text was updated successfully, but these errors were encountered:
Exactly, I can see a use case, where there were multiple products from the same vendor and the user might want aggregated data across the vendor. In this case, having such ECS mapping would surely be beneficial.
Summary
Add an ECS field for package.vendor for the ECS package fields
https://www.elastic.co/guide/en/ecs/current/ecs-package.html
Motivation:
Most security tooling that captures installed software/packages at minimum includes Software/Package Name, Software/Package Vendor, and Package/Software Version. While having package.name and package.version is really helpful that we can map too, it would be beneficial to include a field called package.vendor too since it's a very common data point.
The text was updated successfully, but these errors were encountered: