Enrich index templates with agents' information

[GGP1]

Description

Currently, indices store the agent.id and agent.groups fields along with the event information to build a relationship between an agent and its events.

However, we want to make more information available to correlate events from different indices. For example, the agent's information of an event would look like this:

{
  "agent": {
      "id": "2887e1cf-9bf2-431a-b066-a46860080f56",
      "name": "agent-name",
      "type": "endpoint",
      "version": "5.0.0",
      "groups": ["group1", "group2"],
      "host": {
          "hostname": "myhost",
          "os": {
              "name": "Amazon Linux 2",
              "platform": "Linux"
          },
          "ip": ["192.168.1.2"],
          "architecture": "x86_64"
      }
  }
}

Aside from that, we also want to do some adjustments to the .agents index data model itself, which are:

• Rename agent.is_connected field to agent.status, of type keyword. Expected values are: active. disconnected.

{
  "agent": {
      "id": "2887e1cf-9bf2-431a-b066-a46860080f56",
      "key": "BfDbq0PpcLl9iWatJjY1shGvuQ4KXyOR",
      "name": "agent-name",
      "type": "endpoint",
      "version": "5.0.0",
      "groups": ["group1", "group2"],
      "host": {
          "hostname": "myhost",
          "os": {
              "name": "Amazon Linux 2",
              "platform": "Linux"
          },
          "ip": ["192.168.1.2"],
          "architecture": "x86_64"
      },
      "last_login": "11/11/2024 00:00:00",
      "status": "active"
  }
}

Note

Take in consideration the requirements in #539, as all the Host fields must be included in the mappings.

Functional requirements

• Every stateful and stateless index contain enough information to correlate the event to the agent it belongs to.
• The agents index data model is updated with the changes above.
• Functional requirements from Add states-inventory-ports index template definition to the ECS tooling #536 are met.

Implementation restrictions

• Complete together with Nest ECS Host fields under Agent #539.

Plan

• Rename agent.is_connected field to agent.status, of type keyword. Expected values are: active. disconnected.