Add @timestamp and delivery_timestamp fields to the commands index data model

[QU3B1M]

Description

Add the base ECS field @timestamp, and a custom field delivery_timestamp into the commands index data model at the document top level.

delivery_timestamp

    - name: delivery_timestamp
      type: date
      level: custom
      description: >
        The latest date-time for the command to be delivered. Calculated as the current timestamp plus the timeout.

Update event_generator with the new fields

Functionality validation

Command document generated with the event_generator

{
    "took": 28,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 1,
            "relation": "eq"
        },
        "max_score": 1.0,
        "hits": [
            {
                "_index": ".commands",
                "_id": "0cefe00b-d525-4880-9131-2a4baadb56d3",
                "_score": 1.0,
                "_source": {
                    "@timestamp": "2024-12-21T14:57:31Z",
                    "delivery_timestamp": "2024-12-05T14:57:31Z",
                    "agent": {
                        "groups": [
                            "group1"
                        ]
                    },
                    "command": {
                        "source": "Users/Services",
                        "user": "user73",
                        "target": {
                            "id": "target7",
                            "type": "group"
                        },
                        "action": {
                            "name": "apply_policy",
                            "args": [
                                "/path/to/executable/arg2"
                            ],
                            "version": "v4"
                        },
                        "timeout": 54,
                        "status": "failure",
                        "result": {
                            "code": 143,
                            "message": "Result message 158",
                            "data": "Result data 58"
                        },
                        "request_id": "82a0d79d-c9a5-4c8d-868a-368588472966",
                        "order_id": "621afcab-cc5a-44d4-b7a1-ff2355fb83ad"
                    }
                }
            }
        ]
    }
}

Related Issues

Resolves #565

Check List

• Functionality includes testing.
• API changes companion pull request created, if applicable.
• Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[QU3B1M]

Generated command index template

{
  "index_patterns": [
    ".commands*"
  ],
  "mappings": {
    "date_detection": false,
    "dynamic": "strict",
    "properties": {
      "@timestamp": {
        "type": "date"
      },
      "agent": {
        "properties": {
          "groups": {
            "ignore_above": 1024,
            "type": "keyword"
          }
        }
      },
      "command": {
        "properties": {
          "action": {
            "properties": {
              "args": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "name": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "version": {
                "ignore_above": 1024,
                "type": "keyword"
              }
            }
          },
          "order_id": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "request_id": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "result": {
            "properties": {
              "code": {
                "type": "short"
              },
              "data": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "message": {
                "ignore_above": 1024,
                "type": "keyword"
              }
            }
          },
          "source": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "status": {
            "ignore_above": 1024,
            "type": "keyword"
          },
          "target": {
            "properties": {
              "id": {
                "ignore_above": 1024,
                "type": "keyword"
              },
              "type": {
                "ignore_above": 1024,
                "type": "keyword"
              }
            }
          },
          "timeout": {
            "type": "short"
          },
          "user": {
            "ignore_above": 1024,
            "type": "keyword"
          }
        }
      },
      "delivery_timestamp": {
        "type": "date"
      }
    }
  },
  "order": 1,
  "settings": {
    "index": {
      "hidden": true,
      "number_of_replicas": "0",
      "number_of_shards": "1",
      "query.default_field": [
        "command.source",
        "command.target.type",
        "command.status",
        "command.action.name"
      ],
      "refresh_interval": "5s"
    }
  }
}