{
  "index_patterns": [
    "securesight-*"
  ],
  "priority": 500,
  "_meta": {
    "artifact": "securesight-ecs",
    "version": "1.0.0",
    "published_by": "Secutec",
    "docs": "https://docs.api.secutec.com/guides/elastic.html",
    "clocks_note": "Two clocks, and they are not interchangeable. @timestamp is ss.updated_at -- when the resource changed -- and is what Discover and the dashboards read. event.ingested is ss.stream_position -- where the row sat in the delta stream -- and is what every detection rule windows on via timestamp_override. A rule windowed on @timestamp matches nothing on a first backfill: every row is historical by that clock however recently it arrived.",
    "description": "SecureSight assets and threats, mapped to ECS. Regular indices rather than data streams: the id of each document is the resource id, so the delta stream's at-least-once redelivery upserts. A data stream is append-only and would accumulate one copy per poll.",
    "runtime_note": "threat.age_days lives here, not in the Kibana data view: detection rules query the index directly and never see a data-view runtime field. Defined on the mapping it serves Discover, Lens and rules from one definition.",
    "flattened_note": "ss.identifying_properties and ss.module_data are free-form, module-specific bags and are mapped flattened on purpose. Left to dynamic mapping the first document wins the type for the whole index: one asset with a numeric identifying_properties.version mapped it as long, and every later asset carrying 'v4' was rejected 400 and dropped. Filebeat logs that as 'Cannot index event (status=400): dropping event!' with the reason only in the event log, so 556 of 5083 assets went missing without anything obviously failing. Flattened also makes module_data aggregatable, which dynamic text mapping does not. ss.external_references is flattened for a different reason: it is an ARRAY of objects, and a plain object mapping flattens arrays in Elasticsearch and loses which system each id belongs to. Flattened keeps ss.external_references.system queryable, which is the question a SOC asks of it (\"is this finding already linked to a ticket?\")."
  },
  "template": {
    "settings": {
      "number_of_shards": 1,
      "number_of_replicas": 0,
      "refresh_interval": "5s"
    },
    "mappings": {
      "dynamic": true,
      "runtime": {
        "threat.age_days": {
          "type": "long",
          "script": {
            "source": "if (doc[\"ss.first_seen_at\"].size() == 0) { return; } emit((System.currentTimeMillis() - doc[\"ss.first_seen_at\"].value.toInstant().toEpochMilli()) / 86400000L);"
          }
        }
      },
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "message": {
          "type": "text"
        },
        "event": {
          "properties": {
            "kind": {
              "type": "keyword"
            },
            "dataset": {
              "type": "keyword"
            },
            "module": {
              "type": "keyword"
            },
            "action": {
              "type": "keyword"
            },
            "id": {
              "type": "keyword"
            },
            "provider": {
              "type": "keyword"
            },
            "category": {
              "type": "keyword"
            },
            "severity": {
              "type": "long"
            },
            "created": {
              "type": "date"
            },
            "ingested": {
              "type": "date"
            }
          }
        },
        "vulnerability": {
          "properties": {
            "severity": {
              "type": "keyword"
            },
            "description": {
              "type": "text"
            },
            "scanner": {
              "properties": {
                "vendor": {
                  "type": "keyword"
                }
              }
            },
            "score": {
              "properties": {
                "base": {
                  "type": "float"
                },
                "version": {
                  "type": "keyword"
                }
              }
            }
          }
        },
        "host": {
          "properties": {
            "name": {
              "type": "keyword"
            },
            "ip": {
              "type": "ip"
            }
          }
        },
        "user": {
          "properties": {
            "name": {
              "type": "keyword"
            },
            "email": {
              "type": "keyword"
            }
          }
        },
        "url": {
          "properties": {
            "domain": {
              "type": "keyword"
            }
          }
        },
        "package": {
          "properties": {
            "name": {
              "type": "keyword"
            }
          }
        },
        "destination": {
          "properties": {
            "port": {
              "type": "long"
            }
          }
        },
        "related": {
          "properties": {
            "hosts": {
              "type": "keyword"
            },
            "ip": {
              "type": "ip"
            },
            "user": {
              "type": "keyword"
            }
          }
        },
        "rule": {
          "properties": {
            "name": {
              "type": "keyword"
            },
            "description": {
              "type": "text"
            }
          }
        },
        "observer": {
          "properties": {
            "vendor": {
              "type": "keyword"
            },
            "product": {
              "type": "keyword"
            }
          }
        },
        "securesight": {
          "properties": {
            "id": {
              "type": "keyword"
            },
            "name": {
              "type": "keyword"
            },
            "type": {
              "type": "keyword"
            },
            "status": {
              "type": "keyword"
            },
            "severity": {
              "type": "keyword"
            },
            "module": {
              "type": "keyword"
            },
            "deleted": {
              "type": "boolean"
            },
            "deleted_at": {
              "type": "date"
            },
            "first_seen_at": {
              "type": "date"
            },
            "updated_at": {
              "type": "date"
            },
            "asset": {
              "properties": {
                "id": {
                  "type": "keyword"
                },
                "type": {
                  "type": "keyword"
                }
              }
            }
          }
        },
        "ss": {
          "properties": {
            "id": {
              "type": "keyword"
            },
            "name": {
              "type": "keyword"
            },
            "version": {
              "type": "keyword"
            },
            "type": {
              "type": "keyword"
            },
            "status": {
              "type": "keyword"
            },
            "severity": {
              "type": "keyword"
            },
            "module": {
              "type": "keyword"
            },
            "deleted": {
              "type": "boolean"
            },
            "deleted_at": {
              "type": "date"
            },
            "first_seen_at": {
              "type": "date"
            },
            "updated_at": {
              "type": "date"
            },
            "stream_position": {
              "type": "date"
            },
            "cvss_score": {
              "type": "float"
            },
            "cvss_vector": {
              "type": "keyword"
            },
            "risk_priority_score": {
              "type": "float"
            },
            "public_facing": {
              "type": "boolean"
            },
            "business_value": {
              "type": "long"
            },
            "modules": {
              "type": "keyword"
            },
            "description": {
              "type": "text"
            },
            "note": {
              "type": "text"
            },
            "asset": {
              "properties": {
                "id": {
                  "type": "keyword"
                },
                "name": {
                  "type": "keyword"
                },
                "type": {
                  "type": "keyword"
                }
              }
            },
            "identifying_properties": {
              "type": "flattened"
            },
            "module_data": {
              "type": "flattened"
            },
            "external_references": {
              "type": "flattened"
            }
          }
        }
      }
    }
  }
}