Add fields connected to rules and alerts

custom_schemas/custom_base.yml

@@ -52,6 +52,14 @@
       description: >
         The action request information
 
+    - name: data.alert_id
+      type: alias
+      path: EndpointActions.data.alert_id
+      level: custom
+      short: EndpointActions.data.alert_id
+      description: >
+        List of alert ids that triggered the action
+
     - name: data.command
       type: alias
       path: EndpointActions.data.command
@@ -101,6 +109,23 @@
       description: >
         The user id
 
+    - name: rule_id
+      type: alias
+      path: rule.id
+      level: custom
+      short: rule id
+      description: >
+        ID of the rule that triggered the action
+
+    - name: rule_name
+      type: alias
+      path: rule.name
+      level: custom
+      short: rule name
+      description: >
+        Name of the rule that triggered the action
+
+
     # response alias fields
     - name: completed_at
       type: alias

custom_schemas/custom_endpoint_actions.yml

@@ -35,6 +35,13 @@
       short: data
       description: >
         The action request information
+
+    - name: data.alert_id
+      type: keyword
+      level: custom
+      short: alert id
+      description: >
+        List of alert ids that triggered the action
     
     - name: data.command
       type: keyword

custom_subsets/elastic_endpoint/actions/actions.yaml

@@ -23,6 +23,10 @@ fields:
   agent:
     fields:
       id: {}
+  rule:
+    fields:
+      id: {}
+      name: {}
   error:
     fields:
       code: {}

package/endpoint/data_stream/action_responses/fields/fields.yml

@@ -26,6 +26,11 @@
   type: alias
   description: Request completion timestamp when the response is done executing. Usually matches with @timestamp.
   path: EndpointActions.completed_at
+- name: data.alert_id
+  level: custom
+  type: alias
+  description: List of alert ids that triggered the action
+  path: EndpointActions.data.alert_id
 - name: data.command
   level: custom
   type: alias
@@ -69,6 +74,12 @@
       type: object
       description: The action request information
       default_field: false
+    - name: data.alert_id
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: List of alert ids that triggered the action
+      default_field: false
     - name: data.command
       level: custom
       type: keyword

package/endpoint/data_stream/actions/fields/fields.yml

@@ -21,6 +21,11 @@
   type: alias
   description: 'Alias field that maps to {agent: {id}}'
   path: agent.id
+- name: data.alert_id
+  level: custom
+  type: alias
+  description: List of alert ids that triggered the action
+  path: EndpointActions.data.alert_id
 - name: data.command
   level: custom
   type: alias
@@ -69,6 +74,12 @@
       type: object
       description: The action request information
       default_field: false
+    - name: data.alert_id
+      level: custom
+      type: keyword
+      ignore_above: 1024
+      description: List of alert ids that triggered the action
+      default_field: false
     - name: data.command
       level: custom
       type: keyword
@@ -285,6 +296,29 @@
         `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
 
         This field is an array. This will allow proper categorization of some events that fall in multiple event types.'
+- name: rule
+  title: Rule
+  group: 2
+  description: 'Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
+
+    Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.'
+  type: group
+  default_field: true
+  fields:
+    - name: id
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.
+      example: 101
+      default_field: false
+    - name: name
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: The name of the rule or signature generating the event.
+      example: BLOCK_DNS_over_TLS
+      default_field: false
 - name: user
   title: User
   group: 2