Merge branch 'main' into main

Author: trisch-me

packages/osquery_manager/_dev/build/build.yml

@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@v8.10.0
+    reference: git@v9.1.0

packages/osquery_manager/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.19.0"
+  changes:
+    - description: Update osquery to version 5.18.1 and ECS to 9.10.0
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15321
 - version: "1.18.0"
   changes:
     - description: Adjust result mapping to match action responses

packages/osquery_manager/data_stream/result/fields/ecs.yml

@@ -1,6 +1,6 @@
 # This file is generated with osqgen (https://github.com/aleksmaus/osqgen) tool from the official ECS fields yml
 # To regenerate use:
-# osqgen --schema "./schema/ecs/fields.ecs_8.10.0.yml" ecs > ecs.yml
+# osqgen --schema "./schema/ecs/fields.ecs_9.1.0.yml" ecs > ecs.yml
 - external: ecs
   name: client.as.number
 - external: ecs
@@ -497,8 +497,6 @@
   name: process.parent.pe.sections.var_entropy
 - external: ecs
   name: process.parent.pe.sections.virtual_size
-- external: ecs
-  name: process.parent.pgid
 - external: ecs
   name: process.parent.pid
 - external: ecs
@@ -531,8 +529,6 @@
   name: process.pe.sections.var_entropy
 - external: ecs
   name: process.pe.sections.virtual_size
-- external: ecs
-  name: process.pgid
 - external: ecs
   name: process.pid
 - external: ecs
@@ -853,6 +849,12 @@
   name: user.risk.static_score
 - external: ecs
   name: user.risk.static_score_norm
+- external: ecs
+  name: volume.removable
+- external: ecs
+  name: volume.size
+- external: ecs
+  name: volume.writable
 - external: ecs
   name: vulnerability.score.base
 - external: ecs