Add .caseless subfield to process.name & process.executable (#2341)

Adds a subfield to the process.name and process.executable fields to improve the compatibility of data sources like System, Sysmon, etc., with our Elastic Defend data, which enables us to handle language limitations in KQL more effectively.

Author: w0rk3r

CHANGELOG.next.md

@@ -25,6 +25,8 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+* Added `.caseless` subfield to `process.name` and `process.executable`. #2341
+
 #### Deprecated
 
 ### Tooling and Artifact Changes

docs/fields/field-details.asciidoc

@@ -8128,6 +8128,9 @@ type: keyword
 
 Multi-fields:
 
+* process.executable.caseless (type: keyword)
+
+
 * process.executable.text (type: match_only_text)
 
 
@@ -8343,6 +8346,9 @@ type: keyword
 
 Multi-fields:
 
+* process.name.caseless (type: keyword)
+
+
 * process.name.text (type: match_only_text)
 
 

experimental/generated/beats/fields.ecs.yml

@@ -5175,6 +5175,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: Absolute path to the process executable.
@@ -5213,6 +5217,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: 'Process name.
@@ -5482,6 +5490,11 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
+        default_field: false
       - name: text
         type: match_only_text
         default_field: false
@@ -5560,6 +5573,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: Absolute path to the process executable.
@@ -5598,6 +5615,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: 'Process name.
@@ -6012,6 +6033,11 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
+        default_field: false
       - name: text
         type: match_only_text
         default_field: false
@@ -6401,6 +6427,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: Absolute path to the process executable.
@@ -6644,6 +6674,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: 'Process name.
@@ -7230,6 +7264,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: Absolute path to the process executable.
@@ -7345,6 +7383,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: Absolute path to the process executable.
@@ -7383,6 +7425,10 @@
       type: keyword
       ignore_above: 1024
       multi_fields:
+      - name: caseless
+        type: keyword
+        normalizer: lowercase
+        ignore_above: 1024
       - name: text
         type: match_only_text
       description: 'Process name.

experimental/generated/csv/fields.csv

@@ -648,11 +648,13 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.entry_leader.entry_meta.source.ip,ip,core,,,IP address of the source.
 8.12.0-dev+exp,true,process,process.entry_leader.entry_meta.type,keyword,extended,,,The entry type for the entry session leader.
 8.12.0-dev+exp,true,process,process.entry_leader.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
+8.12.0-dev+exp,true,process,process.entry_leader.executable.caseless,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.entry_leader.executable.text,match_only_text,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.entry_leader.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 8.12.0-dev+exp,true,process,process.entry_leader.group.name,keyword,extended,,,Name of the group.
 8.12.0-dev+exp,true,process,process.entry_leader.interactive,boolean,extended,,True,Whether the process is connected to an interactive shell.
 8.12.0-dev+exp,true,process,process.entry_leader.name,keyword,extended,,ssh,Process name.
+8.12.0-dev+exp,true,process,process.entry_leader.name.caseless,keyword,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.entry_leader.name.text,match_only_text,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.entry_leader.parent.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process.
 8.12.0-dev+exp,true,process,process.entry_leader.parent.pid,long,core,,4242,Process id.
@@ -688,6 +690,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.entry_leader.working_directory.text,match_only_text,extended,,/home/alice,The working directory of the process.
 8.12.0-dev+exp,true,process,process.env_vars,keyword,extended,array,"[""PATH=/usr/local/bin:/usr/bin"", ""USER=ubuntu""]",Array of environment variable bindings.
 8.12.0-dev+exp,true,process,process.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
+8.12.0-dev+exp,true,process,process.executable.caseless,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.executable.text,match_only_text,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.exit_code,long,extended,,137,The exit code of the process.
 8.12.0-dev+exp,true,process,process.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
@@ -698,11 +701,13 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.group_leader.command_line.text,match_only_text,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
 8.12.0-dev+exp,true,process,process.group_leader.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process.
 8.12.0-dev+exp,true,process,process.group_leader.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
+8.12.0-dev+exp,true,process,process.group_leader.executable.caseless,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.group_leader.executable.text,match_only_text,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.group_leader.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 8.12.0-dev+exp,true,process,process.group_leader.group.name,keyword,extended,,,Name of the group.
 8.12.0-dev+exp,true,process,process.group_leader.interactive,boolean,extended,,True,Whether the process is connected to an interactive shell.
 8.12.0-dev+exp,true,process,process.group_leader.name,keyword,extended,,ssh,Process name.
+8.12.0-dev+exp,true,process,process.group_leader.name.caseless,keyword,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.group_leader.name.text,match_only_text,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.group_leader.pid,long,core,,4242,Process id.
 8.12.0-dev+exp,true,process,process.group_leader.real_group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
@@ -762,6 +767,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.macho.sections.virtual_size,long,extended,,,Mach-O Section List virtual size. This is always the same as `physical_size`.
 8.12.0-dev+exp,true,process,process.macho.symhash,keyword,extended,,d3ccf195b62a9279c3c19af1080497ec,A hash of the imports in a Mach-O file.
 8.12.0-dev+exp,true,process,process.name,keyword,extended,,ssh,Process name.
+8.12.0-dev+exp,true,process,process.name.caseless,keyword,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.name.text,match_only_text,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.parent.args,keyword,extended,array,"[""/usr/bin/ssh"", ""-l"", ""user"", ""10.0.0.16""]",Array of process arguments.
 8.12.0-dev+exp,true,process,process.parent.args_count,long,extended,,4,Length of the process.args array.
@@ -817,6 +823,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.parent.end,date,extended,,2016-05-23T08:05:34.853Z,The time the process ended.
 8.12.0-dev+exp,true,process,process.parent.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process.
 8.12.0-dev+exp,true,process,process.parent.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
+8.12.0-dev+exp,true,process,process.parent.executable.caseless,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.parent.executable.text,match_only_text,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.parent.exit_code,long,extended,,137,The exit code of the process.
 8.12.0-dev+exp,true,process,process.parent.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
@@ -850,6 +857,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.parent.macho.sections.virtual_size,long,extended,,,Mach-O Section List virtual size. This is always the same as `physical_size`.
 8.12.0-dev+exp,true,process,process.parent.macho.symhash,keyword,extended,,d3ccf195b62a9279c3c19af1080497ec,A hash of the imports in a Mach-O file.
 8.12.0-dev+exp,true,process,process.parent.name,keyword,extended,,ssh,Process name.
+8.12.0-dev+exp,true,process,process.parent.name.caseless,keyword,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.parent.name.text,match_only_text,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.parent.pe.architecture,keyword,extended,,x64,CPU architecture target for the file.
 8.12.0-dev+exp,true,process,process.parent.pe.company,keyword,extended,,Microsoft Corporation,"Internal company name of the file, provided at compile-time."
@@ -933,6 +941,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.previous.args,keyword,extended,array,"[""/usr/bin/ssh"", ""-l"", ""user"", ""10.0.0.16""]",Array of process arguments.
 8.12.0-dev+exp,true,process,process.previous.args_count,long,extended,,4,Length of the process.args array.
 8.12.0-dev+exp,true,process,process.previous.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
+8.12.0-dev+exp,true,process,process.previous.executable.caseless,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.previous.executable.text,match_only_text,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.real_group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 8.12.0-dev+exp,true,process,process.real_group.name,keyword,extended,,,Name of the group.
@@ -950,11 +959,13 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.12.0-dev+exp,true,process,process.session_leader.command_line.text,match_only_text,extended,,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
 8.12.0-dev+exp,true,process,process.session_leader.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process.
 8.12.0-dev+exp,true,process,process.session_leader.executable,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
+8.12.0-dev+exp,true,process,process.session_leader.executable.caseless,keyword,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.session_leader.executable.text,match_only_text,extended,,/usr/bin/ssh,Absolute path to the process executable.
 8.12.0-dev+exp,true,process,process.session_leader.group.id,keyword,extended,,,Unique identifier for the group on the system/platform.
 8.12.0-dev+exp,true,process,process.session_leader.group.name,keyword,extended,,,Name of the group.
 8.12.0-dev+exp,true,process,process.session_leader.interactive,boolean,extended,,True,Whether the process is connected to an interactive shell.
 8.12.0-dev+exp,true,process,process.session_leader.name,keyword,extended,,ssh,Process name.
+8.12.0-dev+exp,true,process,process.session_leader.name.caseless,keyword,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.session_leader.name.text,match_only_text,extended,,ssh,Process name.
 8.12.0-dev+exp,true,process,process.session_leader.parent.entity_id,keyword,extended,,c2c455d9f99375d,Unique identifier for the process.
 8.12.0-dev+exp,true,process,process.session_leader.parent.pid,long,core,,4242,Process id.

experimental/generated/ecs/ecs_flat.yml

@@ -8426,6 +8426,11 @@ process.entry_leader.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.entry_leader.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.entry_leader.executable.text
     name: text
     type: match_only_text
@@ -8487,6 +8492,11 @@ process.entry_leader.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.entry_leader.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.entry_leader.name.text
     name: text
     type: match_only_text
@@ -8910,6 +8920,11 @@ process.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.executable.text
     name: text
     type: match_only_text
@@ -9029,6 +9044,11 @@ process.group_leader.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.group_leader.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.group_leader.executable.text
     name: text
     type: match_only_text
@@ -9090,6 +9110,11 @@ process.group_leader.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.group_leader.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.group_leader.name.text
     name: text
     type: match_only_text
@@ -9779,6 +9804,11 @@ process.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.name.text
     name: text
     type: match_only_text
@@ -10440,6 +10470,11 @@ process.parent.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.parent.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.parent.executable.text
     name: text
     type: match_only_text
@@ -10849,6 +10884,11 @@ process.parent.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.parent.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.parent.name.text
     name: text
     type: match_only_text
@@ -11833,6 +11873,11 @@ process.previous.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.previous.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.previous.executable.text
     name: text
     type: match_only_text
@@ -12018,6 +12063,11 @@ process.session_leader.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.session_leader.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.session_leader.executable.text
     name: text
     type: match_only_text
@@ -12079,6 +12129,11 @@ process.session_leader.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.session_leader.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.session_leader.name.text
     name: text
     type: match_only_text