[Integration Name]: Elastic Defend reports OS information differently than non-Defend integrations

[chais0n]

Integration Name

Elastic Security [elastic_security]

Dataset Name

endpoint.events.file, endpoint.events.device, endpoint.events.network, endpoint.events.process

Integration Version

9.2.0

Agent Version

9.2.1

Agent Output Type

elasticsearch

Elasticsearch Version

9.2.3

OS Version and Architecture

All (Windows, Ubuntu, RHEL, macOS)

Software/API Version

No response

Error Message

No response

Event Original

No response

What did you do?

Collected logs from various OSes using Defend and other integrations (system, auditd manager, etc).

What did you see?

Logs collected from Defend report different OS values for the following fields:

• host.os.family
• host.os.name
• host.os.platform
• host.os.version

For macOS, the fields are all null.

What did you expect to see?

I expect to see the same host OS values across all integrations.

Anything else?

No response

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[kcreddy]

The package "Elastic Security [elastic_security]" has nothing to do with the endpoint.events.* data or Defend's host OS fields. This likely belongs in the elastic/endpoint-package. Routing.

[ferullo]

@roxana-gheorghe for visibility/priority decision. Making a change is easy, the hard part is how breaking this could be for some users.

[chais0n]

From the customer side it's equal parts a breaking change and a major frustration that they have to use different values for fields. I would like to highlight that the fact that our integrations use completely different values for the same thing itself breaks our philosophy of ECS.

I also don't believe it's as breaking of a change as you might think. Most of my customers already have to put multiple values for host.os since the integrations aren't consistent. In those cases they would still get the data they want when it gets fixed. There will definitely be customers that this impacts and are required to update their searches, though.

From the perspective of all of my customers that have to deal with this issue, that is a welcome break/fix.