Proposed ECS Fields for Mapping

Oct 13, 2025 by wbrum.org 120 views

Description

As part of the ongoing improvements to the rule stage of Wazuh-Engine, it is proposed to integrate specific fields from the Elastic Common Schema (ECS) that are particularly relevant to rule logic and threat detection. This integration aims to enhance the contextual information available in rule processing, improving both the detection capabilities and the richness of event data.

The Elastic Common Schema (ECS) is a widely adopted standard for structuring event data, providing a common framework for security information and event management (SIEM) systems, threat intelligence platforms, and other security tools. By integrating ECS fields into the rule stage of Wazuh-Engine, we can leverage this standard to enhance the detection and analysis capabilities of the engine.

Proposed ECS Fields for Mapping

The following ECS fields are proposed for inclusion in the rule stage mapping process:

1. Rule Fields (`/rules`):

Incorporate fields defined under the ECS Rule schema, which include rule identification, rule category, and rule version, among others. These fields will provide a structured way to represent and manage rules within Wazuh-Engine, improving the overall rule management and processing capabilities.

Rule ID: A unique identifier for each rule, allowing for easy identification and management of rules.
Rule Category: A categorization of the rule, enabling grouping and filtering of rules based on their purpose or functionality.
Rule Version: The version number of the rule, facilitating tracking of changes and updates to the rule.

Reference: Elastic ECS Rule

2. Threat Fields (`/threat`):

Include fields related to threat frameworks, tactics, and techniques as outlined in the ECS Threat schema. This would facilitate a more structured threat analysis and categorization within events, enabling better detection and response to threats.

Threat Framework: A field to represent the threat framework or model used to categorize the threat.
Tactics: A field to represent the tactics employed by the threat actor.
Techniques: A field to represent the techniques used by the threat actor.

Reference: Elastic ECS Threat

3. Risk Fields (`/event`, `/host`, `/user`):

Map risk scores and related attributes that are part of the ECS Risk schema to enhance the visibility into potential risks associated with specific events, hosts, or users.

Risk Score: A numerical value representing the risk level associated with the event, host, or user.
Risk Category: A categorization of the risk, enabling grouping and filtering of risks based on their severity or type.

Reference: Elastic ECS Risk

4. Wazuh Rules (`wazuh.rules`):

Similar to wazuh.decoder, introduce an array field to track which rules an event has passed through within the Wazuh-Engine. This would aid in traceability and detailed event analysis.

Rule History: An array field to store the history of rules that an event has passed through.

Rationale

Mapping these ECS fields in the rule stage will provide a robust framework for enhancing the detection and analysis capabilities of Wazuh-Engine. By aligning with ECS standards, Wazuh-Engine can leverage a common schema that is widely recognized and supported, facilitating better integration and data exchange with other security tools and platforms.

The proposed integration of ECS fields will enable Wazuh-Engine to:

Enhance detection capabilities by providing a structured way to represent and manage rules.
Improve threat analysis and categorization by leveraging the ECS Threat schema.
Provide better visibility into potential risks associated with specific events, hosts, or users.
Facilitate better integration and data exchange with other security tools and platforms.

Impact

The adoption of these ECS fields will necessitate changes to the rule processing logic and possibly the data structure in Wazuh-Engine. It will also require coordination with the Wazuh-Indexer team to ensure proper indexing and querying capabilities for these fields.

The proposed changes will have a significant impact on the rule stage of Wazuh-Engine, enabling better detection and analysis capabilities, and improving the overall security posture of the engine. However, it will also require careful planning and coordination to ensure a smooth transition and minimal disruption to existing workflows.

Conclusion

The proposed integration of ECS fields in the rule stage of Wazuh-Engine will provide a robust framework for enhancing the detection and analysis capabilities of the engine. By aligning with ECS standards, Wazuh-Engine can leverage a common schema that is widely recognized and supported, facilitating better integration and data exchange with other security tools and platforms.

Q: What is the Elastic Common Schema (ECS) and why is it important for Wazuh-Engine?

A: The Elastic Common Schema (ECS) is a widely adopted standard for structuring event data, providing a common framework for security information and event management (SIEM) systems, threat intelligence platforms, and other security tools. By integrating ECS fields into the rule stage of Wazuh-Engine, we can leverage this standard to enhance the detection and analysis capabilities of the engine.

Q: What are the proposed ECS fields for mapping in the rule stage?

A: The proposed ECS fields for mapping in the rule stage include:

Rule fields (/rules): Incorporate fields defined under the ECS Rule schema, which include rule identification, rule category, and rule version, among others.
Threat fields (/threat): Include fields related to threat frameworks, tactics, and techniques as outlined in the ECS Threat schema.
Risk fields (/event, /host, /user): Map risk scores and related attributes that are part of the ECS Risk schema.
Wazuh rules (wazuh.rules): Introduce an array field to track which rules an event has passed through within the Wazuh-Engine.

Q: What are the benefits of integrating ECS fields in the rule stage?

A: The integration of ECS fields in the rule stage will provide a robust framework for enhancing the detection and analysis capabilities of Wazuh-Engine. By aligning with ECS standards, Wazuh-Engine can leverage a common schema that is widely recognized and supported, facilitating better integration and data exchange with other security tools and platforms.

Q: What changes will be required to implement the proposed ECS fields?

A: The adoption of these ECS fields will necessitate changes to the rule processing logic and possibly the data structure in Wazuh-Engine. It will also require coordination with the Wazuh-Indexer team to ensure proper indexing and querying capabilities for these fields.

Q: How will the proposed changes impact the rule stage of Wazuh-Engine?

A: The proposed changes will have a significant impact on the rule stage of Wazuh-Engine, enabling better detection and analysis capabilities, and improving the overall security posture of the engine. However, it will also require careful planning and coordination to ensure a smooth transition and minimal disruption to existing workflows.

Q: What is the timeline for implementing the proposed ECS fields?

A: The timeline for implementing the proposed ECS fields will depend on various factors, including the complexity of the changes, the availability of resources, and the priority of the project. However, we anticipate that the implementation will take several months to complete.

Q: How will the proposed changes be tested and validated?

A: The proposed changes will be thoroughly tested and validated through a combination of unit testing, integration testing, and user acceptance testing (UAT). We will also conduct regular reviews and retrospectives to ensure that the changes meet the required standards and are aligned with the overall goals of the project.

Q: What support will be provided to users during the implementation and testing phases?

A: We will provide comprehensive support to users during the implementation and testing phases, including documentation, training, and technical support. We will also establish a feedback mechanism to ensure that users can provide input and suggestions on the proposed changes.

Q: What are the next steps for implementing the proposed ECS fields?

A: The next steps for implementing the proposed ECS fields include:

Finalizing the design and architecture of the changes
Developing and testing the code changes
Conducting user acceptance testing (UAT)
Deploying the changes to production
Providing ongoing support and maintenance to users

We will continue to provide updates and progress reports on the implementation of the proposed ECS fields. If you have any further questions or concerns, please do not hesitate to reach out to us.