Amazon ECS
| Version | 7.1.4 (View all) |
| Managed integration release status |
|
| Subscription level What's this? |
Basic |
| Ingestion method(s) | API, AWS CloudWatch, AWS S3 |
| Minimum Kibana version(s) | 9.4.0 |
Important - Managed integrations on Elastic Cloud Hosted
You can use this integration as an Elastic Managed integration on Elastic Cloud Hosted deployments running this version or later.
The Amazon ECS integration allows you to monitor Amazon Elastic Container Service (Amazon ECS)—a managed container orchestration service.
Use the Amazon ECS integration to collect metrics related to your ECS instances. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference the metrics when troubleshooting an issue.
For example, you could use this data to track Amazon ECS CPU and memory utilization. Then you can alert when utilization for an instance crosses a predefined threshold.
Important
Extra AWS charges on API requests will be generated by this integration. Check API Requests for more details.
The Amazon ECS integration collects one type of data: metrics.
Metrics give you insight into the state of Amazon ECS. The metrics collected by the Amazon ECS integration include CPU utilization, CPU reservation, memory reservation, memory utilization, and more. See more details in the Metrics reference
You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
Before using any AWS integration you will need:
- AWS Credentials to connect with your AWS account.
- AWS Permissions to make sure the user you're using to connect has permission to share the relevant data.
For more details about these requirements, refer to the AWS integration documentation.
Use this integration if you only need to collect data from the Amazon ECS service.
If you want to collect data from two or more AWS services, consider using the AWS integration. When you configure the AWS integration, you can collect data from as many AWS services as you'd like.
For step-by-step instructions on how to set up an integration, see the Getting started guide.
Example
{
"@timestamp": "2022-07-26T08:59:00.000Z",
"agent": {
"ephemeral_id": "0c23896b-0bfe-469f-bf76-7203a2d52568",
"id": "8c424f1d-e9b1-4aab-8ce5-77dceb4becfb",
"name": "4b4f1fd6f3ff",
"type": "metricbeat",
"version": "8.1.0"
},
"aws": {
"cloudwatch": {
"namespace": "AWS/ECS"
},
"dimensions": {
"ClusterName": "integration-cluster-1",
"ServiceName": "integration-service-1"
},
"ecs": {
"metrics": {
"CPUUtilization": {
"avg": 100.040084913373
},
"MemoryUtilization": {
"avg": 9.195963541666666
}
}
}
},
"cloud": {
"account": {
"id": "627286350134",
"name": "elastic-observability"
},
"provider": "aws",
"region": "eu-west-1"
},
"data_stream": {
"dataset": "aws.ecs_metrics",
"namespace": "default",
"type": "metrics"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "8c424f1d-e9b1-4aab-8ce5-77dceb4becfb",
"snapshot": false,
"version": "8.1.0"
},
"event": {
"agent_id_status": "verified",
"dataset": "aws.ecs_metrics",
"duration": 1862196584,
"ingested": "2022-07-26T09:04:12Z",
"module": "aws"
},
"host": {
"architecture": "aarch64",
"containerized": false,
"hostname": "4b4f1fd6f3ff",
"ip": [
"172.19.0.4"
],
"mac": [
"02-42-AC-13-00-04"
],
"name": "4b4f1fd6f3ff",
"os": {
"codename": "focal",
"family": "debian",
"kernel": "5.10.104-linuxkit",
"name": "Ubuntu",
"platform": "ubuntu",
"type": "linux",
"version": "20.04.3 LTS (Focal Fossa)"
}
},
"metricset": {
"name": "cloudwatch",
"period": 300000
},
"service": {
"type": "aws"
}
}
ECS Field Reference
Refer to the following document for detailed information on ECS fields.
Exported fields
| Field | Description | Type | Metric Type |
|---|---|---|---|
| @timestamp | Event timestamp. | date | |
| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | |
| aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword | |
| aws.dimensions.ClusterName | This dimension filters the data that you request for all resources in a specified cluster. All Amazon ECS metrics are filtered by ClusterName. | keyword | |
| aws.dimensions.ServiceName | This dimension filters the data that you request for all resources in a specified service within a specified cluster. | keyword | |
| aws.ecs.metrics.CPUReservation.avg | The percentage of CPU units that are reserved by running tasks in the cluster. | double | gauge |
| aws.ecs.metrics.CPUUtilization.avg | The percentage of CPU units that are used in the cluster or service. | double | gauge |
| aws.ecs.metrics.GPUReservation.avg | The percentage of total available GPUs that are reserved by running tasks in the cluster. | double | gauge |
| aws.ecs.metrics.MemoryReservation.avg | The percentage of memory that is reserved by running tasks in the cluster. | double | gauge |
| aws.ecs.metrics.MemoryUtilization.avg | The percentage of memory that is used in the cluster or service. | double | gauge |
| aws.tags | Tag key value pairs from aws resources. | flattened | |
| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | |
| cloud.image.id | Image ID for the cloud instance. | keyword | |
| cloud.region | Region in which this host, resource, or service is located. | keyword | |
| data_stream.dataset | Data stream dataset. | constant_keyword | |
| data_stream.namespace | Data stream namespace. | constant_keyword | |
| data_stream.type | Data stream type. | constant_keyword | |
| event.module | Event module | constant_keyword | |
| host.containerized | If the host is a container. | boolean | |
| host.os.build | OS build information. | keyword | |
| host.os.codename | OS codename, if any. | keyword |
This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.
Changelog
| Version | Details | Minimum Kibana version |
|---|---|---|
| 7.1.4 | Bug fix (View pull request) Wrap the www.amazon.com:app_id and www.amazon.com:user_id examples in the user_identity.session_context.web_id_federation_data.attributes field description in backticks so they render as inline code instead of being autolinked into invalid URLs when docs are generated. |
9.4.0 |
| 7.1.3 | Enhancement (View pull request) The changes below apply to the CloudTrail data stream only. Replace every ignore_failure: true with an ignore_missing flag, a condition guard, or an explicit on_failure handler reporting to error.message, so real faults surface instead of being silently swallowed.Add support for CloudTrail fields that were previously dropped. Populate the cloud.provider, cloud.service.name and related.* ECS fields.Bug fix (View pull request) The fixes below apply to the CloudTrail data stream only. Stop populating file.hash.sha256 on digest records, where it held the hash of the previous digest file while file.path pointed at the current one. The value is still available as aws.cloudtrail.digest.previous_hash_value and in related.hash.Fix DeleteObject using event.type: delete, which is not a valid ECS value. It is now deletion.Fix Publish, SendCommand and Converse producing no event.type. They now use info, start and info respectively.Fix retain: none behaving like retain: all. It now drops both the keyword and the flattened copies as documented.Fix retain: keyword and retain: minimal discarding digest and Insights records. The setting governs API call payloads and no longer affects either record type.Fix aws.cloudtrail.service_event_details surviving retain: flattened and retain: none. It is now governed like the other payload fields. |
9.4.0 |
| 7.1.2 | Bug fix (View pull request) Add an Instance or Pod IAM Role option to the Setup Access selector so Elastic Agent can authenticate with the AWS SDK default credential chain (EC2 instance profile, EKS Pod Identity or IRSA) without entering access keys or a Role ARN. Since 7.0.0 every option required at least one credential field, which made this documented path impossible to save. |
9.4.0 |
| 7.1.1 | Bug fix (View pull request) Add data_stream.namespace to the Amazon Inspector vulnerability latest transform's unique key so findings are tracked per namespace, preventing findings ingested into non-default namespaces from being dropped or conflated in the latest index. Bump transform's destination suffix to -v2. |
9.4.0 |
| 7.1.0 | Enhancement (View pull request) Stop storing the assumed-role ARN session name in user.changes.*. The session name is now added to related.user for cross-source correlation; when it is an email, both the full email and the local-part prefix are added. user.name continues to hold the IAM role name for detection rules. |
9.4.0 |
| 7.0.0 | Enhancement (View pull request) Hide the CloudWatch, EBS, EC2, ECS, and S3 metric/log inputs when the Identity Federation setup access option is selected, since only the GuardDuty API input supports identity federation. Enhancement (View pull request) Reorganize AWS credentials configuration into a Setup Access selector with Identity Federation, Direct Access Keys, Temporary Access Keys, Assume Role, Assume Role with External ID, and Shared Credentials options. Existing access keys, role ARN, and shared credential settings continue to function and are auto-mapped to the corresponding option.Enhancement (View pull request) Switch the GuardDuty httpjson stream from manual SigV4 HMAC signing to the native auth.aws block.Breaking change (View pull request) Store the external_id variable as a secret.Enhancement (View pull request) Add assume_role_duration, assume_role_expiry_window, and supports_identity_federation variables.Breaking change (View pull request) Require Kibana and Elastic Agent ^9.4.0 (drop support for Kibana 8.x, Kibana 9.x below 9.4.0, and Elastic Agent below 9.4.0). The var_groups manifest feature and auth.aws runtime require this minimum. |
9.4.0 |
| 6.21.0 | Bug fix (View pull request) Poll Amazon Inspector findings on updatedAt instead of lastObservedAt so that findings AWS marks CLOSED or SUPPRESSED are collected and no longer remain stale in Elastic.Enhancement (View pull request) Include all Inspector finding statuses in the vulnerability latest transform and map aws.inspector.status to the vulnerability.status field (CLOSED as fixed), so remediated findings can be filtered out on the Vulnerability Findings page.Enhancement (View pull request) Add a lag_time variable to the Amazon Inspector data stream that offsets the poll cursor to tolerate delay between when a finding's updatedAt is set and when it becomes available from the API, preventing missed findings. |
9.2.1 8.19.4 |
| 6.20.4 | Bug fix (View pull request) Add security category to the Transit Gateway data stream to match its policy template categories. |
9.2.1 8.19.4 |
| 6.20.3 | Enhancement (View pull request) Add processor tags to all ingest pipeline processors to satisfy elastic-package linter requirements for format_version 3.6.0 and above. |
— |
| 6.20.2 | Bug fix (View pull request) Skip AWS service-linked Config rules when collecting compliance details so the AWS Config data stream no longer degrades on AccessDeniedException, and treat per-rule compliance errors as non-fatal so a single failing rule does not stop ingestion of the rest. |
9.2.1 8.19.4 |
| 6.20.1 | Bug fix (View pull request) Revert addition of assignment of host.id from CloudTrail target hosts. |
9.2.1 8.19.4 |
| 6.20.0 | Enhancement (View pull request) Enable agentless deployment mode for CloudWatch, EBS, EC2, ECS, and S3 policy templates. Bug fix (View pull request) Disable TSDB on the S3 daily storage data stream to avoid rejection of late-arriving daily CloudWatch metrics. |
9.2.1 8.19.4 |
| 6.19.2 | Bug fix (View pull request) Restore a stable endInclusive bound to Inspector findings filter to prevent potential nextToken invalidation. |
9.2.1 8.19.4 |
| 6.19.1 | Bug fix (View pull request) Fix aws.lambda.message flattened field handling. |
9.2.1 8.19.4 |
| 6.19.0 | Enhancement (View pull request) Use new release field for agentless deployment mode to establish as beta. |
9.2.1 8.19.4 |
| 6.18.1 | Enhancement (View pull request) Add documentation for authenticating the CloudTrail integration using AWS IAM Roles Anywhere for agents running outside AWS. |
9.2.1 8.19.4 |
| 6.18.0 | Enhancement (View pull request) Set event.kind to alert for AWS GuardDuty findings. |
9.2.1 8.19.4 |
| 6.17.1 | Bug fix (View pull request) Fix Security Hub findings collection by restoring a stable UpdatedAt end bound. |
9.2.1 8.19.4 |
| 6.17.0 | Enhancement (View pull request) Add ingest timestamp to AWS CloudWatch logs if timestamp is not present in the event. |
9.2.1 8.19.4 |
| 6.16.0 | Enhancement (View pull request) Add fail guard for unsupported VPC Flow Log formats so unrecognised records surface as pipeline errors instead of indexing silently unparsed. |
9.2.1 8.19.4 |
| 6.15.0 | Enhancement (View pull request) Add S3 polling mode performance recommendations to CloudTrail docs |
9.2.1 8.19.4 |
| 6.14.2 | Bug fix (View pull request) Fix NextToken invalidation in Security Hub, GuardDuty, and Inspector by removing the upper time bound from paginated queries. |
9.2.1 8.19.4 |
| 6.14.1 | Bug fix (View pull request) Handle null EvaluationResults in AWS Config GetComplianceDetailsByConfigRule response. |
9.2.1 8.19.4 |
| 6.14.0 | Enhancement (View pull request) Enable agentless deployment for AWS RDS metrics. |
9.2.1 8.19.4 |
| 6.13.0 | Enhancement (View pull request) Enable agentless deployment for AWS DynamoDB metrics. |
9.2.1 8.19.4 |
| 6.12.0 | Enhancement (View pull request) Enable agentless deployment for AWS SNS metrics. |
9.2.1 8.19.4 |
| 6.11.0 | Enhancement (View pull request) Enable agentless deployment for AWS Transitgateway metrics. |
9.2.1 8.19.4 |
| 6.10.0 | Enhancement (View pull request) Enable agentless deployment for AWS Billing metrics. |
9.2.1 8.19.4 |
| 6.9.0 | Enhancement (View pull request) Enable agentless deployment for AWS Health metrics. |
9.2.1 8.19.4 |
| 6.8.0 | Enhancement (View pull request) Enable agentless deployment for AWS SQS metrics. |
9.2.1 8.19.4 |
| 6.7.0 | Enhancement (View pull request) Enable agentless deployment for AWS ELB metrics. |
9.2.1 8.19.4 |
| 6.6.0 | Enhancement (View pull request) Enable agentless deployment for AWS Lambda metrics. |
9.2.1 8.19.4 |
| 6.5.1 | Bug fix (View pull request) Add credential validation to AWS Config CEL program to emit a clear error when access_key_id or secret_access_key are missing. Document that the AWS Config data stream requires static credentials and does not support Role ARN or other SDK-based credential methods. |
9.2.1 8.19.4 |
| 6.5.0 | Enhancement (View pull request) Add timestamp range filter and storage tier exclusion to latest transform source queries to reduce scan scope and improve performance. |
9.2.1 8.19.4 |
| 6.4.3 | Bug fix (View pull request) Align event.kind with ECS in securityhub_findings_full_posture data stream to avoid conflicts with ingest pipeline values. |
9.2.1 8.19.4 |
| 6.4.2 | Bug fix (View pull request) Revert event.kind from alert to event on AWS WAF. |
9.2.1 8.19.4 |
| 6.4.1 | Bug fix (View pull request) Ignore uri_parts failures on S3 access log request paths that the URI parser cannot handle. |
9.2.1 8.19.4 |
| 6.4.0 | Enhancement (View pull request) Set host.id alongside host.target.entity.id in CloudTrail pipeline for entity store host entity resolution. |
9.2.1 8.19.4 |
| 6.3.2 | Bug fix (View pull request) Fix s3access ingest pipeline to handle host headers with ports and Source region field parsing. |
9.2.1 8.19.4 |
| 6.3.1 | Bug fix (View pull request) Fix CloudTrail pipeline errors causing transient json and _conf fields to leak into indexed documents by cleaning them up in the on_failure handler, preventing dynamic mapping conflicts. |
9.2.1 8.19.4 |
| 6.3.0 | Enhancement (View pull request) Removed ECS field definitions from CDR transform destinations, now covered by ecs@mappings component template. Renamed overridden ECS fields files to ecs-overridden.yml for awsconfig and awsinspector transforms. |
9.2.1 8.19.4 |
| 6.2.0 | Enhancement (View pull request) Add support for the aws.waf.captcha_response.*, aws.waf.challenge_response.*, aws.waf.format_version, aws.waf.ja4_fingerprint, aws.waf.labels.name, aws.waf.oversize_fields, aws.waf.request_body_size, aws.waf.request_body_size_inspected_by_waf, aws.waf.response_code_sent, aws.waf.request_headers_inserted.*, host.domain, tls.client.ja3, url.fragment and url.scheme in waf data stream.aws.waf.request_headers_inserted.*, tls.client.ja3, url.registered_domain, url.fragment and url.scheme in waf data stream. |
9.2.1 8.19.4 |
| 6.1.1 | Bug fix (View pull request) Remove duplicate security-solution-default tag references |
9.2.1 8.19.4 |
| 6.1.0 | Bug fix (View pull request) Remove fixed value event.dataset mapping for lambda_logs data stream. |
9.2.1 8.19.4 |
| 6.0.0 | Breaking change (View pull request) Remove third-party pipeline for previously removed 'third-party REST API' input from 'AWS Cloudtrail'. |
9.2.1 8.19.4 |
| 5.6.1 | Bug fix (View pull request) Fix Cloudtrail's Lambda event parsing of vpcConfig.securityGroupIds and vpcConfig.subnetIds fields. |
9.2.1 8.19.4 |
| 5.6.0 | Enhancement (View pull request) Update AWS ALB Grok patterns to support the conn_trace_id field and parse malformed requests missing HTTP versions. |
9.2.1 8.19.4 |
| 5.5.1 | Bug fix (View pull request) Added support for extracting user name from AWS GovCloud STS ARNs and fixed management_event field type conversion. |
9.2.1 8.19.4 |
| 5.5.0 | Enhancement (View pull request) Add dashboards for AWS Web Application Firewall data stream. |
9.2.1 8.19.4 |
| 5.4.1 | Enhancement (View pull request) S3 Access logs, improve S3KEY regex to handle special characters. |
9.2.1 8.19.4 |
| 5.4.0 | Enhancement (View pull request) Add ec2_metrics, lambda, sqs and sns alert rule templates. |
9.2.1 8.19.4 |
| 5.3.1 | Bug fix (View pull request) Add cookies field in cloudfront logs datastream. |
9.1.4 8.19.4 |
| 5.3.0 | Enhancement (View pull request) Added rate limiting and retry configuration for AWS Config data stream. |
9.1.4 8.19.4 |
| 5.2.0 | Enhancement (View pull request) Normalize user fields for AWS CloudTrail events. |
9.1.4 8.19.4 |
| 5.1.0 | Enhancement (View pull request) Set event.kind to alert on AWS WAF events. |
9.1.4 8.19.4 |
| 5.0.0 | Breaking change (View pull request) Rebrand AWS Security Hub as AWS Security Hub CSPM to align with the vendor's current branding. This change involves updating the observer.vendor value to AWS Security Hub CSPM. |
9.1.4 8.19.4 |
| 4.7.0 | Enhancement (View pull request) Add type-specific entity fields to data stream. This enables better entity classification while maintaining backward compatibility with existing actor.entity.id and target.entity.id fields. |
9.1.4 8.19.4 |
| 4.6.0 | Enhancement (View pull request) Retain CloudTrail sessionCredentialFromConsole field as aws.cloudtrail.session_credential_from_console. |
9.1.4 8.19.4 |
| 4.5.0 | Enhancement (View pull request) Prevent updating fleet health status to degraded when the HTTPJSON template value evaluation is empty. |
9.1.4 8.19.4 |
| 4.4.0 | Enhancement (View pull request) Prefer set with copy_from. |
9.1.0 8.19.0 |
| 4.3.2 | Bug fix (View pull request) Update transform to filter out document containing an error.message from AWS Config, AWS Inspector, and AWS Security Hub latest indexes. |
9.1.0 8.19.0 |
| 4.3.1 | Bug fix (View pull request) Update the AWS CloudWatch documentation. |
9.1.0 8.19.0 |
| 4.3.0 | Enhancement (View pull request) Improve documentation to align with new guidelines. |
9.1.0 8.19.0 |
| 4.2.0 | Enhancement (View pull request) Add user.name to Cloudtrail's UserAuthentication events. |
9.1.0 8.19.0 |
| 4.1.0 | Enhancement (View pull request) Add vulnerability_workflow and misconfiguration_workflow sub category labels. |
9.1.0 8.19.0 |
| 4.0.0 | Enhancement (View pull request) Add latest transform to AWS Config and AWS Inspector.This enables support for extended protections for AWS Config and AWS Inspector.Breaking change (View pull request) The latest transforms requires transform node and necessary permissions to use the transform.The transforms stores the latest copy of vulnerabilities and misconfigurations in the destination indices, which will require additional storage. Due to change in fingeprinting on source indices, duplicates occur on source indices of AWS Config and AWS Inspector. |
9.1.0 8.19.0 |
| 3.17.2 | Bug fix (View pull request) Fix Cloudtrail's Lambda event parsing of vpcConfig.securityGroupIds and vpcConfig.subnetIds fields. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.17.1 | Bug fix (View pull request) Disable lastSync start_position configuration for CloudWatch as it's incompatible with versions below 9.x. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.17.0 | Enhancement (View pull request) Enable Agentless deployment for AWS GuardDuty. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.16.0 | Enhancement (View pull request) Map recipient_account_id to cloud.account.id for AWS CloudTrail. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.15.0 | Enhancement (View pull request) Add support for VPC Flow logs versions 6, 7, and 8. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.14.2 | Bug fix (View pull request) Remove unused agent files. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.14.1 | Bug fix (View pull request) Fixed issue where empty DescribeConfigRules responses caused 'index out of bounds' errors in AWS Config integration. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.14.0 | Enhancement (View pull request) Prevent logging expected agent HTTP JSON template errors. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.13.4 | Bug fix (View pull request) Add description on lastSync start_position configuration for CloudWatch. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.13.3 | Bug fix (View pull request) Remove redundant code from config data stream agent configuration. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.13.2 | Bug fix (View pull request) Remove Include Linked Accounts config option from AWS Health. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.13.1 | Bug fix (View pull request) Avoid updating fleet health status to degraded when Guardduty has no findings. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.13.0 | Enhancement (View pull request) Reduce unnecessary work done in cloudtrail data stream when flattened fields are not required. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.12.0 | Enhancement (View pull request) Mapping changes in inspector datastream for Cloud Detection and Response (CDR) vulnerability workflow.Parse and map newly introduced fields in the inspector data stream.Enable request trace log removal and Agentless deployment in the inspector data stream. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.11.0 | Bug fix (View pull request) Fix tlsVersion parsing when not properly defined in cloudtrail event.Enhancement (View pull request) Add empty value removal script to cloudtrail data stream ingest pipeline. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.10.1 | Bug fix (View pull request) Fix configuration template typo. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.10.0 | Enhancement (View pull request) Allow user-specification of fields to retain in the cloudtrail data stream. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.9.0 | Enhancement (View pull request) Ingest managed insights from Security Hub. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.8.2 | Bug fix (View pull request) Fix null reference in securityhub_findings* data streams when extracting host.ip. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.8.1 | Bug fix (View pull request) Modify the data type of event.kind from a constant_keyword to a keyword to handle pipeline errors that send event.kind as pipeline_error. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.8.0 | Enhancement (View pull request) Standardize user fields processing across integrations. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.7.1 | Bug fix (View pull request) Add temporary processor to remove the fields added by the Agentless policy. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.7.0 | Enhancement (View pull request) Add AWS lambda logs overview dashboard. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.6.0 | Enhancement (View pull request) Add AWS lambda logs dataset. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.5.2 | Bug fix (View pull request) Add Redshift InstanceType dimension. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.5.1 | Enhancement (View pull request) Change Redshift terraform node type because dc2.large is deprecated and leads to system tests fails. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.5.0 | Enhancement (View pull request) Add the external_id field to data streams collecting data from S3. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.4.0 | Enhancement (View pull request) Add new AWS Config datastream. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.3.3 | Enhancement (View pull request) Update README - Document ingested log types of AWS Network Firewall. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.3.2 | Enhancement (View pull request) Update README - EC2 Instance IAM Role for AWS Authentication |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.3.1 | Bug fix (View pull request) Fix handling of duplicate fields in Network Firewall Logs data stream. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.3.0 | Enhancement (View pull request) Remove deprecated httpjson input for cloudtrail data stream. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.2.0 | Enhancement (View pull request) Add agentless deployment for AWS Security Hub. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.1.0 | Enhancement (View pull request) Enhancements for Guardduty dashboards. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 3.0.0 | Breaking change (View pull request) Add new Security Hub Findings Full Posture data stream. If you rely on Findings > Misconfigurations view, enable this new data stream. |
9.0.0 8.18.0 8.17.4 8.16.6 |
| 2.45.2 | Enhancement (View pull request) Update grok pattern for AWS S3 access ingest pipeline |
9.0.0 8.16.5 |
| 2.45.1 | Bug fix (View pull request) Fix handling of SQS worker count configuration. |
9.0.0 8.16.5 |
| 2.45.0 | Breaking change (View pull request) Update default data_stream.dataset to aws.cloudwatch_logs for cloudwatch_logs data stream. |
9.0.0 8.16.5 |
| 2.44.0 | Enhancement (View pull request) Add actor.entity.id and target.entity.id |
9.0.0 8.16.5 |
| 2.43.0 | Enhancement (View pull request) Set event.type and event.action fields in vpcflow logs. |
9.0.0 8.16.5 |
| 2.42.0 | Enhancement (View pull request) Add support to configure start_timestamp and ignore_older configurations for AWS S3 backed inputs. |
9.0.0 8.16.5 |
| 2.41.1 | Bug fix (View pull request) Updated SSL description to be uniform and to include links to documentation. |
9.0.0 8.16.2 |
| 2.41.0 | Enhancement (View pull request) Ignore long cloudtrail.request_parameters and cloudtrail.response_elements fields. |
9.0.0 8.16.2 |
| 2.40.0 | Enhancement (View pull request) Add support for Kibana 9.0.0. |
9.0.0 8.16.2 |
| 2.39.0 | Enhancement (View pull request) Allow the usage of deprecated log input and support for stack 9.0 |
8.16.2 |
| 2.38.2 | Bug fix (View pull request) Update links to getting started docs |
8.16.2 |
| 2.38.1 | Enhancement (View pull request) Add missing category. |
8.16.2 |
| 2.38.0 | Enhancement (View pull request) Add support for Access Point ARN when collecting logs via the AWS S3 Bucket. |
8.16.2 |
| 2.37.0 | Enhancement (View pull request) Map aws.dimensions as object instead of flattened in CloudWatch metrics. |
8.16.0 |
| 2.36.2 | Enhancement (View pull request) Include pipeline test examples to accommodate the new Cloudtrail format for the CreateGroup and UpdateGroup event types. |
8.16.0 |
| 2.36.1 | Enhancement (View pull request) Add SQS API calls documentation and required S3 permissions. |
8.16.0 |
| 2.36.0 | Enhancement (View pull request) Add ELB connection logs dashboards for application load balancers. |
8.16.0 |
| 2.35.0 | Enhancement (View pull request) Add the support for connection logs for AWS ELB dataset for Application Load Balancers. |
8.16.0 |
| 2.34.0 | Enhancement (View pull request) |