Add related.entities field

elastic · Aug 14, 2024 · 51ba417 · 51ba417
1 parent a664f22
commit 51ba417
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/schemas/related.yml b/schemas/related.yml
@@ -70,3 +70,15 @@
         identifiers include FQDNs, domain names, workstation names, or aliases.
       normalize:
         - array
+
+    - name: entity
+      level: extended
+      type: keyword
+      short: All the entity identifiers
+      description: >
+        All the entity identifiers related to the document. If the document
+        contains multiple entities, identifiers belonging to different entities
+        will be present. Example identifiers include Cloud Resource Ids, ARNs, email
+        addresses, or hostnames.
+      normalize:
+        - array