Today, we updated our data model by removing certain metadata fields from all events. These changes are designed to enhance your experience in the following ways:
In order to avoid disruption of your cyber-security operations, we automatically updated your detection rules that were impacted. Playbooks were also updated, but only for fields in the "Duplicate Fields" section.
If you are still using impacted fields ouside of Sekoia (in scripts, automations, etc.), you also have to update this logic yourself.
The change is effective on FRA1 (our main region) and will be rolled out to all regions in the coming days.
All events contained duplicated values for the UUIDs of the community, the entity, the intake, and the intake format. The fields using the sekoiaio.
prefix are already available in events and should be used instead of the legacy fields.
The legacy fields listed in the table below are no longer available.
Legacy Field (deleted) | Prefixed Field (kept) |
---|---|
customer.community_uuid | sekoiaio.customer.community_uuid |
customer.intake_uuid | sekoiaio.intake.uuid |
entity.uuid | sekoiaio.entity.uuid |
event.dialect_uuid | sekoiaio.intake.dialect_uuid |
event.dialect | sekoiaio.intake.dialect |
The following fields are no longer available in events. The matching UUID fields should be used instead when needed.
Deleted field name | UUID field to use |
---|---|
customer.community_name | sekoiaio.customer.community_uuid |
sekoiaio.customer.community_name | sekoiaio.customer.community_uuid |
customer.id | sekoiaio.customer.community_uuid |
sekoiaio.customer.id | sekoiaio.customer.community_uuid |
customer.intake_key | sekoiaio.intake.uuid |
sekoiaio.intake.key | sekoiaio.intake.uuid |
customer.intake_name | sekoiaio.intake.uuid |
sekoiaio.intake.name | sekoiaio.intake.uuid |
entity.id | sekoiaio.entity.uuid |
sekoiaio.entity.id | sekoiaio.entity.uuid |
entity.name | sekoiaio.entity.uuid |
sekoiaio.entity.name | sekoiaio.entity.uuid |
If you have any questions or need further assistance, please do not hesitate to contact our support team at support@sekoia.io.