Update Ports Inventory Format

[vikman90]

Parent Issue: #292

Description

Update the ports inventory format to comply with the Elastic Common Schema (ECS).

Data Fields

Field	Type	Example
agent.groups	keyword
agent.id	keyword
destination.ip	ip
destination.port	long
device.id	keyword
file.inode	keyword
host.network.ingress.queue	long
network.protocol	keyword
process.name	keyword
process.pid	long
source.ip	ip
source.port	long

Tasks

• Map and update all fields in the ports inventory according to ECS guidelines.

References

• Common schema definitions: Wazuh Indexer Plugins
• ECS documentation: Elastic ECS Documentation

[LucioDonda]

Messages are being received almost empty altough I'm forcing the opening and closing of ports:

Body:
{
    "agent": {
        "groups": [],
        "host": {
            "architecture": "x86_64",
            "hostname": "pm-ubuntu24-server",
            "ip": [
                "192.168.0.141",
                "fe80::be24:11ff:fe54:83fb"
            ],
            "os": {
                "name": "Ubuntu",
                "platform": "Linux"
            }
        },
        "id": "e5b4b52b-9b22-4dd0-ab57-651a6eb6e720",
        "name": "",
        "type": "Endpoint",
        "version": "5.0.0"
    }
}
{
    "id": "aW52ZW50b3J5OnBvcnRzOg==",
    "module": "inventory",
    "operation": "deleted",
    "type": "ports"
}
{
    "@timestamp": "2024/11/15 20:06:13"
}

Pending UTs fixes / addition

[LucioDonda]

Corrections of resultant json:

{
    "data": {
        "@timestamp": "2024/11/19 20:12:29",
        "destination": {
            "ip": "::ffff:192.168.0.127",
            "port": 60130
        },
        "device": {
            "id": "f4554af2792e6cc5c61bd2c14bf35427b635fa44"
        },
        "file": {
            "inode": 2662
        },
        "host": {
            "network": {
                "egress": {
                    "queue": 268
                },
                "ingress": {
                    "queue": 0
                }
            }
        },
        "interface": {
            "state": "established"
        },
        "network": {
            "protocol": "tcp6"
        },
        "process": {
            "name": "sshd",
            "pid": 1238
        },
        "source": {
            "ip": "::ffff:192.168.0.141",
            "port": 22
        }
    },
    "id": "aW52ZW50b3J5OnBvcnRzOjI2NjI6dGNwNjo6OmZmZmY6MTkyLjE2OC4wLjE0MToyMg==",
    "operation": "create",
    "type": "ports"
}

, metadata 
{
    "id": "aW52ZW50b3J5OnBvcnRzOjI2NjI6dGNwNjo6OmZmZmY6MTkyLjE2OC4wLjE0MToyMg==",
    "module": "inventory",
    "operation": "create",
    "type": "ports"
}

matching id criteria: