[Security Solution][Exceptions] Add lowercase normalized fields for case-insensitive matching

Makefile

@@ -149,7 +149,7 @@ $(ROOT_DIR)/out:
 build-package: $(ROOT_DIR)/out
 	rm -rf $(PACKAGES_DIR)
 	mkdir -p $(PACKAGES_DIR)/endpoint/$(PACKAGE_VERSION)
-	cp -r $(ROOT_DIR)/package/endpoint/ $(PACKAGES_DIR)/endpoint/$(PACKAGE_VERSION)
+	cp -r $(ROOT_DIR)/package/endpoint/* $(PACKAGES_DIR)/endpoint/$(PACKAGE_VERSION)
 
 # Use this target to run the package registry with your modifications to the endpoint package
 .PHONY: run-registry

custom_schemas/custom_file.yml

@@ -11,6 +11,22 @@
     File fields provide details about the affected file associated with the event or metric.
   type: group
   fields:
+    - name: path
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
+    - name: target_path
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
     - name: Ext
       level: custom
       type: object

custom_schemas/custom_os.yml

@@ -11,6 +11,22 @@
     expected:
       - host
   fields:
+    - name: full
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
+    - name: name
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
     - name: Ext
       level: custom
       type: object

custom_schemas/custom_process.yml

@@ -16,6 +16,38 @@
       - { at: Target.process, as: parent }
   type: group
   fields:
+    - name: command_line
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
+    - name: executable
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
+    - name: name
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
+    - name: working_directory
+      multi_fields:
+        - name: caseless
+          type: keyword
+          normalizer: lowercase
+        - name: text
+          type: text
+
     - name: Ext
       level: custom
       type: object

generated/alerts/ecs/ecs_flat.yml

@@ -968,6 +968,11 @@ Target.process.command_line:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.command_line.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.command_line.text
     name: text
     norms: false
@@ -1005,6 +1010,11 @@ Target.process.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.executable.text
     name: text
     norms: false
@@ -1082,6 +1092,11 @@ Target.process.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.name.text
     name: text
     norms: false
@@ -1248,6 +1263,11 @@ Target.process.parent.command_line:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.parent.command_line.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.parent.command_line.text
     name: text
     norms: false
@@ -1285,6 +1305,11 @@ Target.process.parent.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.parent.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.parent.executable.text
     name: text
     norms: false
@@ -1362,6 +1387,11 @@ Target.process.parent.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.parent.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.parent.name.text
     name: text
     norms: false
@@ -1479,6 +1509,11 @@ Target.process.parent.working_directory:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.parent.working_directory.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.parent.working_directory.text
     name: text
     norms: false
@@ -1967,6 +2002,11 @@ Target.process.working_directory:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: Target.process.working_directory.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: Target.process.working_directory.text
     name: text
     norms: false
@@ -3835,6 +3875,11 @@ file.path:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: file.path.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: file.path.text
     name: text
     norms: false
@@ -3922,6 +3967,11 @@ file.target_path:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: file.target_path.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: file.target_path.text
     name: text
     norms: false
@@ -4253,6 +4303,11 @@ host.os.full:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: host.os.full.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: host.os.full.text
     name: text
     norms: false
@@ -4282,6 +4337,11 @@ host.os.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: host.os.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: host.os.name.text
     name: text
     norms: false
@@ -4983,6 +5043,11 @@ process.command_line:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.command_line.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.command_line.text
     name: text
     norms: false
@@ -5018,6 +5083,11 @@ process.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.executable.text
     name: text
     norms: false
@@ -5093,6 +5163,11 @@ process.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.name.text
     name: text
     norms: false
@@ -5258,6 +5333,11 @@ process.parent.command_line:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.parent.command_line.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.parent.command_line.text
     name: text
     norms: false
@@ -5295,6 +5375,11 @@ process.parent.executable:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.parent.executable.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.parent.executable.text
     name: text
     norms: false
@@ -5372,6 +5457,11 @@ process.parent.name:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.parent.name.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.parent.name.text
     name: text
     norms: false
@@ -5489,6 +5579,11 @@ process.parent.working_directory:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.parent.working_directory.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.parent.working_directory.text
     name: text
     norms: false
@@ -5963,6 +6058,11 @@ process.working_directory:
   ignore_above: 1024
   level: extended
   multi_fields:
+  - flat_name: process.working_directory.caseless
+    ignore_above: 1024
+    name: caseless
+    normalizer: lowercase
+    type: keyword
   - flat_name: process.working_directory.text
     name: text
     norms: false