Vulnerabilities template wrong type for package size

[sebasfalcone]

Description

While investigating:

• Vulnerability detector - Router module fails to forward to scanner big packages #27745

It was found that there is an issue with the type used to express the package size for vulnerability events:

wazuh/src/wazuh_modules/vulnerability_scanner/indexer/template/index-template.json

Line 141 in 29263a6

"type": "long"

The type used is long (int 64), when in reality it should be an unsigned long (unit 64)

DoD

• Template updated

[QU3B1M]

The field package.size comes from the default ECS fields, we need to override it in order to modify its type, something like this should do the trick:

- name: package
  title: Package
  group: 2
  short: Fields to describe the package relevant to an event.
  description: >
    The package fields describe information about a package that is
    relevant to an event.
  type: group
  fields:
    - name: size
      type: <type>
      level: custom
      description: >
        Size of the package.

---

The value uint (or unsigned INT) is not compatible with the ECS mappings fields, but the unsigned_long is, so im using that type instead. More info about supported types can be found in the ECS reference

[QU3B1M]

PRs with changes applied for 4.12.0:

• Update Vulnerability Scanner package.size ECS field to unsigned_long for 4.12.0 wazuh-indexer#662
• Update Vulnerability Scanner package.size ECS field to unsigned_long #27988

---

PRs with changes applied for 5.0.0:

• Update states-vulnerabilities package.size field type to unsigned_long wazuh-indexer#663
• [ECS Generator] Update index templates wazuh-indexer-plugins#259