{
  "_meta": {
    "description": "OpenLatch SIEM channel for Elastic Security: composable index template for the logs-openlatch.* data streams that receive OpenLatch OCSF 1.1.0 events through the Bulk API. Install it with PUT _index_template/openlatch-ocsf before the first event, then point the channel at <deployment>/logs-openlatch.siem-default/_bulk. @timestamp is the OCSF time; every OCSF object keeps its OCSF path; every string under unmapped.openlatch.* is a keyword, searchable in KQL and ES|QL. Without this template Elastic's built-in logs template applies, and a document it cannot map lands in the failure store, which the channel counts as failed. Wire format and its history: the OpenLatch SIEM Event Format standard, section Changelog.",
    "ocsf_version": "1.1.0",
    "managed_by": "openlatch"
  },
  "index_patterns": ["logs-openlatch.*"],
  "data_stream": {},
  "priority": 500,
  "composed_of": [],
  "template": {
    "settings": {
      "index.mapping.total_fields.limit": 2000
    },
    "mappings": {
      "dynamic": true,
      "dynamic_templates": [
        {
          "openlatch_strings_as_keywords": {
            "path_match": "unmapped.*",
            "match_mapping_type": "string",
            "mapping": {
              "type": "keyword",
              "ignore_above": 8192
            }
          }
        }
      ],
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "time": {
          "type": "date",
          "format": "epoch_millis"
        },
        "class_uid": {
          "type": "integer"
        },
        "class_name": {
          "type": "keyword"
        },
        "category_uid": {
          "type": "integer"
        },
        "category_name": {
          "type": "keyword"
        },
        "activity_id": {
          "type": "integer"
        },
        "activity_name": {
          "type": "keyword"
        },
        "type_uid": {
          "type": "long"
        },
        "type_name": {
          "type": "keyword"
        },
        "severity_id": {
          "type": "integer"
        },
        "severity": {
          "type": "keyword"
        },
        "status_id": {
          "type": "integer"
        },
        "status": {
          "type": "keyword"
        },
        "action_id": {
          "type": "integer"
        },
        "action": {
          "type": "keyword"
        },
        "disposition_id": {
          "type": "integer"
        },
        "disposition": {
          "type": "keyword"
        },
        "message": {
          "type": "text"
        },
        "metadata": {
          "properties": {
            "version": {
              "type": "keyword"
            },
            "uid": {
              "type": "keyword"
            },
            "profiles": {
              "type": "keyword"
            },
            "product": {
              "properties": {
                "name": {
                  "type": "keyword"
                },
                "vendor_name": {
                  "type": "keyword"
                },
                "feature": {
                  "properties": {
                    "name": {
                      "type": "keyword"
                    }
                  }
                }
              }
            }
          }
        },
        "finding_info": {
          "properties": {
            "uid": {
              "type": "keyword"
            },
            "title": {
              "type": "text"
            },
            "desc": {
              "type": "text"
            },
            "types": {
              "type": "keyword"
            }
          }
        },
        "actor": {
          "properties": {
            "invoked_by": {
              "type": "keyword"
            },
            "user": {
              "properties": {
                "uid": {
                  "type": "keyword"
                },
                "email_addr": {
                  "type": "keyword"
                },
                "name": {
                  "type": "keyword"
                }
              }
            }
          }
        },
        "device": {
          "properties": {
            "type_id": {
              "type": "integer"
            },
            "type": {
              "type": "keyword"
            },
            "hostname": {
              "type": "keyword"
            },
            "uid": {
              "type": "keyword"
            },
            "ip": {
              "type": "keyword"
            }
          }
        },
        "src_endpoint": {
          "properties": {
            "ip": {
              "type": "keyword"
            },
            "hostname": {
              "type": "keyword"
            },
            "uid": {
              "type": "keyword"
            },
            "name": {
              "type": "keyword"
            }
          }
        },
        "api": {
          "properties": {
            "operation": {
              "type": "keyword"
            },
            "service": {
              "properties": {
                "name": {
                  "type": "keyword"
                }
              }
            }
          }
        },
        "cloud": {
          "properties": {
            "provider": {
              "type": "keyword"
            }
          }
        },
        "resources": {
          "type": "flattened"
        },
        "unmapped": {
          "type": "object",
          "dynamic": true
        }
      }
    }
  }
}