From 1794cfb26f4f3942207ba05a854cca77bf814dd2 Mon Sep 17 00:00:00 2001
From: Karl Godard <kg@cmd.com>
Date: Wed, 25 Jan 2023 13:23:08 -0800
Subject: [PATCH] [8.7] Description for host.name updated (FQDN issue) (#2122)

* Description for host.name updated

* build artifacts

* changelog updated

* moved changelog entry to 8.7

Co-authored-by: Karl Godard <karlgodard@elastic.co>
Co-authored-by: Eric Beahan <eric.beahan@elastic.co>
---
 CHANGELOG.next.md                           | 1 +
 docs/fields/field-details.asciidoc          | 2 +-
 experimental/generated/beats/fields.ecs.yml | 6 +++---
 experimental/generated/ecs/ecs_flat.yml     | 5 +++--
 experimental/generated/ecs/ecs_nested.yml   | 6 +++---
 generated/beats/fields.ecs.yml              | 6 +++---
 generated/ecs/ecs_flat.yml                  | 5 +++--
 generated/ecs/ecs_nested.yml                | 6 +++---
 schemas/host.yml                            | 7 +++----
 9 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md
index 1505447e66..ae99bd76f4 100644
--- a/CHANGELOG.next.md
+++ b/CHANGELOG.next.md
@@ -47,6 +47,7 @@ Thanks, you're awesome :-) -->
 #### Improvements
 
 * Updated usage docs to include `threat.indicator.url.domain` and changed `indicator.marking.tlp` and `indicator.enrichments.marking.tlp` from "WHITE" to "CLEAR" to align with TLP 2.0. #2124
+* description for `host.name` definition updated to encourage use of FDQN #2122
 
 
 <!-- All empty sections:
diff --git a/docs/fields/field-details.asciidoc b/docs/fields/field-details.asciidoc
index 9e59a7882e..e62c6fa213 100644
--- a/docs/fields/field-details.asciidoc
+++ b/docs/fields/field-details.asciidoc
@@ -5145,7 +5145,7 @@ example: `["00-00-5E-00-53-23", "00-00-5E-00-53-24"]`
 
 a| Name of the host.
 
-It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.
 
 type: keyword
 
diff --git a/experimental/generated/beats/fields.ecs.yml b/experimental/generated/beats/fields.ecs.yml
index ed0babf839..200f0510c9 100644
--- a/experimental/generated/beats/fields.ecs.yml
+++ b/experimental/generated/beats/fields.ecs.yml
@@ -4066,9 +4066,9 @@
       ignore_above: 1024
       description: 'Name of the host.
 
-        It can contain what `hostname` returns on Unix systems, the fully qualified
-        domain name, or a name specified by the user. The sender decides which value
-        to use.'
+        It can contain what hostname returns on Unix systems, the fully qualified
+        domain name (FQDN), or a name specified by the user. The recommended value
+        is the lowercase FQDN of the host.'
     - name: network.egress.bytes
       level: extended
       type: long
diff --git a/experimental/generated/ecs/ecs_flat.yml b/experimental/generated/ecs/ecs_flat.yml
index 602bf2e5db..8760da8d66 100644
--- a/experimental/generated/ecs/ecs_flat.yml
+++ b/experimental/generated/ecs/ecs_flat.yml
@@ -5814,8 +5814,9 @@ host.name:
   dashed_name: host-name
   description: 'Name of the host.
 
-    It can contain what `hostname` returns on Unix systems, the fully qualified domain
-    name, or a name specified by the user. The sender decides which value to use.'
+    It can contain what hostname returns on Unix systems, the fully qualified domain
+    name (FQDN), or a name specified by the user. The recommended value is the lowercase
+    FQDN of the host.'
   flat_name: host.name
   ignore_above: 1024
   level: core
diff --git a/experimental/generated/ecs/ecs_nested.yml b/experimental/generated/ecs/ecs_nested.yml
index 95671d36fb..9d49aca473 100644
--- a/experimental/generated/ecs/ecs_nested.yml
+++ b/experimental/generated/ecs/ecs_nested.yml
@@ -7217,9 +7217,9 @@ host:
       dashed_name: host-name
       description: 'Name of the host.
 
-        It can contain what `hostname` returns on Unix systems, the fully qualified
-        domain name, or a name specified by the user. The sender decides which value
-        to use.'
+        It can contain what hostname returns on Unix systems, the fully qualified
+        domain name (FQDN), or a name specified by the user. The recommended value
+        is the lowercase FQDN of the host.'
       flat_name: host.name
       ignore_above: 1024
       level: core
diff --git a/generated/beats/fields.ecs.yml b/generated/beats/fields.ecs.yml
index f09dc4cc4b..f35072fb83 100644
--- a/generated/beats/fields.ecs.yml
+++ b/generated/beats/fields.ecs.yml
@@ -4016,9 +4016,9 @@
       ignore_above: 1024
       description: 'Name of the host.
 
-        It can contain what `hostname` returns on Unix systems, the fully qualified
-        domain name, or a name specified by the user. The sender decides which value
-        to use.'
+        It can contain what hostname returns on Unix systems, the fully qualified
+        domain name (FQDN), or a name specified by the user. The recommended value
+        is the lowercase FQDN of the host.'
     - name: network.egress.bytes
       level: extended
       type: long
diff --git a/generated/ecs/ecs_flat.yml b/generated/ecs/ecs_flat.yml
index 495d263b6b..213111250e 100644
--- a/generated/ecs/ecs_flat.yml
+++ b/generated/ecs/ecs_flat.yml
@@ -5745,8 +5745,9 @@ host.name:
   dashed_name: host-name
   description: 'Name of the host.
 
-    It can contain what `hostname` returns on Unix systems, the fully qualified domain
-    name, or a name specified by the user. The sender decides which value to use.'
+    It can contain what hostname returns on Unix systems, the fully qualified domain
+    name (FQDN), or a name specified by the user. The recommended value is the lowercase
+    FQDN of the host.'
   flat_name: host.name
   ignore_above: 1024
   level: core
diff --git a/generated/ecs/ecs_nested.yml b/generated/ecs/ecs_nested.yml
index dd9dc82791..021257cc6c 100644
--- a/generated/ecs/ecs_nested.yml
+++ b/generated/ecs/ecs_nested.yml
@@ -7137,9 +7137,9 @@ host:
       dashed_name: host-name
       description: 'Name of the host.
 
-        It can contain what `hostname` returns on Unix systems, the fully qualified
-        domain name, or a name specified by the user. The sender decides which value
-        to use.'
+        It can contain what hostname returns on Unix systems, the fully qualified
+        domain name (FQDN), or a name specified by the user. The recommended value
+        is the lowercase FQDN of the host.'
       flat_name: host.name
       ignore_above: 1024
       level: core
diff --git a/schemas/host.yml b/schemas/host.yml
index aa39675389..9b7373ad1e 100644
--- a/schemas/host.yml
+++ b/schemas/host.yml
@@ -27,7 +27,6 @@
     Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
   type: group
   fields:
-
     - name: hostname
       level: core
       type: keyword
@@ -44,9 +43,9 @@
       description: >
         Name of the host.
 
-        It can contain what `hostname` returns on Unix systems, the fully
-        qualified domain name, or a name specified by the user. The sender
-        decides which value to use.
+        It can contain what hostname returns on Unix systems, the fully
+        qualified domain name (FQDN), or a name specified by the user.
+        The recommended value is the lowercase FQDN of the host.
 
     - name: id
       level: core