diff --git a/playbooks/wazuh-manager-oss.yml b/playbooks/wazuh-manager-oss.yml
new file mode 100644
index 00000000..5cb9b4bd
--- /dev/null
+++ b/playbooks/wazuh-manager-oss.yml
@@ -0,0 +1,8 @@
+---
+- hosts: <WAZUH_MANAGER_HOST>
+  roles:
+    - role: ../roles/wazuh/ansible-wazuh-manager
+    - role: ../roles/wazuh/filebeat-oss
+      filebeat_output_elasticsearch_hosts: 172.16.0.161:9200
+
+
diff --git a/roles/opendistro/hosts b/roles/opendistro/hosts
new file mode 100644
index 00000000..bd3b73e7
--- /dev/null
+++ b/roles/opendistro/hosts
@@ -0,0 +1,49 @@
+# This is the default ansible 'hosts' file.
+#
+# It should live in /etc/ansible/hosts
+#
+#   - Comments begin with the '#' character
+#   - Blank lines are ignored
+#   - Groups of hosts are delimited by [header] elements
+#   - You can enter hostnames or ip addresses
+#   - A hostname/ip can be a member of multiple groups
+
+# Ex 1: Ungrouped hosts, specify before any group headers.
+
+## green.example.com
+## blue.example.com
+## 192.168.100.1
+## 192.168.100.10
+
+# Ex 2: A collection of hosts belonging to the 'webservers' group
+#[elasticsearch_first
+
+
+es1 ansible_host=172.16.0.161  ansible_user=vagrant ip=172.16.0.161
+es2 ansible_host=172.16.0.162 ansible_user=vagrant ip=172.16.0.162
+es3 ansible_host=172.16.0.163  ansible_user=vagrant ip=172.16.0.163
+manager1 ansible_host=172.16.1.250 ansible_user=vagrant ip=172.16.1.250
+
+[managers]
+manager1
+
+[es-cluster]
+es1
+es2
+es3
+manager1
+
+[kibana]
+es1
+
+[single-host]
+172.16.1.15 ansible_ssh_user=vagrant
+[elastic-cluster]
+172.16.0.161 ansible_ssh_user=vagrant
+172.16.0.162 ansible_ssh_user=vagrant
+172.16.0.163 ansible_ssh_user=vagrant
+[agents]
+172.16.0.131 ansible_ssh_user=vagrant
+172.16.0.132 ansible_ssh_user=vagrant
+# If you have multiple hosts following a pattern you can specify
+# them like this:
diff --git a/roles/opendistro/opendistro-elasticsearch/tasks/local_actions.yml b/roles/opendistro/opendistro-elasticsearch/tasks/local_actions.yml
index 60379616..b6995e5c 100644
--- a/roles/opendistro/opendistro-elasticsearch/tasks/local_actions.yml
+++ b/roles/opendistro/opendistro-elasticsearch/tasks/local_actions.yml
@@ -6,14 +6,12 @@
       module: file
       path: "{{ local_certs_path }}"
       state: directory
-    run_once: true
-    
+
   - name: Local action | Download certificates generation tool
     local_action:
       module: get_url
       url: "{{ certs_gen_tool_url }}"
       dest: "{{ local_certs_path }}/search-guard-tlstool-{{ certs_gen_tool_version }}.zip"
-    run_once: true
 
   - name: Local action | Extract the certificates generation tool
     local_action:
@@ -26,26 +24,36 @@
       module: file
       dest: "{{ local_certs_path }}/tools/sgtlstool.sh"
       mode: a+x
-    run_once: true
 
   - name: Local action | Prepare the certificates generation template file
     local_action:
       module: template
       src: "templates/tlsconfig.yml.j2"
       dest: "{{ local_certs_path }}/config/tlsconfig.yml"
-    run_once: true
+
+
+  - name: Create a directory if it does not exist
+    file:
+      path: "{{ local_certs_path }}/certs/"
+      state: directory
+      mode: '0755'
+    delegate_to: localhost
 
   - name: Local action | Check if root CA file exists
     local_action:
-      module: stat 
-      path: "{{ local_certs_path }}/config/root-ca.key"
+      module: stat
+      path: "{{ local_certs_path }}/certs/root-ca.key"
     register: root_ca_file
 
   - name: Local action | Generate the node & admin certificates in local
     local_action:
-      module: command {{ local_certs_path }}/tools/sgtlstool.sh -c {{ local_certs_path }}/config/tlsconfig.yml -ca -crt -t {{ local_certs_path }}/config/ -f -o
-    run_once: true
-    when: root_ca_file.stat.exists == False
+      module: command {{ local_certs_path }}/tools/sgtlstool.sh -c {{ local_certs_path }}/config/tlsconfig.yml -ca -crt -t {{ local_certs_path }}/certs/ -f -o
+    when: not root_ca_file.stat.exists
 
+  - name: Local action | Generate the node & admin certificates using an existing root CA
+    local_action:
+      module: command {{ local_certs_path }}/tools/sgtlstool.sh -c {{ local_certs_path }}/config/tlsconfig.yml -ca -crt -t {{ local_certs_path }}/certs/ -f
+    when: root_ca_file.stat.exists
+  run_once: true
   tags:
   - generate-certs
\ No newline at end of file
diff --git a/roles/opendistro/opendistro-kibana/tasks/main.yml b/roles/opendistro/opendistro-kibana/tasks/main.yml
index c68200cc..2d29e0cb 100644
--- a/roles/opendistro/opendistro-kibana/tasks/main.yml
+++ b/roles/opendistro/opendistro-kibana/tasks/main.yml
@@ -43,7 +43,8 @@
     block: "{{ lookup('template', 'opendistro_kibana.yml.j2') }}"
     dest: "{{ kibana_conf_path }}/kibana.yml"
     create: true
-    group: root
+    group: kibana
+    owner: kibana
     mode: 0640
     marker: "## {mark} Kibana general settings ##"
   notify: restart kibana
diff --git a/roles/wazuh/filebeat-oss/defaults/main.yml b/roles/wazuh/filebeat-oss/defaults/main.yml
new file mode 100644
index 00000000..4ed76156
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/defaults/main.yml
@@ -0,0 +1,57 @@
+---
+filebeat_version: 7.6.2
+
+filebeat_create_config: true
+
+filebeat_prospectors:
+  - input_type: log
+    paths:
+      - "/var/ossec/logs/alerts/alerts.json"
+    document_type: json
+    json.message_key: log
+    json.keys_under_root: true
+    json.overwrite_keys: true
+
+filebeat_node_name: node-1
+
+filebeat_output_elasticsearch_enabled: false
+filebeat_output_elasticsearch_hosts:
+  - "localhost:9200"
+
+filebeat_enable_logging: true
+filebeat_log_level: debug
+filebeat_log_dir: /var/log/mybeat
+filebeat_log_filename: mybeat.log
+
+filebeat_ssl_dir: /etc/pki/filebeat
+filebeat_ssl_certificate_file: ""
+filebeat_ssl_key_file: ""
+filebeat_ssl_insecure: "false"
+
+filebeat_module_package_url: https://packages.wazuh.com/3.x/filebeat
+filebeat_module_package_name: wazuh-filebeat-0.1.tar.gz
+filebeat_module_package_path: /tmp/
+filebeat_module_destination: /usr/share/filebeat/module
+filebeat_module_folder: /usr/share/filebeat/module/wazuh
+
+# Opendistro Security
+filebeat_opendistro_security: false
+
+elasticsearch_opendistro_security_user: elastic
+elasticsearch_opendistro_security_password: elastic_pass
+
+node_certs_generator : false
+node_certs_source: /usr/share/elasticsearch
+node_certs_destination: /etc/filebeat/certs
+
+
+# CA Generation
+master_certs_path: /es_certs
+generate_CA: true
+ca_cert_name: ""
+
+elasticrepo:
+  apt: 'https://artifacts.elastic.co/packages/oss-7.x/apt'
+  yum: 'https://artifacts.elastic.co/packages/oss-7.x/yum'
+  gpg: 'https://artifacts.elastic.co/GPG-KEY-elasticsearch'
+  key_id: '46095ACC8548582C1A2699A9D27D666CD88E42B4'
diff --git a/roles/wazuh/filebeat-oss/handlers/main.yml b/roles/wazuh/filebeat-oss/handlers/main.yml
new file mode 100644
index 00000000..96e15a22
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/handlers/main.yml
@@ -0,0 +1,3 @@
+---
+- name: restart filebeat
+  service: name=filebeat state=restarted
diff --git a/roles/wazuh/filebeat-oss/meta/main.yml b/roles/wazuh/filebeat-oss/meta/main.yml
new file mode 100644
index 00000000..240b2d08
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/meta/main.yml
@@ -0,0 +1,29 @@
+---
+dependencies: []
+
+galaxy_info:
+  author: Wazuh
+  description: Installing and maintaining filebeat server.
+  company: wazuh.com
+  license: license (GPLv3)
+  min_ansible_version: 2.0
+  platforms:
+    - name: EL
+      versions:
+        - 6
+        - 7
+    - name: Fedora
+      versions:
+        - all
+    - name: Debian
+      versions:
+        - jessie
+    - name: Ubuntu
+      versions:
+        - precise
+        - trusty
+        - xenial
+  galaxy_tags:
+    - web
+    - system
+    - monitoring
diff --git a/roles/wazuh/filebeat-oss/tasks/Debian.yml b/roles/wazuh/filebeat-oss/tasks/Debian.yml
new file mode 100644
index 00000000..a87bb2bf
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tasks/Debian.yml
@@ -0,0 +1,22 @@
+---
+- name: Debian/Ubuntu | Install apt-transport-https and ca-certificates
+  apt:
+    name:
+      - apt-transport-https
+      - ca-certificates
+    state: present
+  register: filebeat_ca_packages_install
+  until: filebeat_ca_packages_install is succeeded
+
+- name: Debian/Ubuntu | Add Elasticsearch apt key.
+  apt_key:
+    url: "{{ elasticrepo.gpg }}"
+    id: "{{ elasticrepo.key_id }}"
+    state: present
+
+- name: Debian/Ubuntu | Add Filebeat repository.
+  apt_repository:
+    repo: "deb {{ elasticrepo.apt }} stable main"
+    state: present
+    update_cache: true
+  changed_when: false
diff --git a/roles/wazuh/filebeat-oss/tasks/RMDebian.yml b/roles/wazuh/filebeat-oss/tasks/RMDebian.yml
new file mode 100644
index 00000000..25a33909
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tasks/RMDebian.yml
@@ -0,0 +1,6 @@
+---
+- name: Debian/Ubuntu | Remove Filebeat repository (and clean up left-over metadata)
+  apt_repository:
+    repo: "deb {{ elasticrepo.apt }} stable main"
+    state: absent
+  changed_when: false
diff --git a/roles/wazuh/filebeat-oss/tasks/RMRedHat.yml b/roles/wazuh/filebeat-oss/tasks/RMRedHat.yml
new file mode 100644
index 00000000..1cf84081
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tasks/RMRedHat.yml
@@ -0,0 +1,6 @@
+---
+- name: RedHat/CentOS/Fedora | Remove Filebeat repository (and clean up left-over metadata)
+  yum_repository:
+    name: elastic_repo_7
+    state: absent
+  changed_when: false
diff --git a/roles/wazuh/filebeat-oss/tasks/RedHat.yml b/roles/wazuh/filebeat-oss/tasks/RedHat.yml
new file mode 100644
index 00000000..23948b37
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tasks/RedHat.yml
@@ -0,0 +1,9 @@
+---
+- name: RedHat/CentOS/Fedora/Amazon Linux | Install Filebeats repo
+  yum_repository:
+    name: elastic_repo_7
+    description: Elastic repository for 7.x packages
+    baseurl: "{{ elasticrepo.yum }}"
+    gpgkey: "{{ elasticrepo.gpg }}"
+    gpgcheck: true
+  changed_when: false
diff --git a/roles/wazuh/filebeat-oss/tasks/config.yml b/roles/wazuh/filebeat-oss/tasks/config.yml
new file mode 100644
index 00000000..d45b06e8
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tasks/config.yml
@@ -0,0 +1,39 @@
+---
+- name: Copy Filebeat configuration.
+  template:
+    src: filebeat.yml.j2
+    dest: "/etc/filebeat/filebeat.yml"
+    owner: root
+    group: root
+    mode: 0400
+  notify: restart filebeat
+  tags: configure
+
+- name: Copy Elasticsearch template.
+  template:
+    src: elasticsearch.yml.j2
+    dest: "/etc/filebeat/wazuh-template.json"
+    owner: root
+    group: root
+    mode: 0400
+  notify: restart filebeat
+  tags: configure
+
+- name: Ensure Filebeat SSL key pair directory exists.
+  file:
+    path: "{{ filebeat_ssl_dir }}"
+    state: directory
+  when: filebeat_ssl_key_file
+  tags: configure
+
+- name: Copy SSL key and cert for filebeat.
+  copy:
+    src: "{{ item }}"
+    dest: "{{ filebeat_ssl_dir }}/{{ item | basename }}"
+    mode: 0400
+  with_items:
+    - "{{ filebeat_ssl_key_file }}"
+    - "{{ filebeat_ssl_certificate_file }}"
+  notify: restart filebeat
+  when: filebeat_ssl_key_file and filebeat_ssl_certificate_file
+  tags: configure
diff --git a/roles/wazuh/filebeat-oss/tasks/main.yml b/roles/wazuh/filebeat-oss/tasks/main.yml
new file mode 100644
index 00000000..df3a428b
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tasks/main.yml
@@ -0,0 +1,125 @@
+---
+- include_tasks: RedHat.yml
+  when: ansible_os_family == 'RedHat'
+
+- include_tasks: Debian.yml
+  when: ansible_os_family == 'Debian'
+
+- name: CentOS/RedHat |  Install Filebeat.
+  package: name=filebeat-{{ filebeat_version }} state=present
+  register: filebeat_installing_package
+  until: filebeat_installing_package is succeeded
+  when:
+    - ansible_distribution in ['CentOS','RedHat', 'Amazon']
+  tags:
+    - install
+
+- name: Debian/Ubuntu | Install Filebeat.
+  apt:
+    name: filebeat={{ filebeat_version }}
+    state: present
+    cache_valid_time: 3600
+  register: filebeat_installing_package_debian
+  until: filebeat_installing_package_debian is succeeded
+  when:
+    - not (ansible_distribution in ['CentOS','RedHat', 'Amazon'])
+  tags:
+    - init
+
+- name: Copying node's certificate from master
+  copy:
+    src: "{{ item }}"
+    dest: "{{ node_certs_destination }}/"
+    mode: 0440
+  with_items:
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.key"
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.crt"
+    - "{{ master_certs_path }}/ca/ca.crt"
+  when:
+    - generate_CA
+    - filebeat_opendistro_security
+  tags: opendistro-security
+
+- name: Copying node's certificate from master (Custom CA)
+  copy:
+    src: "{{ item }}"
+    dest: "{{ node_certs_destination }}/"
+    mode: 0440
+  with_items:
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.key"
+    - "{{ master_certs_path }}/{{ filebeat_node_name }}/{{ filebeat_node_name }}.crt"
+    - "{{ master_certs_path }}/ca/{{ ca_cert_name }}"
+  when:
+    - not generate_CA
+    - filebeat_opendistro_security
+  tags: opendistro-security
+
+- name: Ensuring folder & certs permissions
+  file:
+    path: "{{ node_certs_destination }}/"
+    mode: 0774
+    state: directory
+    recurse: yes
+  when:
+    - filebeat_xpack_security
+  tags: xpack-security
+
+- name: Checking if Filebeat Module folder file exists
+  stat:
+    path: "{{ filebeat_module_folder }}"
+  register: filebeat_module_folder
+
+
+- name: Download Filebeat module package
+  get_url:
+    url: "{{ filebeat_module_package_url }}/{{ filebeat_module_package_name }}"
+    dest: "{{ filebeat_module_package_path }}"
+  when: not filebeat_module_folder.stat.exists
+
+- name: Unpakcing Filebeat module package
+  unarchive:
+    src: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
+    dest: "{{ filebeat_module_destination }}"
+    remote_src: yes
+  when: not filebeat_module_folder.stat.exists
+
+- name: Setting 0755 permission for Filebeat module folder
+  file: dest={{ filebeat_module_folder }} mode=u=rwX,g=rwX,o=rwX recurse=yes
+  when: not filebeat_module_folder.stat.exists
+
+- name: Checking if Filebeat Module package file exists
+  stat:
+    path: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
+  register: filebeat_module_package
+  when: filebeat_module_package is not defined
+
+- name: Delete Filebeat module package file
+  file:
+    state: absent
+    path: "{{ filebeat_module_package_path }}/{{ filebeat_module_package_name }}"
+  when: filebeat_module_package.stat.exists
+
+- import_tasks: config.yml
+  when: filebeat_create_config
+  notify: restart filebeat
+
+- name: Reload systemd
+  systemd: daemon_reload=yes
+  ignore_errors: true
+  when:
+    - not (ansible_distribution == "Amazon" and ansible_distribution_major_version == "NA")
+    - not (ansible_distribution == "Ubuntu" and ansible_distribution_version is version('15.04', '<'))
+    - not (ansible_distribution == "Debian" and ansible_distribution_version is version('8', '<'))
+    - not (ansible_os_family == "RedHat" and ansible_distribution_version is version('7', '<'))
+
+- name: Ensure Filebeat is started and enabled at boot.
+  service:
+    name: filebeat
+    state: started
+    enabled: true
+
+- include_tasks: "RMRedHat.yml"
+  when: ansible_os_family == "RedHat"
+
+- include_tasks: "RMDebian.yml"
+  when: ansible_os_family == "Debian"
diff --git a/roles/wazuh/filebeat-oss/tasks/security_actions.yml b/roles/wazuh/filebeat-oss/tasks/security_actions.yml
new file mode 100644
index 00000000..6b11bc9a
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tasks/security_actions.yml
@@ -0,0 +1,11 @@
+- block:
+
+  - name: Copy certificates and root-ca to Filebeat
+    copy:
+      src: "{{ local_certs_path }}/config/{{ item }}"
+      dest: /etc/filebeat/
+      mode: 0644
+    with_items:
+      - root-ca.pem
+      - "{{ inventory_hostname }}.key"
+      - "{{ inventory_hostname }}.pem"
\ No newline at end of file
diff --git a/roles/wazuh/filebeat-oss/templates/elasticsearch.yml.j2 b/roles/wazuh/filebeat-oss/templates/elasticsearch.yml.j2
new file mode 100644
index 00000000..88d50c3f
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/templates/elasticsearch.yml.j2
@@ -0,0 +1,1800 @@
+{
+  "order": 0,
+  "index_patterns": [
+    "wazuh-alerts-3.x-*",
+    "wazuh-archives-3.x-*"
+  ],
+  "settings": {
+    "index.refresh_interval": "5s",
+    "index.number_of_shards": "3",
+    "index.number_of_replicas": "0",
+    "index.auto_expand_replicas": "0-1",
+    "index.mapping.total_fields.limit": 10000,
+    "index.query.default_field": [
+      "GeoLocation.city_name",
+      "GeoLocation.continent_code",
+      "GeoLocation.country_code2",
+      "GeoLocation.country_code3",
+      "GeoLocation.country_name",
+      "GeoLocation.ip",
+      "GeoLocation.postal_code",
+      "GeoLocation.real_region_name",
+      "GeoLocation.region_name",
+      "GeoLocation.timezone",
+      "agent.id",
+      "agent.ip",
+      "agent.name",
+      "cluster.name",
+      "cluster.node",
+      "command",
+      "data",
+      "data.action",
+      "data.audit",
+      "data.audit.acct",
+      "data.audit.arch",
+      "data.audit.auid",
+      "data.audit.command",
+      "data.audit.cwd",
+      "data.audit.dev",
+      "data.audit.directory.inode",
+      "data.audit.directory.mode",
+      "data.audit.directory.name",
+      "data.audit.egid",
+      "data.audit.enforcing",
+      "data.audit.euid",
+      "data.audit.exe",
+      "data.audit.execve.a0",
+      "data.audit.execve.a1",
+      "data.audit.execve.a2",
+      "data.audit.execve.a3",
+      "data.audit.exit",
+      "data.audit.file.inode",
+      "data.audit.file.mode",
+      "data.audit.file.name",
+      "data.audit.fsgid",
+      "data.audit.fsuid",
+      "data.audit.gid",
+      "data.audit.id",
+      "data.audit.key",
+      "data.audit.list",
+      "data.audit.old-auid",
+      "data.audit.old-ses",
+      "data.audit.old_enforcing",
+      "data.audit.old_prom",
+      "data.audit.op",
+      "data.audit.pid",
+      "data.audit.ppid",
+      "data.audit.prom",
+      "data.audit.res",
+      "data.audit.session",
+      "data.audit.sgid",
+      "data.audit.srcip",
+      "data.audit.subj",
+      "data.audit.success",
+      "data.audit.suid",
+      "data.audit.syscall",
+      "data.audit.tty",
+      "data.audit.uid",
+      "data.aws.accountId",
+      "data.aws.account_id",
+      "data.aws.action",
+      "data.aws.actor",
+      "data.aws.aws_account_id",
+      "data.aws.description",
+      "data.aws.dstport",
+      "data.aws.errorCode",
+      "data.aws.errorMessage",
+      "data.aws.eventID",
+      "data.aws.eventName",
+      "data.aws.eventSource",
+      "data.aws.eventType",
+      "data.aws.id",
+      "data.aws.name",
+      "data.aws.requestParameters.accessKeyId",
+      "data.aws.requestParameters.bucketName",
+      "data.aws.requestParameters.gatewayId",
+      "data.aws.requestParameters.groupDescription",
+      "data.aws.requestParameters.groupId",
+      "data.aws.requestParameters.groupName",
+      "data.aws.requestParameters.host",
+      "data.aws.requestParameters.hostedZoneId",
+      "data.aws.requestParameters.instanceId",
+      "data.aws.requestParameters.instanceProfileName",
+      "data.aws.requestParameters.loadBalancerName",
+      "data.aws.requestParameters.loadBalancerPorts",
+      "data.aws.requestParameters.masterUserPassword",
+      "data.aws.requestParameters.masterUsername",
+      "data.aws.requestParameters.name",
+      "data.aws.requestParameters.natGatewayId",
+      "data.aws.requestParameters.networkAclId",
+      "data.aws.requestParameters.path",
+      "data.aws.requestParameters.policyName",
+      "data.aws.requestParameters.port",
+      "data.aws.requestParameters.stackId",
+      "data.aws.requestParameters.stackName",
+      "data.aws.requestParameters.subnetId",
+      "data.aws.requestParameters.subnetIds",
+      "data.aws.requestParameters.volumeId",
+      "data.aws.requestParameters.vpcId",
+      "data.aws.resource.accessKeyDetails.accessKeyId",
+      "data.aws.resource.accessKeyDetails.principalId",
+      "data.aws.resource.accessKeyDetails.userName",
+      "data.aws.resource.instanceDetails.instanceId",
+      "data.aws.resource.instanceDetails.instanceState",
+      "data.aws.resource.instanceDetails.networkInterfaces.privateDnsName",
+      "data.aws.resource.instanceDetails.networkInterfaces.publicDnsName",
+      "data.aws.resource.instanceDetails.networkInterfaces.subnetId",
+      "data.aws.resource.instanceDetails.networkInterfaces.vpcId",
+      "data.aws.resource.instanceDetails.tags.value",
+      "data.aws.responseElements.AssociateVpcCidrBlockResponse.vpcId",
+      "data.aws.responseElements.description",
+      "data.aws.responseElements.instanceId",
+      "data.aws.responseElements.instances.instanceId",
+      "data.aws.responseElements.instancesSet.items.instanceId",
+      "data.aws.responseElements.listeners.port",
+      "data.aws.responseElements.loadBalancerName",
+      "data.aws.responseElements.loadBalancers.vpcId",
+      "data.aws.responseElements.loginProfile.userName",
+      "data.aws.responseElements.networkAcl.vpcId",
+      "data.aws.responseElements.ownerId",
+      "data.aws.responseElements.publicIp",
+      "data.aws.responseElements.user.userId",
+      "data.aws.responseElements.user.userName",
+      "data.aws.responseElements.volumeId",
+      "data.aws.service.serviceName",
+      "data.aws.severity",
+      "data.aws.source",
+      "data.aws.sourceIPAddress",
+      "data.aws.srcport",
+      "data.aws.userIdentity.accessKeyId",
+      "data.aws.userIdentity.accountId",
+      "data.aws.userIdentity.userName",
+      "data.aws.vpcEndpointId",
+      "data.command",
+      "data.data",
+      "data.docker.Actor.Attributes.container",
+      "data.docker.Actor.Attributes.image",
+      "data.docker.Actor.Attributes.name",
+      "data.docker.Actor.ID",
+      "data.docker.id",
+      "data.docker.message",
+      "data.docker.status",
+      "data.dstip",
+      "data.dstport",
+      "data.dstuser",
+      "data.extra_data",
+      "data.hardware.serial",
+      "data.id",
+      "data.integration",
+      "data.netinfo.iface.adapter",
+      "data.netinfo.iface.ipv4.address",
+      "data.netinfo.iface.ipv6.address",
+      "data.netinfo.iface.mac",
+      "data.netinfo.iface.name",
+      "data.os.architecture",
+      "data.os.build",
+      "data.os.codename",
+      "data.os.hostname",
+      "data.os.major",
+      "data.os.minor",
+      "data.os.name",
+      "data.os.platform",
+      "data.os.release",
+      "data.os.release_version",
+      "data.os.sysname",
+      "data.os.version",
+      "data.oscap.check.description",
+      "data.oscap.check.id",
+      "data.oscap.check.identifiers",
+      "data.oscap.check.oval.id",
+      "data.oscap.check.rationale",
+      "data.oscap.check.references",
+      "data.oscap.check.result",
+      "data.oscap.check.severity",
+      "data.oscap.check.title",
+      "data.oscap.scan.benchmark.id",
+      "data.oscap.scan.content",
+      "data.oscap.scan.id",
+      "data.oscap.scan.profile.id",
+      "data.oscap.scan.profile.title",
+      "data.osquery.columns.address",
+      "data.osquery.columns.command",
+      "data.osquery.columns.description",
+      "data.osquery.columns.dst_ip",
+      "data.osquery.columns.gid",
+      "data.osquery.columns.hostname",
+      "data.osquery.columns.md5",
+      "data.osquery.columns.path",
+      "data.osquery.columns.sha1",
+      "data.osquery.columns.sha256",
+      "data.osquery.columns.src_ip",
+      "data.osquery.columns.user",
+      "data.osquery.columns.username",
+      "data.osquery.name",
+      "data.osquery.pack",
+      "data.port.process",
+      "data.port.protocol",
+      "data.port.state",
+      "data.process.args",
+      "data.process.cmd",
+      "data.process.egroup",
+      "data.process.euser",
+      "data.process.fgroup",
+      "data.process.name",
+      "data.process.rgroup",
+      "data.process.ruser",
+      "data.process.sgroup",
+      "data.process.state",
+      "data.process.suser",
+      "data.program.architecture",
+      "data.program.description",
+      "data.program.format",
+      "data.program.location",
+      "data.program.multiarch",
+      "data.program.name",
+      "data.program.priority",
+      "data.program.section",
+      "data.program.source",
+      "data.program.vendor",
+      "data.program.version",
+      "data.protocol",
+      "data.pwd",
+      "data.sca",
+      "data.sca.check.compliance.cis",
+      "data.sca.check.compliance.cis_csc",
+      "data.sca.check.compliance.pci_dss",
+      "data.sca.check.compliance.hipaa",
+      "data.sca.check.compliance.nist_800_53",
+      "data.sca.check.description",
+      "data.sca.check.directory",
+      "data.sca.check.file",
+      "data.sca.check.id",
+      "data.sca.check.previous_result",
+      "data.sca.check.process",
+      "data.sca.check.rationale",
+      "data.sca.check.reason",
+      "data.sca.check.references",
+      "data.sca.check.registry",
+      "data.sca.check.remediation",
+      "data.sca.check.result",
+      "data.sca.check.status",
+      "data.sca.check.title",
+      "data.sca.description",
+      "data.sca.file",
+      "data.sca.invalid",
+      "data.sca.name",
+      "data.sca.policy",
+      "data.sca.policy_id",
+      "data.sca.scan_id",
+      "data.sca.total_checks",
+      "data.script",
+      "data.src_ip",
+      "data.src_port",
+      "data.srcip",
+      "data.srcport",
+      "data.srcuser",
+      "data.status",
+      "data.system_name",
+      "data.title",
+      "data.tty",
+      "data.uid",
+      "data.url",
+      "data.virustotal.description",
+      "data.virustotal.error",
+      "data.virustotal.found",
+      "data.virustotal.permalink",
+      "data.virustotal.scan_date",
+      "data.virustotal.sha1",
+      "data.virustotal.source.alert_id",
+      "data.virustotal.source.file",
+      "data.virustotal.source.md5",
+      "data.virustotal.source.sha1",
+      "data.vulnerability.advisories",
+      "data.vulnerability.bugzilla_reference",
+      "data.vulnerability.cve",
+      "data.vulnerability.cvss.cvss2.base_score",
+      "data.vulnerability.cvss.cvss2.exploitability_score",
+      "data.vulnerability.cvss.cvss2.impact_score",
+      "data.vulnerability.cvss.cvss2.vector.access_complexity",
+      "data.vulnerability.cvss.cvss2.vector.attack_vector",
+      "data.vulnerability.cvss.cvss2.vector.authentication",
+      "data.vulnerability.cvss.cvss2.vector.availability",
+      "data.vulnerability.cvss.cvss2.vector.confidentiality_impact",
+      "data.vulnerability.cvss.cvss2.vector.integrity_impact",
+      "data.vulnerability.cvss.cvss2.vector.privileges_required",
+      "data.vulnerability.cvss.cvss2.vector.scope",
+      "data.vulnerability.cvss.cvss2.vector.user_interaction",
+      "data.vulnerability.cvss.cvss3.base_score",
+      "data.vulnerability.cvss.cvss3.exploitability_score",
+      "data.vulnerability.cvss.cvss3.impact_score",
+      "data.vulnerability.cvss.cvss3.vector.access_complexity",
+      "data.vulnerability.cvss.cvss3.vector.attack_vector",
+      "data.vulnerability.cvss.cvss3.vector.authentication",
+      "data.vulnerability.cvss.cvss3.vector.availability",
+      "data.vulnerability.cvss.cvss3.vector.confidentiality_impact",
+      "data.vulnerability.cvss.cvss3.vector.integrity_impact",
+      "data.vulnerability.cvss.cvss3.vector.privileges_required",
+      "data.vulnerability.cvss.cvss3.vector.scope",
+      "data.vulnerability.cvss.cvss3.vector.user_interaction",
+      "data.vulnerability.cwe_reference",
+      "data.vulnerability.package.architecture",
+      "data.vulnerability.package.condition",
+      "data.vulnerability.package.generated_cpe",
+      "data.vulnerability.package.name",
+      "data.vulnerability.package.version",
+      "data.vulnerability.rationale",
+      "data.vulnerability.reference",
+      "data.vulnerability.severity",
+      "data.vulnerability.state",
+      "data.vulnerability.title",
+      "data.win.eventdata.auditPolicyChanges",
+      "data.win.eventdata.auditPolicyChangesId",
+      "data.win.eventdata.binary",
+      "data.win.eventdata.category",
+      "data.win.eventdata.categoryId",
+      "data.win.eventdata.data",
+      "data.win.eventdata.image",
+      "data.win.eventdata.ipAddress",
+      "data.win.eventdata.ipPort",
+      "data.win.eventdata.keyName",
+      "data.win.eventdata.logonGuid",
+      "data.win.eventdata.logonProcessName",
+      "data.win.eventdata.operation",
+      "data.win.eventdata.parentImage",
+      "data.win.eventdata.processId",
+      "data.win.eventdata.processName",
+      "data.win.eventdata.providerName",
+      "data.win.eventdata.returnCode",
+      "data.win.eventdata.service",
+      "data.win.eventdata.status",
+      "data.win.eventdata.subcategory",
+      "data.win.eventdata.subcategoryGuid",
+      "data.win.eventdata.subcategoryId",
+      "data.win.eventdata.subjectDomainName",
+      "data.win.eventdata.subjectLogonId",
+      "data.win.eventdata.subjectUserName",
+      "data.win.eventdata.subjectUserSid",
+      "data.win.eventdata.targetDomainName",
+      "data.win.eventdata.targetLinkedLogonId",
+      "data.win.eventdata.targetLogonId",
+      "data.win.eventdata.targetUserName",
+      "data.win.eventdata.targetUserSid",
+      "data.win.eventdata.workstationName",
+      "data.win.system.channel",
+      "data.win.system.computer",
+      "data.win.system.eventID",
+      "data.win.system.eventRecordID",
+      "data.win.system.eventSourceName",
+      "data.win.system.keywords",
+      "data.win.system.level",
+      "data.win.system.message",
+      "data.win.system.opcode",
+      "data.win.system.processID",
+      "data.win.system.providerGuid",
+      "data.win.system.providerName",
+      "data.win.system.securityUserID",
+      "data.win.system.severityValue",
+      "data.win.system.userID",
+      "decoder.ftscomment",
+      "decoder.name",
+      "decoder.parent",
+      "full_log",
+      "host",
+      "id",
+      "input",
+      "location",
+      "manager.name",
+      "message",
+      "offset",
+      "predecoder.hostname",
+      "predecoder.program_name",
+      "previous_log",
+      "previous_output",
+      "program_name",
+      "rule.cis",
+      "rule.cve",
+      "rule.description",
+      "rule.gdpr",
+      "rule.gpg13",
+      "rule.groups",
+      "rule.id",
+      "rule.info",
+      "rule.pci_dss",
+      "rule.hipaa",
+      "rule.nist_800_53",
+      "syscheck.audit.effective_user.id",
+      "syscheck.audit.effective_user.name",
+      "syscheck.audit.group.id",
+      "syscheck.audit.group.name",
+      "syscheck.audit.login_user.id",
+      "syscheck.audit.login_user.name",
+      "syscheck.audit.process.id",
+      "syscheck.audit.process.name",
+      "syscheck.audit.process.ppid",
+      "syscheck.audit.user.id",
+      "syscheck.audit.user.name",
+      "syscheck.diff",
+      "syscheck.event",
+      "syscheck.gid_after",
+      "syscheck.gid_before",
+      "syscheck.gname_after",
+      "syscheck.gname_before",
+      "syscheck.inode_after",
+      "syscheck.inode_before",
+      "syscheck.md5_after",
+      "syscheck.md5_before",
+      "syscheck.path",
+      "syscheck.perm_after",
+      "syscheck.perm_before",
+      "syscheck.sha1_after",
+      "syscheck.sha1_before",
+      "syscheck.sha256_after",
+      "syscheck.sha256_before",
+      "syscheck.tags",
+      "syscheck.uid_after",
+      "syscheck.uid_before",
+      "syscheck.uname_after",
+      "syscheck.uname_before",
+      "title",
+      "type"
+    ]
+  },
+  "mappings": {
+    "dynamic_templates": [
+      {
+        "string_as_keyword": {
+          "mapping": {
+            "type": "keyword"
+          },
+          "match_mapping_type": "string"
+        }
+      }
+    ],
+    "date_detection": false,
+    "properties": {
+      "@timestamp": {
+        "type": "date"
+      },
+      "timestamp": {
+        "type": "date",
+        "format": "date_optional_time||epoch_millis"
+      },
+      "@version": {
+        "type": "text"
+      },
+      "agent": {
+        "properties": {
+          "ip": {
+            "type": "keyword"
+          },
+          "id": {
+            "type": "keyword"
+          },
+          "name": {
+            "type": "keyword"
+          }
+        }
+      },
+      "manager": {
+        "properties": {
+          "name": {
+            "type": "keyword"
+          }
+        }
+      },
+      "cluster": {
+        "properties": {
+          "name": {
+            "type": "keyword"
+          },
+          "node": {
+            "type": "keyword"
+          }
+        }
+      },
+      "full_log": {
+        "type": "text"
+      },
+      "previous_log": {
+        "type": "text"
+      },
+      "GeoLocation": {
+        "properties": {
+          "area_code": {
+            "type": "long"
+          },
+          "city_name": {
+            "type": "keyword"
+          },
+          "continent_code": {
+            "type": "text"
+          },
+          "coordinates": {
+            "type": "double"
+          },
+          "country_code2": {
+            "type": "text"
+          },
+          "country_code3": {
+            "type": "text"
+          },
+          "country_name": {
+            "type": "keyword"
+          },
+          "dma_code": {
+            "type": "long"
+          },
+          "ip": {
+            "type": "keyword"
+          },
+          "latitude": {
+            "type": "double"
+          },
+          "location": {
+            "type": "geo_point"
+          },
+          "longitude": {
+            "type": "double"
+          },
+          "postal_code": {
+            "type": "keyword"
+          },
+          "real_region_name": {
+            "type": "keyword"
+          },
+          "region_name": {
+            "type": "keyword"
+          },
+          "timezone": {
+            "type": "text"
+          }
+        }
+      },
+      "host": {
+        "type": "keyword"
+      },
+      "syscheck": {
+        "properties": {
+          "path": {
+            "type": "keyword"
+          },
+          "sha1_before": {
+            "type": "keyword"
+          },
+          "sha1_after": {
+            "type": "keyword"
+          },
+          "uid_before": {
+            "type": "keyword"
+          },
+          "uid_after": {
+            "type": "keyword"
+          },
+          "gid_before": {
+            "type": "keyword"
+          },
+          "gid_after": {
+            "type": "keyword"
+          },
+          "perm_before": {
+            "type": "keyword"
+          },
+          "perm_after": {
+            "type": "keyword"
+          },
+          "md5_after": {
+            "type": "keyword"
+          },
+          "md5_before": {
+            "type": "keyword"
+          },
+          "gname_after": {
+            "type": "keyword"
+          },
+          "gname_before": {
+            "type": "keyword"
+          },
+          "inode_after": {
+            "type": "keyword"
+          },
+          "inode_before": {
+            "type": "keyword"
+          },
+          "mtime_after": {
+            "type": "date",
+            "format": "date_optional_time"
+          },
+          "mtime_before": {
+            "type": "date",
+            "format": "date_optional_time"
+          },
+          "uname_after": {
+            "type": "keyword"
+          },
+          "uname_before": {
+            "type": "keyword"
+          },
+          "size_before": {
+            "type": "long"
+          },
+          "size_after": {
+            "type": "long"
+          },
+          "diff": {
+            "type": "keyword"
+          },
+          "event": {
+            "type": "keyword"
+          },
+          "audit": {
+            "properties": {
+              "effective_user": {
+                "properties": {
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "group": {
+                "properties": {
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "login_user": {
+                "properties": {
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "process": {
+                "properties": {
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  },
+                  "ppid": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "user": {
+                "properties": {
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  }
+                }
+              }
+            }
+          },
+          "sha256_after": {
+            "type": "keyword"
+          },
+          "sha256_before": {
+            "type": "keyword"
+          },
+          "tags": {
+            "type": "keyword"
+          }
+        }
+      },
+      "location": {
+        "type": "keyword"
+      },
+      "message": {
+        "type": "text"
+      },
+      "offset": {
+        "type": "keyword"
+      },
+      "rule": {
+        "properties": {
+          "description": {
+            "type": "keyword"
+          },
+          "groups": {
+            "type": "keyword"
+          },
+          "level": {
+            "type": "long"
+          },
+          "id": {
+            "type": "keyword"
+          },
+          "cve": {
+            "type": "keyword"
+          },
+          "info": {
+            "type": "keyword"
+          },
+          "frequency": {
+            "type": "long"
+          },
+          "firedtimes": {
+            "type": "long"
+          },
+          "cis": {
+            "type": "keyword"
+          },
+          "pci_dss": {
+            "type": "keyword"
+          },
+          "gdpr": {
+            "type": "keyword"
+          },
+          "gpg13": {
+            "type": "keyword"
+          },
+          "hipaa": {
+            "type": "keyword"
+          },
+          "nist_800_53": {
+            "type": "keyword"
+          },
+          "mail": {
+            "type": "boolean"
+          }
+        }
+      },
+      "predecoder": {
+        "properties": {
+          "program_name": {
+            "type": "keyword"
+          },
+          "timestamp": {
+            "type": "keyword"
+          },
+          "hostname": {
+            "type": "keyword"
+          }
+        }
+      },
+      "decoder": {
+        "properties": {
+          "parent": {
+            "type": "keyword"
+          },
+          "name": {
+            "type": "keyword"
+          },
+          "ftscomment": {
+            "type": "keyword"
+          },
+          "fts": {
+            "type": "long"
+          },
+          "accumulate": {
+            "type": "long"
+          }
+        }
+      },
+      "data": {
+        "properties": {
+          "audit": {
+            "properties": {
+              "acct": {
+                "type": "keyword"
+              },
+              "arch": {
+                "type": "keyword"
+              },
+              "auid": {
+                "type": "keyword"
+              },
+              "command": {
+                "type": "keyword"
+              },
+              "cwd": {
+                "type": "keyword"
+              },
+              "dev": {
+                "type": "keyword"
+              },
+              "directory": {
+                "properties": {
+                  "inode": {
+                    "type": "keyword"
+                  },
+                  "mode": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "egid": {
+                "type": "keyword"
+              },
+              "enforcing": {
+                "type": "keyword"
+              },
+              "euid": {
+                "type": "keyword"
+              },
+              "exe": {
+                "type": "keyword"
+              },
+              "execve": {
+                "properties": {
+                  "a0": {
+                    "type": "keyword"
+                  },
+                  "a1": {
+                    "type": "keyword"
+                  },
+                  "a2": {
+                    "type": "keyword"
+                  },
+                  "a3": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "exit": {
+                "type": "keyword"
+              },
+              "file": {
+                "properties": {
+                  "inode": {
+                    "type": "keyword"
+                  },
+                  "mode": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "fsgid": {
+                "type": "keyword"
+              },
+              "fsuid": {
+                "type": "keyword"
+              },
+              "gid": {
+                "type": "keyword"
+              },
+              "id": {
+                "type": "keyword"
+              },
+              "key": {
+                "type": "keyword"
+              },
+              "list": {
+                "type": "keyword"
+              },
+              "old-auid": {
+                "type": "keyword"
+              },
+              "old-ses": {
+                "type": "keyword"
+              },
+              "old_enforcing": {
+                "type": "keyword"
+              },
+              "old_prom": {
+                "type": "keyword"
+              },
+              "op": {
+                "type": "keyword"
+              },
+              "pid": {
+                "type": "keyword"
+              },
+              "ppid": {
+                "type": "keyword"
+              },
+              "prom": {
+                "type": "keyword"
+              },
+              "res": {
+                "type": "keyword"
+              },
+              "session": {
+                "type": "keyword"
+              },
+              "sgid": {
+                "type": "keyword"
+              },
+              "srcip": {
+                "type": "keyword"
+              },
+              "subj": {
+                "type": "keyword"
+              },
+              "success": {
+                "type": "keyword"
+              },
+              "suid": {
+                "type": "keyword"
+              },
+              "syscall": {
+                "type": "keyword"
+              },
+              "tty": {
+                "type": "keyword"
+              },
+              "type": {
+                "type": "keyword"
+              },
+              "uid": {
+                "type": "keyword"
+              }
+            }
+          },
+          "protocol": {
+            "type": "keyword"
+          },
+          "action": {
+            "type": "keyword"
+          },
+          "srcip": {
+            "type": "keyword"
+          },
+          "dstip": {
+            "type": "keyword"
+          },
+          "srcport": {
+            "type": "keyword"
+          },
+          "dstport": {
+            "type": "keyword"
+          },
+          "srcuser": {
+            "type": "keyword"
+          },
+          "dstuser": {
+            "type": "keyword"
+          },
+          "id": {
+            "type": "keyword"
+          },
+          "status": {
+            "type": "keyword"
+          },
+          "data": {
+            "type": "keyword"
+          },
+          "extra_data": {
+            "type": "keyword"
+          },
+          "system_name": {
+            "type": "keyword"
+          },
+          "url": {
+            "type": "keyword"
+          },
+          "oscap": {
+            "properties": {
+              "check": {
+                "properties": {
+                  "description": {
+                    "type": "text"
+                  },
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "identifiers": {
+                    "type": "text"
+                  },
+                  "oval": {
+                    "properties": {
+                      "id": {
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "rationale": {
+                    "type": "text"
+                  },
+                  "references": {
+                    "type": "text"
+                  },
+                  "result": {
+                    "type": "keyword"
+                  },
+                  "severity": {
+                    "type": "keyword"
+                  },
+                  "title": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "scan": {
+                "properties": {
+                  "benchmark": {
+                    "properties": {
+                      "id": {
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "content": {
+                    "type": "keyword"
+                  },
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "profile": {
+                    "properties": {
+                      "id": {
+                        "type": "keyword"
+                      },
+                      "title": {
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "return_code": {
+                    "type": "long"
+                  },
+                  "score": {
+                    "type": "double"
+                  }
+                }
+              }
+            }
+          },
+          "type": {
+            "type": "keyword"
+          },
+          "netinfo": {
+            "properties": {
+              "iface": {
+                "properties": {
+                  "name": {
+                    "type": "keyword"
+                  },
+                  "mac": {
+                    "type": "keyword"
+                  },
+                  "adapter": {
+                    "type": "keyword"
+                  },
+                  "type": {
+                    "type": "keyword"
+                  },
+                  "state": {
+                    "type": "keyword"
+                  },
+                  "mtu": {
+                    "type": "long"
+                  },
+                  "tx_bytes": {
+                    "type": "long"
+                  },
+                  "rx_bytes": {
+                    "type": "long"
+                  },
+                  "tx_errors": {
+                    "type": "long"
+                  },
+                  "rx_errors": {
+                    "type": "long"
+                  },
+                  "tx_dropped": {
+                    "type": "long"
+                  },
+                  "rx_dropped": {
+                    "type": "long"
+                  },
+                  "tx_packets": {
+                    "type": "long"
+                  },
+                  "rx_packets": {
+                    "type": "long"
+                  },
+                  "ipv4": {
+                    "properties": {
+                      "gateway": {
+                        "type": "keyword"
+                      },
+                      "dhcp": {
+                        "type": "keyword"
+                      },
+                      "address": {
+                        "type": "keyword"
+                      },
+                      "netmask": {
+                        "type": "keyword"
+                      },
+                      "broadcast": {
+                        "type": "keyword"
+                      },
+                      "metric": {
+                        "type": "long"
+                      }
+                    }
+                  },
+                  "ipv6": {
+                    "properties": {
+                      "gateway": {
+                        "type": "keyword"
+                      },
+                      "dhcp": {
+                        "type": "keyword"
+                      },
+                      "address": {
+                        "type": "keyword"
+                      },
+                      "netmask": {
+                        "type": "keyword"
+                      },
+                      "broadcast": {
+                        "type": "keyword"
+                      },
+                      "metric": {
+                        "type": "long"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "os": {
+            "properties": {
+              "hostname": {
+                "type": "keyword"
+              },
+              "architecture": {
+                "type": "keyword"
+              },
+              "name": {
+                "type": "keyword"
+              },
+              "version": {
+                "type": "keyword"
+              },
+              "codename": {
+                "type": "keyword"
+              },
+              "major": {
+                "type": "keyword"
+              },
+              "minor": {
+                "type": "keyword"
+              },
+              "build": {
+                "type": "keyword"
+              },
+              "platform": {
+                "type": "keyword"
+              },
+              "sysname": {
+                "type": "keyword"
+              },
+              "release": {
+                "type": "keyword"
+              },
+              "release_version": {
+                "type": "keyword"
+              }
+            }
+          },
+          "port": {
+            "properties": {
+              "protocol": {
+                "type": "keyword"
+              },
+              "local_ip": {
+                "type": "ip"
+              },
+              "local_port": {
+                "type": "long"
+              },
+              "remote_ip": {
+                "type": "ip"
+              },
+              "remote_port": {
+                "type": "long"
+              },
+              "tx_queue": {
+                "type": "long"
+              },
+              "rx_queue": {
+                "type": "long"
+              },
+              "inode": {
+                "type": "long"
+              },
+              "state": {
+                "type": "keyword"
+              },
+              "pid": {
+                "type": "long"
+              },
+              "process": {
+                "type": "keyword"
+              }
+            }
+          },
+          "hardware": {
+            "properties": {
+              "serial": {
+                "type": "keyword"
+              },
+              "cpu_name": {
+                "type": "keyword"
+              },
+              "cpu_cores": {
+                "type": "long"
+              },
+              "cpu_mhz": {
+                "type": "double"
+              },
+              "ram_total": {
+                "type": "long"
+              },
+              "ram_free": {
+                "type": "long"
+              },
+              "ram_usage": {
+                "type": "long"
+              }
+            }
+          },
+          "program": {
+            "properties": {
+              "format": {
+                "type": "keyword"
+              },
+              "name": {
+                "type": "keyword"
+              },
+              "priority": {
+                "type": "keyword"
+              },
+              "section": {
+                "type": "keyword"
+              },
+              "size": {
+                "type": "long"
+              },
+              "vendor": {
+                "type": "keyword"
+              },
+              "install_time": {
+                "type": "keyword"
+              },
+              "version": {
+                "type": "keyword"
+              },
+              "architecture": {
+                "type": "keyword"
+              },
+              "multiarch": {
+                "type": "keyword"
+              },
+              "source": {
+                "type": "keyword"
+              },
+              "description": {
+                "type": "keyword"
+              },
+              "location": {
+                "type": "keyword"
+              }
+            }
+          },
+          "process": {
+            "properties": {
+              "pid": {
+                "type": "long"
+              },
+              "name": {
+                "type": "keyword"
+              },
+              "state": {
+                "type": "keyword"
+              },
+              "ppid": {
+                "type": "long"
+              },
+              "utime": {
+                "type": "long"
+              },
+              "stime": {
+                "type": "long"
+              },
+              "cmd": {
+                "type": "keyword"
+              },
+              "args": {
+                "type": "keyword"
+              },
+              "euser": {
+                "type": "keyword"
+              },
+              "ruser": {
+                "type": "keyword"
+              },
+              "suser": {
+                "type": "keyword"
+              },
+              "egroup": {
+                "type": "keyword"
+              },
+              "sgroup": {
+                "type": "keyword"
+              },
+              "fgroup": {
+                "type": "keyword"
+              },
+              "rgroup": {
+                "type": "keyword"
+              },
+              "priority": {
+                "type": "long"
+              },
+              "nice": {
+                "type": "long"
+              },
+              "size": {
+                "type": "long"
+              },
+              "vm_size": {
+                "type": "long"
+              },
+              "resident": {
+                "type": "long"
+              },
+              "share": {
+                "type": "long"
+              },
+              "start_time": {
+                "type": "long"
+              },
+              "pgrp": {
+                "type": "long"
+              },
+              "session": {
+                "type": "long"
+              },
+              "nlwp": {
+                "type": "long"
+              },
+              "tgid": {
+                "type": "long"
+              },
+              "tty": {
+                "type": "long"
+              },
+              "processor": {
+                "type": "long"
+              }
+            }
+          },
+          "sca": {
+            "properties": {
+              "type": {
+                "type": "keyword"
+              },
+              "scan_id": {
+                "type": "keyword"
+              },
+              "policy": {
+                "type": "keyword"
+              },
+              "name": {
+                "type": "keyword"
+              },
+              "file": {
+                "type": "keyword"
+              },
+              "description": {
+                "type": "keyword"
+              },
+              "passed": {
+                "type": "integer"
+              },
+              "failed": {
+                "type": "integer"
+              },
+              "score": {
+                "type": "long"
+              },
+              "check": {
+                "properties": {
+                  "id": {
+                    "type": "keyword"
+                  },
+                  "title": {
+                    "type": "keyword"
+                  },
+                  "description": {
+                    "type": "keyword"
+                  },
+                  "rationale": {
+                    "type": "keyword"
+                  },
+                  "remediation": {
+                    "type": "keyword"
+                  },
+                  "compliance": {
+                    "properties": {
+                      "cis": {
+                        "type": "keyword"
+                      },
+                      "cis_csc": {
+                        "type": "keyword"
+                      },
+                      "pci_dss": {
+                        "type": "keyword"
+                      },
+                      "hipaa": {
+                        "type": "keyword"
+                      },
+                      "nist_800_53": {
+                        "type": "keyword"
+                      }
+                    }
+                  },
+                  "references": {
+                    "type": "keyword"
+                  },
+                  "file": {
+                    "type": "keyword"
+                  },
+                  "directory": {
+                    "type": "keyword"
+                  },
+                  "registry": {
+                    "type": "keyword"
+                  },
+                  "process": {
+                    "type": "keyword"
+                  },
+                  "result": {
+                    "type": "keyword"
+                  },
+                  "previous_result": {
+                    "type": "keyword"
+                  },
+                  "reason": {
+                    "type": "keyword"
+                  },
+                  "status": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "invalid": {
+                "type": "keyword"
+              },
+              "policy_id": {
+                "type": "keyword"
+              },
+              "total_checks": {
+                "type": "keyword"
+              }
+            }
+          },
+          "command": {
+            "type": "keyword"
+          },
+          "integration": {
+            "type": "keyword"
+          },
+          "timestamp": {
+            "type": "date"
+          },
+          "title": {
+            "type": "keyword"
+          },
+          "uid": {
+            "type": "keyword"
+          },
+          "virustotal": {
+            "properties": {
+              "description": {
+                "type": "keyword"
+              },
+              "error": {
+                "type": "keyword"
+              },
+              "found": {
+                "type": "keyword"
+              },
+              "malicious": {
+                "type": "keyword"
+              },
+              "permalink": {
+                "type": "keyword"
+              },
+              "positives": {
+                "type": "keyword"
+              },
+              "scan_date": {
+                "type": "keyword"
+              },
+              "sha1": {
+                "type": "keyword"
+              },
+              "source": {
+                "properties": {
+                  "alert_id": {
+                    "type": "keyword"
+                  },
+                  "file": {
+                    "type": "keyword"
+                  },
+                  "md5": {
+                    "type": "keyword"
+                  },
+                  "sha1": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "total": {
+                "type": "keyword"
+              }
+            }
+          },
+          "vulnerability": {
+            "properties": {
+              "advisories": {
+                "type": "keyword"
+              },
+              "bugzilla_reference": {
+                "type": "keyword"
+              },
+              "cve": {
+                "type": "keyword"
+              },
+              "cvss": {
+                "properties": {
+                  "cvss2": {
+                    "properties": {
+                      "base_score": {
+                        "type": "keyword"
+                      },
+                      "exploitability_score": {
+                        "type": "keyword"
+                      },
+                      "impact_score": {
+                        "type": "keyword"
+                      },
+                      "vector": {
+                        "properties": {
+                          "access_complexity": {
+                            "type": "keyword"
+                          },
+                          "attack_vector": {
+                            "type": "keyword"
+                          },
+                          "authentication": {
+                            "type": "keyword"
+                          },
+                          "availability": {
+                            "type": "keyword"
+                          },
+                          "confidentiality_impact": {
+                            "type": "keyword"
+                          },
+                          "integrity_impact": {
+                            "type": "keyword"
+                          },
+                          "privileges_required": {
+                            "type": "keyword"
+                          },
+                          "scope": {
+                            "type": "keyword"
+                          },
+                          "user_interaction": {
+                            "type": "keyword"
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "cvss3": {
+                    "properties": {
+                      "base_score": {
+                        "type": "keyword"
+                      },
+                      "exploitability_score": {
+                        "type": "keyword"
+                      },
+                      "impact_score": {
+                        "type": "keyword"
+                      },
+                      "vector": {
+                        "properties": {
+                          "access_complexity": {
+                            "type": "keyword"
+                          },
+                          "attack_vector": {
+                            "type": "keyword"
+                          },
+                          "authentication": {
+                            "type": "keyword"
+                          },
+                          "availability": {
+                            "type": "keyword"
+                          },
+                          "confidentiality_impact": {
+                            "type": "keyword"
+                          },
+                          "integrity_impact": {
+                            "type": "keyword"
+                          },
+                          "privileges_required": {
+                            "type": "keyword"
+                          },
+                          "scope": {
+                            "type": "keyword"
+                          },
+                          "user_interaction": {
+                            "type": "keyword"
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "cwe_reference": {
+                "type": "keyword"
+              },
+              "package": {
+                "properties": {
+                  "architecture": {
+                    "type": "keyword"
+                  },
+                  "condition": {
+                    "type": "keyword"
+                  },
+                  "generated_cpe": {
+                    "type": "keyword"
+                  },
+                  "name": {
+                    "type": "keyword"
+                  },
+                  "version": {
+                    "type": "keyword"
+                  }
+                }
+              },
+              "published": {
+                "type": "date"
+              },
+              "updated": {
+                "type": "date"
+              },
+              "rationale": {
+                "type": "keyword"
+              },
+              "reference": {
+                "type": "keyword"
+              },
+              "severity": {
+                "type": "keyword"
+              },
+              "state": {
+                "type": "keyword"
+              },
+              "title": {
+                "type": "keyword"
+              }
+            }
+          },
+          "aws": {
+            "properties": {
+              "bytes": {
+                "type": "long"
+              },
+              "dstaddr": {
+                "type": "ip"
+              },
+              "srcaddr": {
+                "type": "ip"
+              },
+              "end": {
+                "type": "date"
+              },
+              "start": {
+                "type": "date"
+              },
+              "source_ip_address": {
+                "type": "ip"
+              },
+              "service": {
+                "properties": {
+                  "count": {
+                    "type": "long"
+                  },
+                  "action.networkConnectionAction.remoteIpDetails": {
+                    "properties": {
+                      "ipAddressV4": {
+                        "type": "ip"
+                      },
+                      "geoLocation": {
+                        "type": "geo_point"
+                      }
+                    }
+                  },
+                  "eventFirstSeen": {
+                    "type": "date"
+                  },
+                  "eventLastSeen": {
+                    "type": "date"
+                  }
+                }
+              },
+              "createdAt": {
+                "type": "date"
+              },
+              "updatedAt": {
+                "type": "date"
+              },
+              "resource.instanceDetails": {
+                "properties": {
+                  "launchTime": {
+                    "type": "date"
+                  },
+                  "networkInterfaces": {
+                    "properties": {
+                      "privateIpAddress": {
+                        "type": "ip"
+                      },
+                      "publicIp": {
+                        "type": "ip"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "program_name": {
+        "type": "keyword"
+      },
+      "command": {
+        "type": "keyword"
+      },
+      "type": {
+        "type": "text"
+      },
+      "title": {
+        "type": "keyword"
+      },
+      "id": {
+        "type": "keyword"
+      },
+      "input": {
+        "properties": {
+          "type": {
+            "type": "keyword"
+          }
+        }
+      },
+      "previous_output": {
+        "type": "keyword"
+      }
+    }
+  },
+  "version": 1
+}
diff --git a/roles/wazuh/filebeat-oss/templates/filebeat.yml.j2 b/roles/wazuh/filebeat-oss/templates/filebeat.yml.j2
new file mode 100644
index 00000000..747d2da6
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/templates/filebeat.yml.j2
@@ -0,0 +1,39 @@
+# Wazuh - Filebeat configuration file
+
+# Wazuh - Filebeat configuration file
+filebeat.modules:
+  - module: wazuh
+    alerts:
+      enabled: true
+    archives:
+      enabled: false
+
+setup.template.json.enabled: true
+setup.template.json.path: '/etc/filebeat/wazuh-template.json'
+setup.template.json.name: 'wazuh'
+setup.template.overwrite: true
+setup.ilm.enabled: false
+
+
+# Send events directly to Elasticsearch
+output.elasticsearch:
+  hosts: {{ filebeat_output_elasticsearch_hosts | to_json }}
+
+{% if filebeat_opendistro_security %}
+  username: {{ elasticsearch_opendistro_security_user }}
+  password: {{ elasticsearch_opendistro_security_password }}
+  protocol: https
+{% if generate_CA == true %}
+  ssl.certificate_authorities: 
+    - {{node_certs_destination}}/ca.crt
+{% elif generate_CA == false %}
+  ssl.certificate_authorities:
+    - {{node_certs_destination}}/{{ca_cert_name}}
+{% endif %}
+
+  ssl.certificate: "{{node_certs_destination}}/{{ filebeat_node_name }}.crt" 
+  ssl.key: "{{node_certs_destination}}/{{ filebeat_node_name }}.key"
+{% endif %}
+
+# Optional. Send events to Logstash instead of Elasticsearch
+#output.logstash.hosts: ["YOUR_LOGSTASH_SERVER_IP:5000"]
\ No newline at end of file
diff --git a/roles/wazuh/filebeat-oss/tests/requirements.yml b/roles/wazuh/filebeat-oss/tests/requirements.yml
new file mode 100644
index 00000000..63d857e2
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tests/requirements.yml
@@ -0,0 +1,3 @@
+---
+- src: geerlingguy.java
+- src: geerlingguy.elasticsearch
diff --git a/roles/wazuh/filebeat-oss/tests/test.yml b/roles/wazuh/filebeat-oss/tests/test.yml
new file mode 100644
index 00000000..3a4c8f21
--- /dev/null
+++ b/roles/wazuh/filebeat-oss/tests/test.yml
@@ -0,0 +1,20 @@
+---
+- hosts: all
+
+  pre_tasks:
+    - name: Update apt cache.
+      apt:
+        cache_valid_time: 600
+      when: ansible_os_family == 'Debian'
+
+    - name: Install test dependencies (RedHat).
+      package: name=which state=present
+      when: ansible_os_family == 'RedHat'
+
+    - name: Install test dependencies.
+      package: name=curl state=present
+
+  roles:
+    - geerlingguy.java
+    - geerlingguy.elasticsearch
+    - role_under_test