I am seeing this failure while testing pipeline of integration:
[0] parsing field value failed: field "event.category"'s value "vulnerability" is not one of the allowed values (authentication, configuration, database, driver, file, host, iam, intrusion_detection, malware, network, package, process, registry, session, threat, web)
When ECS states the following:
event.category/keyword
Description: This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
event.category represents the "big buckets" of ECS categories. For example, filtering on event.category:process yields all events relating to process activity. This field is closely related to event.type, which is used as a subcategory.
This field is an array. This will allow proper categorization of some events that fall in multiple categories.
type: keyword
Note: this field should contain an array of values.
Important: The field value must be one of the following:
api, authentication, configuration, database, driver, email, file, host, iam, intrusion_detection, library, malware, network, package, process, registry, session, threat, vulnerability, web
To learn more about when to use which value, visit the page allowed values for event.category