[Bug] MAC Addresses Using : Separators Instead of -

[MakoWish]

While working on an Integration for Elastic Agent, I noticed there are some discrepancies between the use of : or - separators for MAC addresses throughout some Elastic products. According to ECS Host Fields, the standard should be -, but as of 8.6.2, Elastic Endpoint is still using : separators for MAC addresses.

[bjmcnic]

Thanks for identifying this issue. We will bring Elastic Defend into conformance with ECS (i.e. switch to the - separator) in an upcoming release.