mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-21 00:13:06 +01:00
Update Zeek and Strelka
This commit is contained in:
@@ -9,11 +9,12 @@
|
||||
|
||||
|
||||
output {
|
||||
if "osquery" in [tags] {
|
||||
if [module] =~ "osquery" {
|
||||
elasticsearch {
|
||||
pipeline => "%{module}.%{dataset}"
|
||||
hosts => "{{ ES }}"
|
||||
index => "so-osquery-%{+YYYY.MM.dd}"
|
||||
template => "/so-common-template.json"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user