Merge pull request #6822 from Security-Onion-Solutions/fix/event_fields

Add event.acknowledged and event.escalated mappings
2025-12-27 19:33:14 +01:00 · 2022-01-10 16:14:45 -05:00
parent b7a90a88f9 84f7c6b13b
commit 17509a9231
1 changed files with 16 additions and 0 deletions
--- a/salt/elasticsearch/templates/so/so-common-template.json.jinja
+++ b/salt/elasticsearch/templates/so/so-common-template.json.jinja
@@ -291,6 +291,14 @@
        },
        "event": {
          "properties": {
+	    "acknowledged": {
+              "type": "boolean",
+	      "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              }
+            },
            "action": {
              "ignore_above": 1024,
              "type": "keyword"
@@ -331,6 +339,14 @@
            "end": {
              "type": "date"
            },
+	    "escalated": {
+              "type": "boolean",
+	      "fields": {
+                "keyword": {
+                  "type": "keyword"
+                }
+              }
+            },
            "hash": {
              "ignore_above": 1024,
              "type": "keyword"