From 550b3ee92d02d4d6ce6bb11610532b68fb02089c Mon Sep 17 00:00:00 2001
From: DefensiveDepth <Josh@defensivedepth.com>
Date: Fri, 24 May 2024 14:46:24 -0400
Subject: [PATCH] Add IDH mappings

---
 salt/soc/files/soc/sigma_so_pipeline.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/salt/soc/files/soc/sigma_so_pipeline.yaml b/salt/soc/files/soc/sigma_so_pipeline.yaml
index 312d07965..8314361f5 100644
--- a/salt/soc/files/soc/sigma_so_pipeline.yaml
+++ b/salt/soc/files/soc/sigma_so_pipeline.yaml
@@ -17,6 +17,16 @@ transformations:
         dst_ip: destination.ip.keyword
         dst_port: destination.port
         winlog.event_data.User: user.name
+        logtype: event.code # OpenCanary
+    # Maps "opencanary" product to SO IDH logs
+    - id: opencanary_idh_add-fields
+      type: add_condition
+      conditions:
+        event.module: 'opencanary'
+        event.dataset: 'opencanary.idh'
+      rule_conditions:
+      - type: logsource
+        product: opencanary
     # Maps "antivirus" category to Windows Defender logs shipped by Elastic Agent Winlog Integration
     # winlog.event_data.threat_name has to be renamed prior to ingestion, it is originally winlog.event_data.Threat Name
     - id: antivirus_field-mappings_windows-defender
@@ -88,3 +98,11 @@ transformations:
       - type: logsource
         product: linux
         service: auth
+    # event.code should always be a string
+    - id: convert_event_code_to_string
+      type: convert_type
+      target_type: 'str'
+      field_name_conditions:
+        - type: include_fields
+          fields:
+          - event.code