CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Map user name to keyword and remove security subfield generation

Browse Source
This commit is contained in:
Wes
2023-07-18 14:46:47 +00:00
parent 6816d06710
commit 1d3e39b6bd
3 changed files with 6 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
salt/elasticsearch/templates/component/ecs/user.json
View File

@@ -48,6 +48,10 @@
"properties": { "properties": {
"user": { "user": {
"properties": { "properties": {
"name": {
"ignore_above": 1024,
"type": "keyword"
},
"changes": { "changes": {
"properties": { "properties": {
"domain": { "domain": {
@@ -348,16 +352,6 @@
} }
} }
}, },
"name": {
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
},
"ignore_above": 1024,
"type": "keyword"
},
"roles": { "roles": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",
@@ -454,16 +448,6 @@
} }
} }
}, },
"name": {
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
}
},
"ignore_above": 1024,
"type": "keyword"
},
"roles": { "roles": {
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword", "type": "keyword",

10
salt/elasticsearch/templates/component/so/common-dynamic-mappings.json
View File

@@ -75,17 +75,7 @@
{ {
"strings": { "strings": {
"mapping": { "mapping": {
"type": "text",
"fields": {
"security": {
"analyzer": "es_security_analyzer",
"type": "text"
},
"keyword": {
"ignore_above": 32765,
"type": "keyword" "type": "keyword"
}
}
}, },
"match_mapping_type": "string" "match_mapping_type": "string"
} }

9
salt/elasticsearch/templates/component/so/dtc-user-mappings.json
View File

@@ -49,15 +49,6 @@
"user": { "user": {
"properties": { "properties": {
"name": { "name": {
"fields": {
"security": {
"type": "text",
"analyzer": "es_security_analyzer"
},
"keyword": {
"type": "keyword"
}
},
"ignore_above": 1024, "ignore_above": 1024,
"type": "keyword" "type": "keyword"
} }