From 778997bed46fc77b876328a6b98ebb477fe97082 Mon Sep 17 00:00:00 2001
From: Doug Burks <doug.burks@securityonionsolutions.com>
Date: Wed, 20 Mar 2024 17:07:37 -0400
Subject: [PATCH] FEATURE: Add Events column layout for event.module system
 #12628

---
 salt/soc/defaults.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index de372a98f..30149fdfd 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1064,6 +1064,15 @@ soc:
         -  event.action
         -  event.outcome
         -  event.dataset
+      ':system:':
+        -  soc_timestamp
+        -  process.name
+        -  process.pid
+        -  user.effective.name
+        -  user.name
+        -  system.auth.sudo.command
+        -  event.dataset
+        -  message
     server:
       bindAddress: 0.0.0.0:9822
       baseUrl: /