Merge pull request #12634 from Security-Onion-Solutions/dougburks-patch-1

FEATURE: Add Events column layout for event.module system #12628

salt/soc/defaults.yaml

@@ -1064,6 +1064,15 @@ soc:
         -  event.action
         -  event.outcome
         -  event.dataset
+      ':system:':
+        -  soc_timestamp
+        -  process.name
+        -  process.pid
+        -  user.effective.name
+        -  user.name
+        -  system.auth.sudo.command
+        -  event.dataset
+        -  message
     server:
       bindAddress: 0.0.0.0:9822
       baseUrl: /