FEATURE: Add Events table columns for event.module strelka #12716

2025-12-06 09:12:45 +01:00 · 2024-04-02 10:42:20 -04:00
parent a678a5a416
commit 2f03cbf115
1 changed files with 9 additions and 0 deletions
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -570,6 +570,15 @@ soc:
        - file.mime_type
        - log.id.fuid
        - event.dataset
+      ':strelka:file':
+        - soc_timestamp
+        - file.name
+        - file.size
+        - hash.md5
+        - file.source
+        - file.mime_type
+        - log.id.fuid
+        - event.dataset  
      ':suricata:':
        - soc_timestamp
        - source.ip