CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4797 from Security-Onion-Solutions/fix/wazuh_data_port

Browse Source 
Change field name and mapping for Wazuh's data.port
This commit is contained in:
weslambert
2021-07-14 10:14:53 -04:00
committed by GitHub
parent c1523c4936 723172bc1f
commit 42ba9888d7
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
salt/elasticsearch/files/ingest/ossec
View File

@@ -33,6 +33,7 @@
{ "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } }, { "rename": { "field": "data.win.eventdata.user", "target_field": "user.name", "ignore_missing": true } },
{ "rename": { "field": "data.win.system", "target_field": "winlog", "ignore_missing": true } }, { "rename": { "field": "data.win.system", "target_field": "winlog", "ignore_missing": true } },
{ "rename": { "field": "data.win.eventdata", "target_field": "winlog.event_data", "ignore_missing": true } }, { "rename": { "field": "data.win.eventdata", "target_field": "winlog.event_data", "ignore_missing": true } },
{ "rename": { "field": "data", "target_field": "wazuh.data", "ignore_missing": true } },
{ "rename": { "field": "winlog.eventID", "target_field": "winlog.event_id", "ignore_missing": true } }, { "rename": { "field": "winlog.eventID", "target_field": "winlog.event_id", "ignore_missing": true } },
{ "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } }, { "rename": { "field": "predecoder.program_name", "target_field": "process.name", "ignore_missing": true } },
{ "rename": { "field": "decoder.name", "target_field": "event.dataset", "ignore_missing": true } }, { "rename": { "field": "decoder.name", "target_field": "event.dataset", "ignore_missing": true } },

7
salt/elasticsearch/templates/so/so-common-template.json
View File

@@ -65,7 +65,8 @@
{ {
"port": { "port": {
"path_match": "*.port", "path_match": "*.port",
"mapping": { "path_unmatch": "*.data.port",
"mapping": {
"type": "integer", "type": "integer",
"fields" : { "fields" : {
"keyword" : { "keyword" : {
@@ -680,6 +681,10 @@
"redis":{ "redis":{
"type":"object", "type":"object",
"dynamic": true "dynamic": true
},
"wazuh":{
"type":"object",
"dynamic": true
} }
} }
} }