From 51cc04793332fcf8aa2c6444c5378867f072d753 Mon Sep 17 00:00:00 2001 From: Doug Burks Date: Tue, 22 Nov 2022 10:40:22 -0500 Subject: [PATCH] add cip to hunt.eventfields.json --- salt/soc/files/soc/hunt.eventfields.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/salt/soc/files/soc/hunt.eventfields.json b/salt/soc/files/soc/hunt.eventfields.json index d19f2904a..a9709a6a6 100644 --- a/salt/soc/files/soc/hunt.eventfields.json +++ b/salt/soc/files/soc/hunt.eventfields.json @@ -59,7 +59,9 @@ "::file_create_stream_hash": ["soc_timestamp", "file.target", "hash.md5", "hash.sha256", "process.executable", "process.pid", "winlog.computer_name"], "::tds": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "tds.command", "event.dataset" ], "::tds_rpc": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "tds.procedure_name", "event.dataset" ], + "::cip": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "cip.service", "cip.status_code", "event.dataset" ], "::tds_sql_batch": ["soc_timestamp", "source.ip", "source.port", "destination.ip", "destination.port", "log.id.uid", "tds.header_type", "event.dataset" ] + }