Merge pull request #1002 from Security-Onion-Solutions/fix/strelka_observer

Add observer name for Strelka events
2025-12-08 02:02:50 +01:00 · 2020-07-14 13:39:52 -04:00
parent 7ed902c0ae f9df39977b
commit 7a36803e2c
1 changed files with 1 additions and 0 deletions
--- a/salt/elasticsearch/files/ingest/strelka.file
+++ b/salt/elasticsearch/files/ingest/strelka.file
@@ -19,6 +19,7 @@
          }
      }
    },
+    { "set":         { "field": "observer.name",        "value": "{{agent.name}}",
    { "remove":         { "field": ["host", "path", "message", "scan.exiftool.keys"],                                         "ignore_missing": true  } },
    { "pipeline":       { "name": "common"                                                                                   } }
  ]