mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-05-04 10:28:16 +02:00
Fixup sigma pipelines
This commit is contained in:
@@ -0,0 +1,7 @@
|
||||
name: Security Onion - Final Pipeline
|
||||
priority: 95
|
||||
transformations:
|
||||
- id: override_field_name_mapping
|
||||
type: field_name_mapping
|
||||
mapping:
|
||||
FieldNameToOverride: NewFieldName
|
||||
@@ -0,0 +1,18 @@
|
||||
name: Security Onion Baseline Pipeline
|
||||
priority: 90
|
||||
transformations:
|
||||
- id: baseline_field_name_mapping
|
||||
type: field_name_mapping
|
||||
mapping:
|
||||
cs-method: http.method
|
||||
c-uri: http.uri
|
||||
c-useragent: http.useragent
|
||||
cs-version: http.version
|
||||
uid: user.uid
|
||||
sid: rule.uuid
|
||||
answer: answers
|
||||
query: dns.query.name
|
||||
src_ip: destination.ip.keyword
|
||||
src_port: source.port
|
||||
dst_ip: destination.ip.keyword
|
||||
dst_port: destination.port
|
||||
Reference in New Issue
Block a user