diff --git a/salt/soc/files/soc/sigma_playbook_pipeline.yaml b/salt/soc/files/soc/sigma_playbook_pipeline.yaml index 6d428d2a8..b31f8ba5d 100644 --- a/salt/soc/files/soc/sigma_playbook_pipeline.yaml +++ b/salt/soc/files/soc/sigma_playbook_pipeline.yaml @@ -8,6 +8,7 @@ transformations: mapping: process.executable: process.executable.caseless process.parent.executable: process.parent.executable.caseless + process.parent.name: process.parent.name.caseless process.command_line: process.command_line.caseless process.parent.command_line: process.parent.command_line.caseless file.path: file.path.caseless