From 9d4536dcbec222e508f63d44295d99e6278349bd Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Fri, 15 May 2020 15:05:21 -0400 Subject: [PATCH] osquery ingest parsing update --- salt/elasticsearch/files/ingest/osquery.query_result | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/salt/elasticsearch/files/ingest/osquery.query_result b/salt/elasticsearch/files/ingest/osquery.query_result index 669cc35e5..e9cdbe2d3 100644 --- a/salt/elasticsearch/files/ingest/osquery.query_result +++ b/salt/elasticsearch/files/ingest/osquery.query_result @@ -24,8 +24,14 @@ { "rename": { "field": "message3.columns.pid", "target_field": "process.pid", "ignore_missing": true } }, { "rename": { "field": "message3.columns.parent", "target_field": "process.ppid", "ignore_missing": true } }, { "rename": { "field": "message3.columns.cwd", "target_field": "process.working_directory", "ignore_missing": true } }, + { "rename": { "field": "message3.columns.community_id", "target_field": "network.community_id", "ignore_missing": true } }, + { "rename": { "field": "message3.columns.local_address", "target_field": "local.ip", "ignore_missing": true } }, + { "rename": { "field": "message3.columns.local_port", "target_field": "local.port", "ignore_missing": true } }, + { "rename": { "field": "message3.columns.remote_address", "target_field": "remote.ip", "ignore_missing": true } }, + { "rename": { "field": "message3.columns.remote_port", "target_field": "remote.port", "ignore_missing": true } }, + { "rename": { "field": "message3.columns.process_name", "target_field": "process.name", "ignore_missing": true } }, { "rename": { "field": "message3.columns.eventid", "target_field": "event.code", "ignore_missing": true } }, - { "set": { "if": "ctx.message3.columns.data != null", "field": "dataset", "value": "wel-{{message3.columns.source}}", "override": true } }, + { "set": { "if": "ctx.message3.columns.?data != null", "field": "dataset", "value": "wel-{{message3.columns.source}}", "override": true } }, { "rename": { "field": "message3.columns.winlog.EventData.SubjectUserName", "target_field": "user.name", "ignore_missing": true } }, { "rename": { "field": "message3.columns.winlog.EventData.destinationHostname", "target_field": "destination.hostname", "ignore_missing": true } }, { "rename": { "field": "message3.columns.winlog.EventData.destinationIp", "target_field": "destination.ip", "ignore_missing": true } },