add endpoint_x_events_x_process to defaults.yaml

salt/soc/defaults.yaml

@@ -995,6 +995,14 @@ soc:
         -  tds.header_type
         -  log.id.uid
         -  event.dataset
+      ':endpoint:endpoint_x_events_x_process':
+        -  soc_timestamp
+        -  event.dataset
+        -  host.name
+        -  user.name
+        -  process.parent.name
+        -  process.name
+        -  process.working_directory
     server:
       bindAddress: 0.0.0.0:9822
       baseUrl: /