Add mapping for scan.exiftool and scan.pe.sections.entropy

2025-12-06 17:22:49 +01:00 · 2022-01-14 17:01:13 -05:00
parent a90bc9dba9
commit c512351dd6
1 changed files with 20 additions and 0 deletions
--- a/salt/elasticsearch/templates/so/so-case-template.json.jinja
+++ b/salt/elasticsearch/templates/so/so-case-template.json.jinja
@@ -244,6 +244,26 @@
              "message": {
                "type": "text"
              },
+              "scan":{
+                "type":"object",
+                "dynamic": true,
+                "properties":{
+                  "exiftool":{
+                    "type":"text"
+                   },
+                   "pe":{
+                     "properties":{
+                       "sections":{
+                         "properties":{
+                           "entropy":{
+                             "type": "float"
+                           }
+                         }
+                       }
+                     }
+                   }
+                }
+              },
              "tags": {
                "type": "keyword",
                "ignore_above": 1024