From c5d638193377e28d34a245613992f40f62a6f547 Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Wed, 3 Jun 2020 11:16:43 -0400
Subject: [PATCH] SMTP for suricata

---
 salt/elasticsearch/files/ingest/suricata.smtp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/salt/elasticsearch/files/ingest/suricata.smtp b/salt/elasticsearch/files/ingest/suricata.smtp
index 523ec1b30..6e0c1fcdc 100644
--- a/salt/elasticsearch/files/ingest/suricata.smtp
+++ b/salt/elasticsearch/files/ingest/suricata.smtp
@@ -2,7 +2,11 @@
   "description" : "suricata.smtp",
   "processors" : [
     { "rename": 	{ "field": "message2.proto", 		"target_field": "network.transport",		"ignore_missing": true 	} },
-    { "rename": 	{ "field": "message2.app_proto", 		"target_field": "network.protocol",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.smtp.helo", 		"target_field": "smtp.helo",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.email.mail_from", 		"target_field": "smtp.from",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.email.to", 		"target_field": "smtp.to",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.email.cc", 		"target_field": "smtp.cc",		"ignore_missing": true 	} },
+    { "rename": 	{ "field": "message2.email.attachment", 		"target_field": "smtp.attachment",		"ignore_missing": true 	} },
     { "pipeline": { "name": "common" } }
   ]
 }