From d04aa06455e7e96b5cbdac6c09953e01bd718c81 Mon Sep 17 00:00:00 2001
From: Josh Brower <Josh@DefensiveDepth.com>
Date: Thu, 22 Feb 2024 14:01:02 -0500
Subject: [PATCH] Fix source.ip

---
 salt/soc/files/soc/sigma_so_pipeline.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/files/soc/sigma_so_pipeline.yaml b/salt/soc/files/soc/sigma_so_pipeline.yaml
index 8121a6f13..533823e6f 100644
--- a/salt/soc/files/soc/sigma_so_pipeline.yaml
+++ b/salt/soc/files/soc/sigma_so_pipeline.yaml
@@ -12,7 +12,7 @@ transformations:
         sid: rule.uuid
         answer: answers
         query: dns.query.name
-        src_ip: destination.ip.keyword
+        src_ip: source.ip.keyword
         src_port: source.port
         dst_ip: destination.ip.keyword
         dst_port: destination.port