Drop Hashes field

2025-12-06 09:12:45 +01:00 · 2024-03-01 15:26:02 -05:00
parent b017157d21
commit d832158cc5
1 changed files with 12 additions and 1 deletions
--- a/salt/soc/files/soc/sigma_so_pipeline.yaml
+++ b/salt/soc/files/soc/sigma_so_pipeline.yaml
@@ -35,6 +35,17 @@ transformations:
      rule_conditions:
      - type: logsource
        category: antivirus
+    # Drops the Hashes field which is specific to Sysmon logs
+    # Ingested sysmon logs will have the Hashes field mapped to ECS specific fields
+    - id: hashes_drop_sysmon-specific-field
+      type: drop_detection_item
+      field_name_conditions:
+        - type: include_fields
+          fields:
+          - winlog.event_data.Hashes
+      rule_conditions:
+      - type: logsource
+        product: windows
    - id: hashes_process-creation
      type: field_name_mapping
      mapping:
@@ -67,4 +78,4 @@ transformations:
      rule_conditions:
      - type: logsource
        product: windows
-        category: driver_load
+        category: driver_load