CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Drop Hashes field

Browse Source
This commit is contained in:
Josh Brower
2024-03-01 15:26:02 -05:00
parent b017157d21
commit d832158cc5
1 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
salt/soc/files/soc/sigma_so_pipeline.yaml
View File

@@ -35,6 +35,17 @@ transformations:
rule_conditions: rule_conditions:
- type: logsource - type: logsource
category: antivirus category: antivirus
# Drops the Hashes field which is specific to Sysmon logs
# Ingested sysmon logs will have the Hashes field mapped to ECS specific fields
- id: hashes_drop_sysmon-specific-field
type: drop_detection_item
field_name_conditions:
- type: include_fields
fields:
- winlog.event_data.Hashes
rule_conditions:
- type: logsource
product: windows
- id: hashes_process-creation - id: hashes_process-creation
type: field_name_mapping type: field_name_mapping
mapping: mapping:
@@ -67,4 +78,4 @@ transformations:
rule_conditions: rule_conditions:
- type: logsource - type: logsource
product: windows product: windows
category: driver_load category: driver_load