From e2caf4668e5298b92b6b91fe7185c4e15df736d9 Mon Sep 17 00:00:00 2001
From: Doug Burks <doug.burks@securityonionsolutions.com>
Date: Tue, 26 Mar 2024 16:08:41 -0400
Subject: [PATCH] FEATURE: Add Events table columns for event.module
 elastic_agent #12666

---
 salt/soc/defaults.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 70db82fc6..861f6b02c 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1176,6 +1176,10 @@ soc:
         -  logdata.USERNAME
         -  logdata.USERAGENT
         -  event.dataset
+      ':elastic_agent:':
+        -  soc_timestamp
+        -  event.dataset
+        -  message
     server:
       bindAddress: 0.0.0.0:9822
       baseUrl: /