CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 09:12:45 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #9204 from Security-Onion-Solutions/fix/ics_ingest_field_names_2_4

Browse Source 
Fix ICS Ingest Field Names
This commit is contained in:
weslambert
2022-11-22 12:30:17 -05:00
committed by GitHub
parent b801997709 6b77843e52
commit f9cc7888f4
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
salt/elasticsearch/files/ingest/zeek.enip
View File

@@ -8,7 +8,7 @@
{ "rename": { "field": "message2.enip_command", "target_field": "enip.command", "ignore_missing": true } },
{ "rename": { "field": "message2.length", "target_field": "enip.length", "ignore_missing": true } },
{ "rename": { "field": "message2.session_handle", "target_field": "enip.session.handle", "ignore_missing": true } },
{ "rename": { "field": "message2.enip_status", "target_field": "enip.status.code", "ignore_missing": true } },
{ "rename": { "field": "message2.enip_status", "target_field": "enip.status_code", "ignore_missing": true } },
{ "rename": { "field": "message2.sender_context", "target_field": "enip.sender.context", "ignore_missing": true } },
{ "rename": { "field": "message2.options", "target_field": "enip.options", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }

2
salt/elasticsearch/files/ingest/zeek.stun
View File

@@ -7,7 +7,7 @@
{ "rename": { "field": "message2.is_orig", "target_field": "stun.is_orig", "ignore_missing": true } },
{ "rename": { "field": "message2.trans_id", "target_field": "stun.id", "ignore_missing": true } },
{ "rename": { "field": "message2.method", "target_field": "stun.method", "ignore_missing": true } },
{ "rename": { "field": "message2.class", "target_field": "stun.clas", "ignore_missing": true } },
{ "rename": { "field": "message2.class", "target_field": "stun.class", "ignore_missing": true } },
{ "rename": { "field": "message2.attr_types", "target_field": "stun.attribute.types", "ignore_missing": true } },
{ "rename": { "field": "message2.attr_vals", "target_field": "stun.attribute.values", "ignore_missing": true } },
{ "pipeline": { "name": "zeek.common" } }