From f9df39977b2dc928f218bacff1b120569aadf2b9 Mon Sep 17 00:00:00 2001 From: Wes Lambert Date: Tue, 14 Jul 2020 17:38:43 +0000 Subject: [PATCH] Add observer name for Strelka events --- salt/elasticsearch/files/ingest/strelka.file | 1 + 1 file changed, 1 insertion(+) diff --git a/salt/elasticsearch/files/ingest/strelka.file b/salt/elasticsearch/files/ingest/strelka.file index 17c1dca62..78fa5a10e 100644 --- a/salt/elasticsearch/files/ingest/strelka.file +++ b/salt/elasticsearch/files/ingest/strelka.file @@ -19,6 +19,7 @@ } } }, + { "set": { "field": "observer.name", "value": "{{agent.name}}", { "remove": { "field": ["host", "path", "message", "scan.exiftool.keys"], "ignore_missing": true } }, { "pipeline": { "name": "common" } } ]