From fc824359edfcfa11b0a44983e7bf63a2e62e0931 Mon Sep 17 00:00:00 2001
From: Doug Burks <doug.burks@securityonionsolutions.com>
Date: Tue, 20 Jun 2023 07:30:56 -0400
Subject: [PATCH] Update default fields for kratos.audit

---
 salt/soc/defaults.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index e2e15a5b1..9e4c25408 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -61,7 +61,7 @@ soc:
         - log.id.uid
         - network.community_id
         - event.dataset
-      ':kratos:audit':
+      ':kratos:kratos.audit':
         - soc_timestamp
         - http_request.headers.x-real-ip
         - identity_id