19 Commits

Author	SHA1	Message	Date
reyesj2	a81e4c3362	remove dash(-) from kafka.id ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-11 11:55:17 -04:00
reyesj2	08557ae287	kafka.id field should only be present when metadata for kafka exists ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-11 11:01:34 -04:00
reyesj2	3b0339a9b3	create kafka.id from kafka {partition}-{offset}-{timestamp} for tracking event ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-06-04 14:27:52 -04:00
reyesj2	fadb6e2aa9	Re-add original timestamp format + ignore failures with this processor ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:57:48 -04:00
reyesj2	192d91565d	Update final pipeline timestamp format for event.module system events ... Signed-off-by: reyesj2 <94730068+reyesj2@users.noreply.github.com>	2024-04-29 16:34:29 -04:00
DefensiveDepth	376efab40c	Ship Defender logs	2024-04-08 14:01:38 -04:00
Wes	486a633dfe	Add pfsense Suricata config	2024-03-21 20:07:59 +00:00
Josh Brower	5513e74807	comma	2024-01-09 08:12:33 -05:00
Josh Brower	31ee365a91	Fixup FIM events	2024-01-09 08:11:05 -05:00
Wes	508260bd46	Use event.created for timestamp	2023-09-19 13:32:03 +00:00
Wes	7971d9749a	Assign pipeline to import	2023-08-17 14:08:48 +00:00
Josh Brower	dd1fa51eb5	Generate community_id for defend endpoint logs	2023-08-04 09:03:17 -04:00
Josh Brower	4f94d953c9	Merge remote-tracking branch 'origin/2.4/dev' into fix/elasticsearch_endpoint	2023-07-25 07:42:59 -04:00
Wes	5553be02ac	Change how tags are added	2023-07-24 21:31:28 +00:00
Josh Brower	741e6039c1	Cleanup for Sigma Rules	2023-07-24 09:25:58 -04:00
Wes	3a34da354f	Use append instead of set	2023-06-15 16:35:43 +00:00
Wes	58a63e0765	Remove extra comma	2023-06-15 14:22:37 +00:00
Wes	b5bccc5e05	Use module in dataset name and add dataset tag	2023-06-15 13:06:57 +00:00
Wes	38ab426470	Add final Fleet pipeline	2023-06-13 13:36:26 +00:00