0d297274c8
DetectionComment Mapping Defined
2024-02-13 12:53:18 -07:00
64f6d0fba9
Updated Detection's ES Mappings
...
Detection's now have a License field and the Comment model is defined now.
2024-02-09 14:20:07 -07:00
29174566f3
WIP: Updated Detection Mappings, Changed Engine to Language
...
Detection mappings updated to include the removal of Note and the addition of Tags, Ruleset, and Language.
SOC defaults updated to use language based queries rather than engine and show the language column instead of the engine column in results.
2024-02-08 09:44:56 -07:00
585147d1de
Added so-detection mapping in elasticsearch
2024-01-31 10:39:47 -07:00
8426aad56d
Text mapping for scan.pe.flags
2024-01-24 15:10:42 +00:00
0bba68769b
Make scan.pe.image_version type of 'float'
2023-09-26 14:05:12 +00:00
0fed757b11
Add entropy mapping
2023-08-31 15:10:27 +00:00
a59eda319e
Remove security subfield
2023-07-18 19:00:50 +00:00
1d3e39b6bd
Map user name to keyword and remove security subfield generation
2023-07-18 14:46:47 +00:00
495a9c0783
Add mapping for event.severity_label
2023-06-05 21:19:37 +00:00
5fc297b8c1
Change Elastic Logic
2023-03-21 16:52:08 -04:00
fdffac83e1
sysmon fix by bryant
2022-09-19 14:47:45 -04:00
fe1b72655b
Additional .keyword shims for process mappings
2022-03-24 16:45:06 +00:00
406267a892
Add process.name.keyword
2022-03-08 12:42:34 -05:00
ffae22beef
Add DTC syslog mappings for .keyword and add refs to defaults.yml
2022-03-04 13:04:11 +00:00
1f71816ad7
Add keyword subfield for DTC winlog mappings
2022-03-03 14:54:30 +00:00
1c086e36da
Add missing comma for file mappings
2022-03-03 13:49:54 +00:00
85979cbce8
Add file, process, and winlog mapping changes
2022-03-03 13:37:27 +00:00
8f97f09c9c
Additional .keyword changes for host.hostname client.address, and event.action
2022-03-02 21:54:46 +00:00
3ee46e4c29
Add .keyword for destination/source geo.country_name
2022-03-02 21:50:03 +00:00
ab9b81ea39
Change match_only_text to text for mac in host mappings
2022-03-02 15:01:05 +00:00
ed620b93b7
Add custom analyzer definition to all SO/DTC mappings
2022-03-02 14:43:19 +00:00
27c8eaa630
Update all other mappings for .security where applicable
2022-03-02 14:39:23 +00:00
e925d435ff
Update event, file, and host mappings to include .security
2022-03-02 14:33:52 +00:00
496b161253
Update ECS mappings to include .security
2022-03-02 14:27:36 +00:00
aae2fd1fbb
Update DNS mappings to include .security
2022-03-02 14:27:15 +00:00
0b45cf7ae1
Update base mappings to include .security
2022-03-02 14:25:57 +00:00
d89af5f04f
Update agent mappings to include .security
2022-03-02 14:25:14 +00:00
5489b8559d
Revert "Switch from .security to match_only_text"
...
This reverts commit f7862af934
2022-03-01 18:44:00 +00:00
e942d81433
Ensure correct formatting for source override
2022-02-25 19:14:58 -05:00
a511fd33e9
Ensure correct formatting for destination override
2022-02-25 19:14:21 -05:00
a8bdff89ae
Move files into SO component template directory
2022-02-25 18:00:16 +00:00
0f8a39002f
Add .text subfield mappings for DTC where fields are defined
2022-02-24 19:39:52 +00:00
f7862af934
Switch from .security to match_only_text
2022-02-22 20:33:49 +00:00
9b841fd872
Add 'event.created' and 'event.ingested' keyword mapping
2022-02-08 21:34:32 +00:00
317f6471d8
Add additional scan and rule filset mappings
2022-02-04 19:05:09 +00:00
f3902cf77d
Fix EG template and mappings
2022-02-04 16:00:16 +00:00
a3031b2b5c
Additional DTC mapping changes
2022-02-04 15:38:51 +00:00
1ce386bb7f
Add more DTC transition mappings
2022-02-03 17:33:05 +00:00
9db1510b0e
Initial composable template configuration and base mappings
2022-02-02 02:08:31 +00:00
Corey Ogburn
Wes
Mike Reeves
doug