proc_creation per OS type

Merge pull request #15872 from Security-Onion-Solutions/3/soc-logs
cleanup status code
2026-05-09 21:02:36 +02:00 · 2026-05-08 09:11:24 -04:00 · 2026-05-07 19:01:24 +02:00
1 changed files with 22 additions and 1 deletions
@@ -126,15 +126,36 @@ transformations:
          fields:
          - event.code
    # Maps process_creation rules to endpoint process creation logs
-    # This is an OS-agnostic mapping, to account for logs that don't specify source OS
    - id: endpoint_process_create_windows_add-fields
      type: add_condition
      conditions:
        event.category: 'process'
        event.type: 'start'
+        host.os.type: 'windows'
      rule_conditions:
      - type: logsource
        category: process_creation
+        product: windows
+    - id: endpoint_process_create_macos_add-fields
+      type: add_condition
+      conditions:
+        event.category: 'process'
+        event.type: 'start'
+        host.os.type: 'macos'
+      rule_conditions:
+      - type: logsource
+        category: process_creation
+        product: macos
+    - id: endpoint_process_create_linux_add-fields
+      type: add_condition
+      conditions:
+        event.category: 'process'
+        event.type: 'start'
+        host.os.type: 'linux'
+      rule_conditions:
+      - type: logsource
+        category: process_creation
+        product: linux
    # Maps file_event rules to endpoint file creation logs
    # This is an OS-agnostic mapping, to account for logs that don't specify source OS
    - id: endpoint_file_create_add-fields
Author	SHA1	Message	Date
Josh Brower	e1d830da76	proc_creation per OS type	2026-05-08 09:11:24 -04:00
Josh Brower	e847c46129	Merge pull request #15872 from Security-Onion-Solutions/3/soc-logs cleanup status code	2026-05-07 19:01:24 +02:00