{
  "description" : "suricata.krb5",
  "processors" : [
    { "set":      	{ "field": "event.dataset",        		"value": "kerberos"  							} },
    { "rename": 	{ "field": "message2.proto", 			"target_field": "network.transport",		"ignore_missing": true 	} },
    { "rename": 	{ "field": "message2.app_proto",		"target_field": "network.protocol",		"ignore_missing": true 	} },
    { "rename":         { "field": "message2.krb5.msg_type",		"target_field": "kerberos.request_type",	"ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.cname",		"target_field": "kerberos.client",		"ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.realm",		"target_field": "kerberos.realm",		"ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.sname",		"target_field": "kerberos.service",		"ignore_missing": true  } },
    { "rename":         { "field": "message2.krb5.encryption",		"target_field": "kerberos.ticket.cipher",	"ignore_missing": true  } },
    { "rename":         { "field": "message2.krb.weak_encryption",	"target_field": "kerberos.weak_encryption",	"ignore_missing": true  } },
    { "pipeline": { "name": "common" } }
  ]
}