mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-15 04:31:26 +01:00
104 lines
2.5 KiB
JSON
104 lines
2.5 KiB
JSON
{
|
|
"_meta": {
|
|
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html",
|
|
"ecs_version": "1.12.2"
|
|
},
|
|
"template": {
|
|
"mappings": {
|
|
"properties": {
|
|
"event": {
|
|
"properties": {
|
|
"action": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"category": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"created": {
|
|
"type": "date",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"dataset": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"ingested": {
|
|
"type": "date",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"module": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"outcome": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"severity_label": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"timezone": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} |