mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
15 lines
1.3 KiB
Plaintext
15 lines
1.3 KiB
Plaintext
{
|
|
"description" : "osquery normalize",
|
|
"processors" : [
|
|
{ "rename": { "field": "result.columns.cmdline", "target_field": "process.command_line", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.cwd", "target_field": "process.working_directory", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.name", "target_field": "process.name", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.path", "target_field": "process.executable", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.pid", "target_field": "process.pid", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.parent", "target_field": "process.ppid", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.uid", "target_field": "user.id", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.username", "target_field": "user.name", "ignore_missing": true } },
|
|
{ "rename": { "field": "result.columns.gid", "target_field": "group.id", "ignore_missing": true } }
|
|
]
|
|
}
|