mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 09:12:45 +01:00
138 lines
3.3 KiB
Plaintext
138 lines
3.3 KiB
Plaintext
{
|
|
"_meta": {
|
|
"documentation": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html",
|
|
"ecs_version": "1.12.2"
|
|
},
|
|
"template": {
|
|
"mappings": {
|
|
"properties": {
|
|
"event": {
|
|
"properties": {
|
|
"action": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"agent_id_status": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"category": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"code": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"created": {
|
|
"type": "date",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"dataset": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"duration": {
|
|
"type": "long"
|
|
},
|
|
"end": {
|
|
"type": "date"
|
|
},
|
|
"hash": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ingested": {
|
|
"type": "date",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"kind": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"module": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"keyword": {
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"original": {
|
|
"doc_values": false,
|
|
"index": false,
|
|
"type": "keyword"
|
|
},
|
|
"outcome": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"provider": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"reason": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"reference": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"risk_score": {
|
|
"type": "float"
|
|
},
|
|
"risk_score_norm": {
|
|
"type": "float"
|
|
},
|
|
"sequence": {
|
|
"type": "long"
|
|
},
|
|
"severity": {
|
|
"type": "long"
|
|
},
|
|
"start": {
|
|
"type": "date"
|
|
},
|
|
"timezone": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"url": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|