mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-05 07:43:09 +01:00
1753 lines
61 KiB
JSON
1753 lines
61 KiB
JSON
{"template": {
|
|
"settings": {
|
|
"index": {
|
|
"lifecycle": {
|
|
"name": "logs"
|
|
},
|
|
"codec": "best_compression",
|
|
"default_pipeline": "logs-windows.sysmon_operational-1.20.1",
|
|
"mapping": {
|
|
"total_fields": {
|
|
"limit": "10000"
|
|
}
|
|
},
|
|
"query": {
|
|
"default_field": [
|
|
"cloud.account.id",
|
|
"cloud.availability_zone",
|
|
"cloud.instance.id",
|
|
"cloud.instance.name",
|
|
"cloud.machine.type",
|
|
"cloud.provider",
|
|
"cloud.region",
|
|
"cloud.project.id",
|
|
"cloud.image.id",
|
|
"container.id",
|
|
"container.image.name",
|
|
"container.name",
|
|
"host.architecture",
|
|
"host.hostname",
|
|
"host.id",
|
|
"host.mac",
|
|
"host.name",
|
|
"host.os.family",
|
|
"host.os.kernel",
|
|
"host.os.name",
|
|
"host.os.platform",
|
|
"host.os.version",
|
|
"host.os.build",
|
|
"host.os.codename",
|
|
"host.type",
|
|
"event.action",
|
|
"event.category",
|
|
"event.code",
|
|
"event.kind",
|
|
"event.outcome",
|
|
"event.provider",
|
|
"event.type",
|
|
"tags",
|
|
"input.type",
|
|
"destination.domain",
|
|
"dns.answers.class",
|
|
"dns.answers.data",
|
|
"dns.answers.name",
|
|
"dns.answers.type",
|
|
"dns.header_flags",
|
|
"dns.id",
|
|
"dns.op_code",
|
|
"dns.question.class",
|
|
"dns.question.name",
|
|
"dns.question.registered_domain",
|
|
"dns.question.subdomain",
|
|
"dns.question.top_level_domain",
|
|
"dns.question.type",
|
|
"dns.response_code",
|
|
"dns.type",
|
|
"ecs.version",
|
|
"error.code",
|
|
"error.message",
|
|
"file.code_signature.status",
|
|
"file.code_signature.subject_name",
|
|
"file.directory",
|
|
"file.extension",
|
|
"file.hash.md5",
|
|
"file.hash.sha1",
|
|
"file.hash.sha256",
|
|
"file.hash.sha512",
|
|
"file.name",
|
|
"file.path",
|
|
"file.pe.architecture",
|
|
"file.pe.company",
|
|
"file.pe.description",
|
|
"file.pe.file_version",
|
|
"file.pe.imphash",
|
|
"file.pe.original_file_name",
|
|
"file.pe.product",
|
|
"group.domain",
|
|
"group.id",
|
|
"group.name",
|
|
"log.level",
|
|
"message",
|
|
"network.community_id",
|
|
"network.direction",
|
|
"network.protocol",
|
|
"network.transport",
|
|
"network.type",
|
|
"process.args",
|
|
"process.command_line",
|
|
"process.entity_id",
|
|
"process.executable",
|
|
"process.hash.md5",
|
|
"process.hash.sha1",
|
|
"process.hash.sha256",
|
|
"process.hash.sha512",
|
|
"process.name",
|
|
"process.parent.args",
|
|
"process.parent.command_line",
|
|
"process.parent.entity_id",
|
|
"process.parent.executable",
|
|
"process.parent.name",
|
|
"process.pe.architecture",
|
|
"process.pe.company",
|
|
"process.pe.description",
|
|
"process.pe.file_version",
|
|
"process.pe.imphash",
|
|
"process.pe.original_file_name",
|
|
"process.pe.product",
|
|
"process.title",
|
|
"process.working_directory",
|
|
"registry.data.strings",
|
|
"registry.data.type",
|
|
"registry.hive",
|
|
"registry.key",
|
|
"registry.path",
|
|
"registry.value",
|
|
"related.hash",
|
|
"related.hosts",
|
|
"related.user",
|
|
"rule.name",
|
|
"service.name",
|
|
"service.type",
|
|
"source.domain",
|
|
"user.domain",
|
|
"user.id",
|
|
"user.name",
|
|
"user.target.group.domain",
|
|
"user.target.group.id",
|
|
"user.target.group.name",
|
|
"user.target.name",
|
|
"sysmon.dns.status",
|
|
"winlog.api",
|
|
"winlog.activity_id",
|
|
"winlog.computer_name",
|
|
"winlog.event_data.AuthenticationPackageName",
|
|
"winlog.event_data.Binary",
|
|
"winlog.event_data.BitlockerUserInputTime",
|
|
"winlog.event_data.BootMode",
|
|
"winlog.event_data.BootType",
|
|
"winlog.event_data.BuildVersion",
|
|
"winlog.event_data.CallTrace",
|
|
"winlog.event_data.ClientInfo",
|
|
"winlog.event_data.Company",
|
|
"winlog.event_data.Configuration",
|
|
"winlog.event_data.CorruptionActionState",
|
|
"winlog.event_data.CreationUtcTime",
|
|
"winlog.event_data.Description",
|
|
"winlog.event_data.Detail",
|
|
"winlog.event_data.DeviceName",
|
|
"winlog.event_data.DeviceNameLength",
|
|
"winlog.event_data.DeviceTime",
|
|
"winlog.event_data.DeviceVersionMajor",
|
|
"winlog.event_data.DeviceVersionMinor",
|
|
"winlog.event_data.DriveName",
|
|
"winlog.event_data.DriverName",
|
|
"winlog.event_data.DriverNameLength",
|
|
"winlog.event_data.DwordVal",
|
|
"winlog.event_data.EntryCount",
|
|
"winlog.event_data.EventType",
|
|
"winlog.event_data.EventNamespace",
|
|
"winlog.event_data.ExtraInfo",
|
|
"winlog.event_data.FailureName",
|
|
"winlog.event_data.FailureNameLength",
|
|
"winlog.event_data.FileVersion",
|
|
"winlog.event_data.FinalStatus",
|
|
"winlog.event_data.GrantedAccess",
|
|
"winlog.event_data.Group",
|
|
"winlog.event_data.IdleImplementation",
|
|
"winlog.event_data.IdleStateCount",
|
|
"winlog.event_data.ImpersonationLevel",
|
|
"winlog.event_data.IntegrityLevel",
|
|
"winlog.event_data.IpAddress",
|
|
"winlog.event_data.IpPort",
|
|
"winlog.event_data.KeyLength",
|
|
"winlog.event_data.LastBootGood",
|
|
"winlog.event_data.LastShutdownGood",
|
|
"winlog.event_data.LmPackageName",
|
|
"winlog.event_data.LogonGuid",
|
|
"winlog.event_data.LogonId",
|
|
"winlog.event_data.LogonProcessName",
|
|
"winlog.event_data.LogonType",
|
|
"winlog.event_data.MajorVersion",
|
|
"winlog.event_data.MaximumPerformancePercent",
|
|
"winlog.event_data.MemberName",
|
|
"winlog.event_data.MemberSid",
|
|
"winlog.event_data.MinimumPerformancePercent",
|
|
"winlog.event_data.MinimumThrottlePercent",
|
|
"winlog.event_data.MinorVersion",
|
|
"winlog.event_data.Name",
|
|
"winlog.event_data.NewProcessId",
|
|
"winlog.event_data.NewProcessName",
|
|
"winlog.event_data.NewSchemeGuid",
|
|
"winlog.event_data.NewThreadId",
|
|
"winlog.event_data.NewTime",
|
|
"winlog.event_data.NominalFrequency",
|
|
"winlog.event_data.Number",
|
|
"winlog.event_data.OldSchemeGuid",
|
|
"winlog.event_data.OldTime",
|
|
"winlog.event_data.Operation",
|
|
"winlog.event_data.OriginalFileName",
|
|
"winlog.event_data.Path",
|
|
"winlog.event_data.PerformanceImplementation",
|
|
"winlog.event_data.PreviousCreationUtcTime",
|
|
"winlog.event_data.PreviousTime",
|
|
"winlog.event_data.PrivilegeList",
|
|
"winlog.event_data.ProcessId",
|
|
"winlog.event_data.ProcessName",
|
|
"winlog.event_data.ProcessPath",
|
|
"winlog.event_data.ProcessPid",
|
|
"winlog.event_data.Product",
|
|
"winlog.event_data.PuaCount",
|
|
"winlog.event_data.PuaPolicyId",
|
|
"winlog.event_data.QfeVersion",
|
|
"winlog.event_data.Query",
|
|
"winlog.event_data.Reason",
|
|
"winlog.event_data.SchemaVersion",
|
|
"winlog.event_data.ScriptBlockText",
|
|
"winlog.event_data.ServiceName",
|
|
"winlog.event_data.ServiceVersion",
|
|
"winlog.event_data.Session",
|
|
"winlog.event_data.ShutdownActionType",
|
|
"winlog.event_data.ShutdownEventCode",
|
|
"winlog.event_data.ShutdownReason",
|
|
"winlog.event_data.Signature",
|
|
"winlog.event_data.SignatureStatus",
|
|
"winlog.event_data.Signed",
|
|
"winlog.event_data.StartAddress",
|
|
"winlog.event_data.StartFunction",
|
|
"winlog.event_data.StartModule",
|
|
"winlog.event_data.StartTime",
|
|
"winlog.event_data.State",
|
|
"winlog.event_data.Status",
|
|
"winlog.event_data.StopTime",
|
|
"winlog.event_data.SubjectDomainName",
|
|
"winlog.event_data.SubjectLogonId",
|
|
"winlog.event_data.SubjectUserName",
|
|
"winlog.event_data.SubjectUserSid",
|
|
"winlog.event_data.TSId",
|
|
"winlog.event_data.TargetDomainName",
|
|
"winlog.event_data.TargetImage",
|
|
"winlog.event_data.TargetInfo",
|
|
"winlog.event_data.TargetLogonGuid",
|
|
"winlog.event_data.TargetLogonId",
|
|
"winlog.event_data.TargetProcessGUID",
|
|
"winlog.event_data.TargetProcessId",
|
|
"winlog.event_data.TargetServerName",
|
|
"winlog.event_data.TargetUserName",
|
|
"winlog.event_data.TargetUserSid",
|
|
"winlog.event_data.TerminalSessionId",
|
|
"winlog.event_data.TokenElevationType",
|
|
"winlog.event_data.TransmittedServices",
|
|
"winlog.event_data.Type",
|
|
"winlog.event_data.UserSid",
|
|
"winlog.event_data.Version",
|
|
"winlog.event_data.Workstation",
|
|
"winlog.event_data.param1",
|
|
"winlog.event_data.param2",
|
|
"winlog.event_data.param3",
|
|
"winlog.event_data.param4",
|
|
"winlog.event_data.param5",
|
|
"winlog.event_data.param6",
|
|
"winlog.event_data.param7",
|
|
"winlog.event_data.param8",
|
|
"winlog.event_id",
|
|
"winlog.keywords",
|
|
"winlog.channel",
|
|
"winlog.record_id",
|
|
"winlog.related_activity_id",
|
|
"winlog.opcode",
|
|
"winlog.provider_guid",
|
|
"winlog.provider_name",
|
|
"winlog.task",
|
|
"winlog.user.identifier",
|
|
"winlog.user.name",
|
|
"winlog.user.domain",
|
|
"winlog.user.type"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"mappings": {
|
|
"dynamic_templates": [
|
|
{
|
|
"container.labels": {
|
|
"path_match": "container.labels.*",
|
|
"mapping": {
|
|
"type": "keyword"
|
|
},
|
|
"match_mapping_type": "string"
|
|
}
|
|
},
|
|
{
|
|
"winlog.user_data": {
|
|
"path_match": "winlog.user_data.*",
|
|
"mapping": {
|
|
"type": "keyword"
|
|
},
|
|
"match_mapping_type": "string"
|
|
}
|
|
}
|
|
],
|
|
"properties": {
|
|
"container": {
|
|
"properties": {
|
|
"image": {
|
|
"properties": {
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"sysmon": {
|
|
"properties": {
|
|
"file": {
|
|
"properties": {
|
|
"archived": {
|
|
"type": "boolean"
|
|
},
|
|
"is_executable": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"dns": {
|
|
"properties": {
|
|
"status": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"log": {
|
|
"properties": {
|
|
"level": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"destination": {
|
|
"properties": {
|
|
"port": {
|
|
"type": "long"
|
|
},
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ip": {
|
|
"type": "ip"
|
|
}
|
|
}
|
|
},
|
|
"rule": {
|
|
"properties": {
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"source": {
|
|
"properties": {
|
|
"port": {
|
|
"type": "long"
|
|
},
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ip": {
|
|
"type": "ip"
|
|
}
|
|
}
|
|
},
|
|
"error": {
|
|
"properties": {
|
|
"code": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"message": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"network": {
|
|
"properties": {
|
|
"community_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"protocol": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"transport": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"direction": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"cloud": {
|
|
"properties": {
|
|
"availability_zone": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"image": {
|
|
"properties": {
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"instance": {
|
|
"properties": {
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"provider": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"machine": {
|
|
"properties": {
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"project": {
|
|
"properties": {
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"region": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"account": {
|
|
"properties": {
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"file": {
|
|
"properties": {
|
|
"path": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"extension": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"code_signature": {
|
|
"properties": {
|
|
"valid": {
|
|
"type": "boolean"
|
|
},
|
|
"trusted": {
|
|
"type": "boolean"
|
|
},
|
|
"subject_name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"exists": {
|
|
"type": "boolean"
|
|
},
|
|
"status": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"pe": {
|
|
"properties": {
|
|
"file_version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"product": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"imphash": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"description": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"company": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"original_file_name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"architecture": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"directory": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"hash": {
|
|
"properties": {
|
|
"sha1": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"sha256": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"sha512": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"md5": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"ecs": {
|
|
"properties": {
|
|
"version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"related": {
|
|
"properties": {
|
|
"hosts": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ip": {
|
|
"type": "ip"
|
|
},
|
|
"user": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"hash": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"host": {
|
|
"properties": {
|
|
"hostname": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"os": {
|
|
"properties": {
|
|
"build": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"kernel": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"codename": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "text"
|
|
}
|
|
}
|
|
},
|
|
"family": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"platform": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ip": {
|
|
"type": "ip"
|
|
},
|
|
"containerized": {
|
|
"type": "boolean"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"mac": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"architecture": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"event": {
|
|
"properties": {
|
|
"sequence": {
|
|
"type": "long"
|
|
},
|
|
"ingested": {
|
|
"type": "date"
|
|
},
|
|
"code": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"provider": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"created": {
|
|
"type": "date"
|
|
},
|
|
"kind": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"module": {
|
|
"type": "constant_keyword",
|
|
"value": "windows"
|
|
},
|
|
"action": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"category": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"dataset": {
|
|
"type": "constant_keyword",
|
|
"value": "windows.sysmon_operational"
|
|
},
|
|
"outcome": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"group": {
|
|
"properties": {
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"registry": {
|
|
"properties": {
|
|
"hive": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"path": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"data": {
|
|
"properties": {
|
|
"strings": {
|
|
"ignore_above": 1024,
|
|
"type": "wildcard"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"value": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"key": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"process": {
|
|
"properties": {
|
|
"args": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"parent": {
|
|
"properties": {
|
|
"args": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"pid": {
|
|
"type": "long"
|
|
},
|
|
"args_count": {
|
|
"type": "long"
|
|
},
|
|
"entity_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"command_line": {
|
|
"ignore_above": 1024,
|
|
"type": "wildcard",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"executable": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"pe": {
|
|
"properties": {
|
|
"file_version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"product": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"imphash": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"description": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"company": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"original_file_name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"architecture": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"pid": {
|
|
"type": "long"
|
|
},
|
|
"working_directory": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"args_count": {
|
|
"type": "long"
|
|
},
|
|
"entity_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"title": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"command_line": {
|
|
"ignore_above": 1024,
|
|
"type": "wildcard",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"executable": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"hash": {
|
|
"properties": {
|
|
"sha1": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"sha256": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"sha512": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"md5": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"winlog": {
|
|
"properties": {
|
|
"related_activity_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"computer_name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"process": {
|
|
"properties": {
|
|
"pid": {
|
|
"type": "long"
|
|
},
|
|
"thread": {
|
|
"properties": {
|
|
"id": {
|
|
"type": "long"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"keywords": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"channel": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"event_data": {
|
|
"properties": {
|
|
"SignatureStatus": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DeviceTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ProcessName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"LogonGuid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Configuration": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"OriginalFileName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Query": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"BootMode": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Product": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"StartAddress": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetLogonGuid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"FileVersion": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"CallTrace": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"StopTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Status": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"GrantedAccess": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"CorruptionActionState": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"KeyLength": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"PreviousCreationUtcTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetInfo": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ServiceVersion": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"SubjectUserSid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"PerformanceImplementation": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetUserSid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Group": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"NewThreadId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Description": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ShutdownActionType": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DwordVal": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ProcessPid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DeviceVersionMajor": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ScriptBlockText": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TransmittedServices": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"MaximumPerformancePercent": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"NewTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"FinalStatus": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"IdleStateCount": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"MajorVersion": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Path": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"SchemaVersion": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TokenElevationType": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"MinorVersion": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"SubjectLogonId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"IdleImplementation": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ProcessPath": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"QfeVersion": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DeviceVersionMinor": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"OldTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"IpAddress": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DeviceName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Company": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"PuaPolicyId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"EventType": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"IntegrityLevel": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"LastShutdownGood": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"IpPort": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DriverNameLength": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"LmPackageName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"UserSid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"LastBootGood": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"PuaCount": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetProcessGUID": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Signed": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"StartTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ShutdownEventCode": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"NewProcessName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"FailureNameLength": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetProcessId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ServiceName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"PreviousTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"State": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"StartFunction": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"BootType": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Binary": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ClientInfo": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ImpersonationLevel": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"MemberName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetUserName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Detail": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TerminalSessionId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"MemberSid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DriverName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DeviceNameLength": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"OldSchemeGuid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Operation": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"CreationUtcTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Reason": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ShutdownReason": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetServerName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Number": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"BuildVersion": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"SubjectDomainName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetImage": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"MinimumPerformancePercent": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"LogonId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"LogonProcessName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TSId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetDomainName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"PrivilegeList": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param7": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param8": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param5": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param6": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"DriveName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"EventNamespace": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"NewProcessId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"LogonType": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ExtraInfo": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"StartModule": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param3": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param4": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param1": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"param2": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"TargetLogonId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Workstation": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"SubjectUserName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"FailureName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"NewSchemeGuid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Signature": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"MinimumThrottlePercent": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ProcessId": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"EntryCount": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"BitlockerUserInputTime": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"AuthenticationPackageName": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"NominalFrequency": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"Session": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"opcode": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"version": {
|
|
"type": "long"
|
|
},
|
|
"record_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"event_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"task": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"provider_guid": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"activity_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"api": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"provider_name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"user": {
|
|
"properties": {
|
|
"identifier": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"dns": {
|
|
"properties": {
|
|
"op_code": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"resolved_ip": {
|
|
"type": "ip"
|
|
},
|
|
"response_code": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"question": {
|
|
"properties": {
|
|
"registered_domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"top_level_domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"subdomain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"class": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"answers": {
|
|
"properties": {
|
|
"data": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"class": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ttl": {
|
|
"type": "long"
|
|
}
|
|
}
|
|
},
|
|
"header_flags": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"message": {
|
|
"type": "match_only_text"
|
|
},
|
|
"tags": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"input": {
|
|
"properties": {
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"@timestamp": {
|
|
"type": "date"
|
|
},
|
|
"data_stream": {
|
|
"properties": {
|
|
"namespace": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"type": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"dataset": {
|
|
"type": "constant_keyword"
|
|
}
|
|
}
|
|
},
|
|
"service": {
|
|
"properties": {
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"dataset": {
|
|
"properties": {
|
|
"name": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"namespace": {
|
|
"type": "constant_keyword"
|
|
},
|
|
"type": {
|
|
"type": "constant_keyword"
|
|
}
|
|
}
|
|
},
|
|
"user": {
|
|
"properties": {
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"target": {
|
|
"properties": {
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword",
|
|
"fields": {
|
|
"text": {
|
|
"type": "match_only_text"
|
|
}
|
|
}
|
|
},
|
|
"group": {
|
|
"properties": {
|
|
"domain": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"_meta": {
|
|
"package": {
|
|
"name": "windows"
|
|
},
|
|
"managed_by": "fleet",
|
|
"managed": true
|
|
}
|
|
}
|