mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-15 21:52:47 +01:00
111 lines
2.5 KiB
JSON
111 lines
2.5 KiB
JSON
{"template": {
|
|
"mappings": {
|
|
"properties": {
|
|
"pack_name": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"metadata": {
|
|
"type": "object",
|
|
"enabled": false
|
|
},
|
|
"data": {
|
|
"properties": {
|
|
"query": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"pack_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"input_type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"pack_prebuilt": {
|
|
"type": "boolean"
|
|
},
|
|
"type": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"queries": {
|
|
"properties": {
|
|
"action_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"saved_query_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"saved_query_prebuilt": {
|
|
"type": "boolean"
|
|
},
|
|
"query": {
|
|
"type": "text"
|
|
},
|
|
"id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"version": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ecs_mapping": {
|
|
"type": "object",
|
|
"enabled": false
|
|
},
|
|
"platform": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"agents": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
},
|
|
"agents": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"@timestamp": {
|
|
"type": "date"
|
|
},
|
|
"action_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"user_id": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"expiration": {
|
|
"type": "date"
|
|
},
|
|
"event": {
|
|
"properties": {
|
|
"agent_id_status": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
},
|
|
"ingested": {
|
|
"format": "strict_date_time_no_millis||strict_date_optional_time||epoch_millis",
|
|
"type": "date"
|
|
}
|
|
}
|
|
},
|
|
"agent_ids": {
|
|
"ignore_above": 1024,
|
|
"type": "keyword"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|