securityonion/salt/soc/files/soc/cases.eventfields.json

{
  "default": ["soc_timestamp", "so_case.title", "so_case.status", "so_case.severity", "so_case.createTime"]
}