mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-06 17:22:49 +01:00
17 lines
772 B
Plaintext
17 lines
772 B
Plaintext
{
|
|
"description" : "osquery live query",
|
|
"processors" : [
|
|
{
|
|
"script": {
|
|
"lang": "painless",
|
|
"source": "def dict = ['columns': new HashMap()]; for (entry in ctx['rows'].entrySet()) { dict['columns'][entry.getKey()] = entry.getValue(); } ctx['result'] = dict; "
|
|
}
|
|
},
|
|
{ "remove": { "field": [ "rows" ], "ignore_missing": true, "ignore_failure": true } },
|
|
{ "rename": { "field": "distributed_query_execution_id", "target_field": "result.query_id", "ignore_missing": true } },
|
|
{ "rename": { "field": "computer_name", "target_field": "host.hostname", "ignore_missing": true } },
|
|
{ "pipeline": { "name": "osquery.normalize" } },
|
|
{ "pipeline": { "name": "common" } }
|
|
]
|
|
}
|