Skip to content

Commit 8346948

Browse files
committed
Revert "remove security analytics mappings for network logs due to them breaking Query Workbench (see cisagov#746)"; instead I'm going to keep them in there, just without the field mappings.
This reverts commit 457d39c.
1 parent 90e04eb commit 8346948

File tree

1 file changed

+37
-0
lines changed

1 file changed

+37
-0
lines changed
Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"index_name": "MALCOLM_NETWORK_INDEX_ALIAS_REPLACER",
3+
"rule_topic": "network",
4+
"partial": true,
5+
"alias_mappings": {
6+
"properties": {
7+
"zeek.x509.certificate.serial": {
8+
"type": "alias",
9+
"path": "zeek.x509.certificate_serial"
10+
},
11+
"service": {
12+
"type": "alias",
13+
"path": "network.protocol"
14+
},
15+
"rejected": {
16+
"type": "alias",
17+
"path": "zeek.dns.rejected"
18+
},
19+
"id.resp_p": {
20+
"type": "alias",
21+
"path": "destination.port"
22+
},
23+
"id.resp_h": {
24+
"type": "alias",
25+
"path": "destination.ip"
26+
},
27+
"id.orig_h": {
28+
"type": "alias",
29+
"path": "source.ip"
30+
},
31+
"Z-flag": {
32+
"type": "alias",
33+
"path": "zeek.dns.Z"
34+
}
35+
}
36+
}
37+
}

0 commit comments

Comments
 (0)