fix#4500 ocsf fields and api

Signed-off-by: cwillum <[email protected]>
harshavamsi · Jul 13, 2023 · ef13a74 · ef13a74
1 parent ea63aa2
commit ef13a74
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/_security-analytics/api-tools/correlation-eng.md b/_security-analytics/api-tools/correlation-eng.md
@@ -24,8 +24,8 @@ POST /_plugins/_security_analytics/correlation/rules
 | Field | Type | Description |
 | :--- | :--- |:--- |
 | `index` | String | The name of the index used as the log source. |
-| `query` | String | TBD. |
-| `category` | String | TBD. |
+| `query` | String | The query used to filter security logs for correlation. |
+| `category` | String | The log type associated with the log source. |
 
 #### Example request
 
@@ -164,7 +164,7 @@ GET /_plugins/_security_analytics/findings/correlate?finding=425dce0b-f5ee-4889-
 | :--- | :--- |:--- |
 | `finding` | String | The finding ID. |
 | `detector_type` | String | The log type for the detector. |
-| `nearby_findings` | Number | TBD. |
+| `nearby_findings` | Number | The number of nearby findings with respect to the given finding ID. |
 | `time_window` | String | Sets a window of time in which all of the correlations must have occurred together. |
 
 

diff --git a/images/Security/detector_rules.png b/images/Security/detector_rules.png