Skip to content

Commit

Permalink
update others_application mappings (#277)
Browse files Browse the repository at this point in the history
Signed-off-by: Grant Haywood <[email protected]>
Co-authored-by: Subhobrata Dey <[email protected]>
  • Loading branch information
phaseshiftg and sbcd90 authored Feb 20, 2023
1 parent 821f86e commit a705168
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 29 deletions.
Original file line number Diff line number Diff line change
@@ -1,7 +1,4 @@
# this file provides pre-defined mappings for Sigma fields defined for all Sigma rules under application log group to their corresponding ECS Fields.
fieldmappings:
EventID: event_uid
HiveName: unmapped.HiveName
fieldB: mappedB
fieldA1: mappedA
creationTime: timestamp
Signature: abusech-malware-signature
Filename: file-name
28 changes: 4 additions & 24 deletions src/main/resources/OSMapping/others_application/mappings.json
Original file line number Diff line number Diff line change
@@ -1,32 +1,12 @@
{
"properties": {
"windows-event_data-CommandLine": {
"abusech-malware-signature": {
"type": "alias",
"path": "CommandLine"
"path": "abusech.malware.signature"
},
"event_uid": {
"file-name": {
"type": "alias",
"path": "EventID"
},
"windows-hostname": {
"type": "alias",
"path": "HostName"
},
"windows-message": {
"type": "alias",
"path": "Message"
},
"windows-provider-name": {
"type": "alias",
"path": "Provider_Name"
},
"windows-servicename": {
"type": "alias",
"path": "ServiceName"
},
"timestamp": {
"path": "creationTime",
"type": "alias"
"path": "file.name"
}
}
}

0 comments on commit a705168

Please sign in to comment.