updated ad_ldap mappings (#213)

Signed-off-by: Grant Haywood <[email protected]> Signed-off-by: Grant Haywood <[email protected]>
opensearch-project · Jan 4, 2023 · d224c17 · d224c17
1 parent 1770873
commit d224c17
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 13 deletions.
diff --git a/src/main/resources/OSMapping/ad_ldap/fieldmappings.yml b/src/main/resources/OSMapping/ad_ldap/fieldmappings.yml
@@ -1,7 +1,2 @@
-# this file provides pre-defined mappings for Sigma fields defined for all Sigma rules under windows log group to their corresponding ECS Fields.
 fieldmappings:
-    EventID: event_uid
-    HiveName: unmapped.HiveName
-    fieldB: mappedB
-    fieldA1: mappedA
-    CommandLine: windows-event_data-CommandLine
+    TargetUserName: winlog-event_data-TargetUserName
diff --git a/src/main/resources/OSMapping/ad_ldap/mappings.json b/src/main/resources/OSMapping/ad_ldap/mappings.json
@@ -1,12 +1,8 @@
 {
   "properties": {
-    "windows-event_data-CommandLine": {
-      "type": "alias",
-      "path": "CommandLine"
-    },
-    "event_uid": {
-      "type": "alias",
-      "path": "EventID"
+    "winlog-event_data-TargetUserName": {
+      "path": "winlog.event_data.TargetUserName",
+      "type": "alias"
     }
   }
 }