update others_web mappings (#304)

Signed-off-by: Grant Haywood <[email protected]>
(cherry picked from commit f72911a)

src/main/resources/OSMapping/others_web/fieldmappings.yml

@@ -1,8 +1,9 @@
 # this file provides pre-defined mappings for Sigma fields defined for all Sigma rules under web log group to their corresponding ECS Fields.
 fieldmappings:
-  EventID: event_uid
-  HiveName: unmapped.HiveName
-  fieldB: mappedB
-  fieldA1: mappedA
+  c-uri: rsa-web-p_url
+  sc-status: rsa-misc-status
+  c-useragent: rsa-web-p_user_agent
+  cs-method: rsa-web-p_web_method
+  cs-uri-query: rsa-web-web_ref_query
+  cs-username: rsa-misc-username_fld
   creationTime: timestamp
-

src/main/resources/OSMapping/others_web/mappings.json

@@ -1,32 +1,32 @@
 {
   "properties": {
-    "windows-event_data-CommandLine": {
-      "type": "alias",
-      "path": "CommandLine"
+    "rsa-web-p_url": {
+      "path": "rsa.web.p_url",
+      "type": "alias"
     },
-    "event_uid": {
-      "type": "alias",
-      "path": "EventID"
+    "rsa-misc-status": {
+      "path": "rsa.misc.status",
+      "type": "alias"
     },
-    "windows-hostname": {
-      "type": "alias",
-      "path": "HostName"
+    "rsa-web-p_user_agent": {
+      "path": "rsa.web.p_user_agent",
+      "type": "alias"
     },
-    "windows-message": {
-      "type": "alias",
-      "path": "Message"
+    "rsa-web-p_web_method": {
+      "path": "rsa.web.p_web_method",
+      "type": "alias"
     },
-    "windows-provider-name": {
-      "type": "alias",
-      "path": "Provider_Name"
+    "rsa-web-web_ref_query": {
+      "path": "rsa.web.web_ref_query",
+      "type": "alias"
     },
-    "windows-servicename": {
-      "type": "alias",
-      "path": "ServiceName"
+    "rsa-misc-username_fld": {
+      "path": "rsa.misc.username_fld",
+      "type": "alias"
     },
     "timestamp": {
       "path": "creationTime",
       "type": "alias"
     }
   }
-}
+}