-
Notifications
You must be signed in to change notification settings - Fork 202
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improving count rule's output #1342
Comments
|
|
@fukusuket I talked to someone who is more familiar with importing into elastic stack and he said that elastic will create multiple logs (documents) when arrays are used and it will make parsing more difficult so I think we should avoid arrays and keep everything as strings. We should probably keep the Channel and EventID information not in Details, but in the normal fields so that it makes searching for them easier. |
@YamatoSecurity
{
"Timestamp": "2021-10-24 06:50:11.666 +09:00",
"RuleTitle": "TEST_TITLE",
"Level": "info",
"Computer": "HOSTA ¦ HOSTB",
"Channel": "Sysmon ¦ Security",
"EventID": "4624 ¦ 4625",
"RecordID": "",
"Details": {
"Count": 2,
"IpAddress": "10.23.23.9",
"SubStatus": "0x0",
"LogonType": "10"
},
"ExtraFieldInfo": "-"
} |
@fukusuket LGTM! |
|
TODO
|
#1341 (comment)
The text was updated successfully, but these errors were encountered: