You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@fukusuket Sorry for the many issues! I noticed there is a bug in both the correlation rules and the old count aggregation rules.
When using the all-field-info and all-field-info-verbose profiles which use the original field names, the field information does not get outputted.
Same thing happens when using the ../hayabusa-rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt_Deprecated.yml rule.
I would like to output the same regardless of what profile is being used.
These are the original field names and no name conversion is done so they are expected when all-field-info profiles are used.
In the future, I want to rename the fields like we do in details, etc.. but that will take some planning.
(See issue: #1445)
The text was updated successfully, but these errors were encountered:
@fukusuket Sorry for the many issues! I noticed there is a bug in both the correlation rules and the old
count
aggregation rules.When using the
all-field-info
andall-field-info-verbose
profiles which use the original field names, the field information does not get outputted.Example:
gives the output:
However,
gives:
Same thing happens when using the
../hayabusa-rules/hayabusa/builtin/Security/LogonLogoff/Logon/Sec_4625_Med_LogonFail_WrongPW_PW-Guessing_Cnt_Deprecated.yml
rule.I would like to output the same regardless of what profile is being used.
These are the original field names and no name conversion is done so they are expected when
all-field-info
profiles are used.In the future, I want to rename the fields like we do in
details
, etc.. but that will take some planning.(See issue: #1445)
The text was updated successfully, but these errors were encountered: