Skip to content

Commit

Permalink
correct dns mappings with test passing
Browse files Browse the repository at this point in the history
  • Loading branch information
phaseshiftg committed Nov 7, 2022
1 parent db97ea9 commit c3c58f6
Show file tree
Hide file tree
Showing 4 changed files with 467 additions and 11 deletions.
9 changes: 3 additions & 6 deletions src/main/resources/OSMapping/dns/fieldmappings.yml
Original file line number Diff line number Diff line change
@@ -1,7 +1,4 @@
# this file provides pre-defined mappings for Sigma fields defined for all Sigma rules under windows log group to their corresponding ECS Fields.
fieldmappings:
EventID: event_uid
HiveName: unmapped.HiveName
fieldB: mappedB
fieldA1: mappedA
CommandLine: windows-event_data-CommandLine
record_type: dns-answers-type
query: dns-question-name
parent_domain: dns-question-registered_domain
14 changes: 9 additions & 5 deletions src/main/resources/OSMapping/dns/mappings.json
Original file line number Diff line number Diff line change
@@ -1,12 +1,16 @@
{
"properties": {
"windows-event_data-CommandLine": {
"dns-answers-type": {
"type": "alias",
"path": "CommandLine"
"path": "dns.answers.type"
},
"event_uid": {
"dns-question-name": {
"type": "alias",
"path": "EventID"
"path": "dns.question.name"
},
"dns-question-registered_domain": {
"type": "alias",
"path": "dns.question.registered_domain"
}
}
}
}
Loading

0 comments on commit c3c58f6

Please sign in to comment.