Merge pull request #239 from neu5ron/master

update helk config
2019-02-05 20:01:28 +01:00
parent 5092b1e603 046510f021
commit cc8a89b679
1 changed files with 3 additions and 3 deletions
@@ -48,11 +48,11 @@ fieldmappings:
    Destination:
        EventID=20: wmi_consumer_destination
    DestinationHostname: dst_host_name
-    DestinationIp: dst_ip
+    DestinationIp: dst_ip_addr
    DestinationIsIpv6: dst_is_ipv6
    DestinationPort: dst_port
    DestinationPortName: dst_port_name
-    Details: 
+    Details:
        EventID=13: registry_key_value
    Device: device_name
    EngineVersion: powershell.engine.version
@@ -130,7 +130,7 @@ fieldmappings:
    State:
        EventID=4: service_state
        EventID=16: sysmon_configuration_state
-    SubjectUserName: 
+    SubjectUserName:
        EventID=4624: user_reporter_name
        EventId=4648: user_name
        EventID=5140: user_name