security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

better description and event.outcome

Browse Source
This commit is contained in:
Tiago Faria
2020-04-29 23:59:26 +01:00
committed by GitHub
parent ac4a2b1f26
commit dfdb5b9550
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/config/ecs-cloudtrail.yml
+3 -3
View File
@@ -1,4 +1,4 @@
title: Elastic Common Schema mapping for cloudtrail logs
title: Elastic Common Schema and Elastic Exported Fields mapping for AWS CloudTrail logs
order: 20
backends:
- es-qs
@@ -43,7 +43,7 @@ fieldmappings:
userIdentity.userName: user.name
vpcEndpointId: aws.cloudtrail.vpc_endpoint_id
overrides:
- field: event_outcome
- field: event.outcome
value: failure
regexes:
- (\(aws.cloudtrail.error_message.keyword:.* event.action:\"ConsoleLogin\"\))
@@ -53,4 +53,4 @@ overrides:
- (\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_message.keyword:\*\))
- (\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_code.keyword:\*\))
- (\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_message.keyword:\*\))
- (\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_code.keyword:\*\))
- (\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_code.keyword:\*\))