Justin Ibarra
97ee8cc9ac
* Refresh beats and ecs schemas and default to use latest to validate * remove incorrect ecs_version from zoom rule * remove stale ecs_version from rules
14 lines
218 B
JSON
14 lines
218 B
JSON
{
|
|
"endgame-*": {
|
|
"endgame": {
|
|
"metadata": {
|
|
"type": "keyword"
|
|
},
|
|
"event_subtype_full": "keyword"
|
|
}
|
|
},
|
|
"winlogbeat-*": {
|
|
"winlog.event_data.OriginalFileName": "keyword"
|
|
}
|
|
}
|