sigma-rules/etc/non-ecs-schema.json

{
  "endgame-*": {
    "endgame": {
      "metadata": {
        "type": "keyword"
      },
      "event_subtype_full": "keyword"
    }
  },
  "winlogbeat-*": {
    "winlog.event_data.OriginalFileName": "keyword"
  }
}