Brent Murphy
598e807a5c
* [New Rule] O365 Teams Custom Application Interaction Allowed * rebrand to m365, still needed non ecs schema * Update non-ecs-schema.json
17 lines
278 B
JSON
17 lines
278 B
JSON
{
|
|
"endgame-*": {
|
|
"endgame": {
|
|
"metadata": {
|
|
"type": "keyword"
|
|
},
|
|
"event_subtype_full": "keyword"
|
|
}
|
|
},
|
|
"winlogbeat-*": {
|
|
"winlog.event_data.OriginalFileName": "keyword"
|
|
},
|
|
"filebeat-*": {
|
|
"o365.audit.NewValue": "keyword"
|
|
}
|
|
}
|