trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update transforms.conf

Browse Source
This commit is contained in:
Chris Long
2020-06-01 21:46:22 -07:00
committed by GitHub
parent da366bcce6
commit c55b3d6def
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
Vagrant/resources/splunk_server/transforms.conf
View File

@@ -14,8 +14,8 @@ DEST_KEY = MetaData:Host
REGEX = hostIdentifier\"\:\"([^\"]+)\"
FORMAT = host::$1
[setnull]
REGEX = Error\scasting
[osquery_status_filter]
REGEX = (POST\srequest\sto\sURI|Refreshing\sconfiguration|not\sattaching|Executing\sscheduled\squery|Error\scasting)
DEST_KEY = queue
FORMAT = nullQueue