Files
DetectionLab/Vagrant/resources/splunk_server/transforms.conf
2017-12-11 08:49:25 -08:00

11 lines
240 B
Plaintext

[powershell_rename_host]
DEST_KEY = MetaData:Host
SOURCE_KEY = MetaData:Source
REGEX = PowerShell_transcript\.([^\S]+)\.
FORMAT = host::$1
[wef_computername_as_host]
DEST_KEY = MetaData:Host
REGEX = (?m)ComputerName=(.+)
FORMAT = host::$1