FEATURE: Add Events column layout for event.dataset system.auth #12628

Security-Onion-Solutions · Mar 20, 2024 · 44c36e0 · 44c36e0
1 parent 655d3e3
commit 44c36e0
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/salt/soc/merged.map.jinja b/salt/soc/merged.map.jinja
@@ -85,6 +85,7 @@
 {% do SOCMERGED.config.eventFields.update({':endpoint:events.process': SOCMERGED.config.eventFields.pop(':endpoint:events_x_process') }) %}
 {% do SOCMERGED.config.eventFields.update({':endpoint:events.registry': SOCMERGED.config.eventFields.pop(':endpoint:events_x_registry') }) %}
 {% do SOCMERGED.config.eventFields.update({':endpoint:events.security': SOCMERGED.config.eventFields.pop(':endpoint:events_x_security') }) %}
+{% do SOCMERGED.config.eventFields.update({':system:system.auth': SOCMERGED.config.eventFields.pop(':system:system_x_auth') }) %}
 {% set standard_eventFields = SOCMERGED.config.pop('eventFields') %}
 {%   do SOCMERGED.config.server.client.hunt.update({'eventFields': standard_eventFields}) %}
 {%   do SOCMERGED.config.server.client.dashboards.update({'eventFields': standard_eventFields}) %}