FEATURE: Add Events column layout for event.module system #12628

Security-Onion-Solutions · Mar 20, 2024 · 778997b · 778997b
1 parent 655d3e3
commit 778997b
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
@@ -1064,6 +1064,15 @@ soc:
         -  event.action
         -  event.outcome
         -  event.dataset
+      ':system:':
+        -  soc_timestamp
+        -  process.name
+        -  process.pid
+        -  user.effective.name
+        -  user.name
+        -  system.auth.sudo.command
+        -  event.dataset
+        -  message
     server:
       bindAddress: 0.0.0.0:9822
       baseUrl: /