Skip to content

Commit

Permalink
fix(Intakes): update documentations for intakes
Browse files Browse the repository at this point in the history
  • Loading branch information
squioc committed Dec 2, 2024
1 parent fb0b271 commit bf614bb
Show file tree
Hide file tree
Showing 22 changed files with 11,164 additions and 592 deletions.

Large diffs are not rendered by default.

Large diffs are not rendered by default.

Large diffs are not rendered by default.

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
Expand Up @@ -1165,7 +1165,6 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
"id": "111111111111111"
},
"crowdstrike": {
"base_filename": "svchost.exe",
"customer_id": "222222222222222222222"
},
"file": {
Expand All @@ -1181,6 +1180,10 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
"platform": "win"
}
},
"process": {
"command_line": "svchost.exe",
"name": "svchost.exe"
},
"related": {
"ip": [
"4.3.2.1"
Expand Down Expand Up @@ -2396,7 +2399,6 @@ The following table lists the fields that are extracted, normalized under the EC
|`@timestamp` | `date` | Date/time when the event originated. |
|`agent.id` | `keyword` | Unique identifier of this agent. |
|`agent.version` | `keyword` | Version of the agent. |
|`crowdstrike.base_filename` | `keyword` | Base Filename |
|`crowdstrike.customer_id` | `keyword` | Customer ID (cid) |
|`crowdstrike.gateway_ip` | `ip` | Gateway IP |
|`crowdstrike.gateway_mac` | `keyword` | Gateway MAC |
Expand Down

Large diffs are not rendered by default.

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,7 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
},
"user": {
"name": "root"
},
"wallix": {}
}
}
```
Expand All @@ -68,8 +67,7 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
},
"user": {
"name": "wabuser"
},
"wallix": {}
}
}
```
Expand Down Expand Up @@ -155,21 +153,6 @@ This section demonstrates how the raw logs will be transformed by our parsers. I
```


=== "rexec.json"

```json

{
"message": "rexec line 15: Deprecated option UsePrivilegeSeparation",
"event": {
"provider": "sshd"
},
"wallix": {}
}
```


=== "session_integrity.json"

```json
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -40,14 +40,6 @@ In this section, you will find examples of raw logs as generated natively by the



=== "rexec"

```
rexec line 15: Deprecated option UsePrivilegeSeparation
```



=== "session_integrity"

```
Expand Down
Loading

0 comments on commit bf614bb

Please sign in to comment.