Merge pull request #483 from Security-Onion-Solutions/2.4/dnsmapping

Fix dns.query.name
Security-Onion-Solutions · Nov 2, 2023 · c9419d1 · c9419d1
2 parents 824f394 + 9b6110e
commit c9419d1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/so-soctopus/so-soctopus/playbook/securityonion-baseline.yml b/so-soctopus/so-soctopus/playbook/securityonion-baseline.yml
@@ -232,8 +232,8 @@ fieldmappings:
     username: user.name
     uid: user.uid
     sid: rule.uuid
-    query: query
     answer: answers
+    query: dns.query.name
     src_ip: destination.ip.keyword
     src_port: source.port
     dst_ip: destination.ip.keyword