hayabusa
hayabusa copied to clipboard
Support for `Provider_name` and `Data[x]` notation to the field mapping
Currently, the field mapping feature does not support following point:
-
Provider_name
matching- e.g. Since the Application log has multiple
Provider_names
, we need to convert the field value only when theProvider_name
matches.(in addition toChannel
,EventID
)
- e.g. Since the Application log has multiple
-
Data[x]
notation filed mapping
We want to support following rule/field conversion, so I'll implement above point.
- https://github.com/Yamato-Security/hayabusa-rules/pull/666