Commit2b5f705

committed

upd qradar linux auditd config

1 parent6973aa3 commit2b5f705Copy full SHA for 2b5f705

File tree

-6

lines changed

-6

lines changed

Lines changed: 6 additions & 6 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`platform:Qradar`
`2`	`2`	`source:linux_auditd`
`3`		`-description:Text that describe current mapping`
	`3`	`+description:Auditd field mappings to QRadar default CEPs.`
`4`	`4`
`5`	`5`	`log_source:`
`6`	`6`	`devicetype:[11]`
`@@ -9,8 +9,8 @@ default_log_source:`
`9`	`9`	`devicetype:11`
`10`	`10`
`11`	`11`	`field_mapping:`
`12`		`-a0:a0`
`13`		`-a1:a1`
`14`		`-a2:a2`
`15`		`-a3:a3`
`16`		`-exe:exe`
	`12`	`+a0:Command`
	`13`	`+a1:Command`
	`14`	`+a2:Command`
	`15`	`+a3:Command`
	`16`	`+exe:Process Path`

Comments

(0)