paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-11-04 05:43:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

corrected field name case in decoder-linux-sysmon.xml

Browse Source 
fixed incorrect case on system.eventId to system.eventID
This commit is contained in:
Kevin Branch
2023-06-23 17:51:09 -04:00
committed by GitHub
parent e7443b2f28
commit e051121c8b
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Sysmon Linux/decoder-linux-sysmon.xml
View File

@@ -7,7 +7,7 @@
<decoder name="sysmon-linux-child"> <decoder name="sysmon-linux-child">
<parent>sysmon-linux</parent> <parent>sysmon-linux</parent>
<regex offset="after_parent">\pEventID\p(\d+)\p/EventID\p</regex> <regex offset="after_parent">\pEventID\p(\d+)\p/EventID\p</regex>
<order>system.eventId</order> <order>system.eventID</order>
</decoder> </decoder>
<!-- keywords --> <!-- keywords -->