Cargill / OpenSIEM-Logstash-Parsing

SIEM Logstash parsing for more than hundred technologies
Apache License 2.0
181 stars 40 forks source link

reordered related ip and host #520

Closed brian-grabau closed 2 months ago

brian-grabau commented 2 months ago

Description

Related hosts copied bad data to related fields before the DNS enrichment cleaned up the bad data. Moving related IP and Related host high up on the enrichment process ensures bad data is not copied to related fields and that complete data is copied to related fields.

Related Issues

Are there any Issues to this PR?

Todos

Are there any additional items that must be completed before this PR gets merged in?