Cannot define custom string in the custom pipeline mapping

[ndex11]

Command: sigma convert -t qradar -p qradar_pipeline.yaml rules\windows\dns_query\dns_query_win_anonymfiles_com.yml

Error: Error while conversion: The QRadar savedsearches Sigma backend supports only the following fields for process_creation log source

I think there should be something after "log source" in the error message but there is not.

Not working: name: Qradar Pipeline priority: 100 transformations:

• id: field_mapping type: field_name_mapping mapping: QueryName: "Domain Name"

Not working: name: Qradar Pipeline priority: 100 transformations:

• id: field_mapping type: field_name_mapping mapping: QueryName: test

Working: name: Qradar Pipeline priority: 100 transformations:

• id: field_mapping type: field_name_mapping mapping: QueryName: Image

Working: name: Qradar Pipeline priority: 100 transformations:

• id: field_mapping type: field_name_mapping mapping: QueryName: "Image"

[thomaspatzke]

It's a QRadar backend issue, moving it to the project.

[thomaspatzke]

Can't move across orgs, please reopen in this repository.