Set event.kind to 'event' vs 'alert' during ECS conversion

sysflow-telemetry / sysflow

SysFlow documentation and issues tracker

Other

45 stars 10 forks source link

Set event.kind to 'event' vs 'alert' during ECS conversion #82

Closed ghost closed 2 years ago

ghost commented 3 years ago

When handling records and converting to ECS, it would be cool to set the 'event.kind' field to indicate whether this created by a rule as an 'alert' or whether it is reported as base record, ie 'event'.

san-zrl commented 3 years ago

Done in the latest update to PR https://github.com/sysflow-telemetry/sf-processor/pull/38.