WIP of cisagov#356, normalize winlogbeats

mmguero-dev · Jan 8, 2025 · 9ce0289 · 9ce0289
1 parent 413eca5
commit 9ce0289
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/dashboards/templates/composable/component/miscbeat.json b/dashboards/templates/composable/component/miscbeat.json
@@ -623,13 +623,13 @@
                     "StartAddress": { "type": "keyword" },
                     "StartFunction": { "type": "keyword" },
                     "StartModule": { "type": "keyword" },
-                    "StartTime": { "type": "date" },
+                    "StartTime": { "type": "keyword" },
                     "StartType": { "type": "keyword" },
                     "State": { "type": "keyword" },
                     "StateTransition": { "type": "keyword" },
                     "Status": { "type": "keyword" },
                     "Status_Code": { "type": "keyword" },
-                    "StopTime": { "type": "date" },
+                    "StopTime": { "type": "keyword" },
                     "string": { "type": "keyword" },
                     "string2": { "type": "keyword" },
                     "SubcategoryGuid": { "type": "keyword" },
@@ -667,6 +667,7 @@
                     "TicketEncryptionType": { "type": "keyword" },
                     "TicketOptions": { "type": "keyword" },
                     "TimeStamp": { "type": "date" },
+                    "TimeSourceRefId": { "type": "keyword" },
                     "TimezoneBiasHour": { "type": "keyword" },
                     "TokenElevationType": { "type": "keyword" },
                     "TransactionId": { "type": "keyword" },