From 9ce0289e622d5b190ea088c08cc89f4efcc3c225 Mon Sep 17 00:00:00 2001 From: Seth Grover Date: Wed, 8 Jan 2025 13:55:32 -0700 Subject: [PATCH] WIP of cisagov/Malcolm#356, normalize winlogbeats --- dashboards/templates/composable/component/miscbeat.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/dashboards/templates/composable/component/miscbeat.json b/dashboards/templates/composable/component/miscbeat.json index cd92f2c81..e4b4d31a3 100644 --- a/dashboards/templates/composable/component/miscbeat.json +++ b/dashboards/templates/composable/component/miscbeat.json @@ -623,13 +623,13 @@ "StartAddress": { "type": "keyword" }, "StartFunction": { "type": "keyword" }, "StartModule": { "type": "keyword" }, - "StartTime": { "type": "date" }, + "StartTime": { "type": "keyword" }, "StartType": { "type": "keyword" }, "State": { "type": "keyword" }, "StateTransition": { "type": "keyword" }, "Status": { "type": "keyword" }, "Status_Code": { "type": "keyword" }, - "StopTime": { "type": "date" }, + "StopTime": { "type": "keyword" }, "string": { "type": "keyword" }, "string2": { "type": "keyword" }, "SubcategoryGuid": { "type": "keyword" }, @@ -667,6 +667,7 @@ "TicketEncryptionType": { "type": "keyword" }, "TicketOptions": { "type": "keyword" }, "TimeStamp": { "type": "date" }, + "TimeSourceRefId": { "type": "keyword" }, "TimezoneBiasHour": { "type": "keyword" }, "TokenElevationType": { "type": "keyword" }, "TransactionId": { "type": "keyword" },