-
Notifications
You must be signed in to change notification settings - Fork 44
Open
Labels
Description
The event.category field is missing from Asset Discovery logs, which is essential for better event classification. This field is used by SIEM Readiness for categorizing logs.
The following allowed values should be used for the event.category field:
- api
- authentication
- configuration
- database
- driver
- file
- host
- iam
- intrusion_detection
- library
- malware
- network
- package
- process
- registry
- session
- threat
- vulnerability
- web
optional: event.type and perhaps other essential fields should be considered as well
Reactions are currently unavailable