evtx fields for template

mmguero-dev · Dec 12, 2024 · 915367b · 915367b
1 parent 1008803
commit 915367b
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/dashboards/templates/composable/component/evtx.json b/dashboards/templates/composable/component/evtx.json
@@ -41,6 +41,7 @@
                 "EventData.Category_ID": { "type": "keyword" },
                 "EventData.Category_Name": { "type": "keyword" },
                 "EventData.CategoryId": { "type": "keyword" },
+                "EventData.ChangeType": { "type": "keyword" },
                 "EventData.ChannelName": { "type": "keyword" },
                 "EventData.ClientIP": { "type": "keyword" },
                 "EventData.ClientMode": { "type": "integer" },
@@ -272,6 +273,7 @@
                 "EventData.Signature_Version": { "type": "keyword" },
                 "EventData.SignatureStatus": { "type": "keyword" },
                 "EventData.Signed": { "type": "keyword" },
+                "EventData.Source": { "type": "keyword" },
                 "EventData.Source_ID": { "type": "keyword" },
                 "EventData.Source_Name": { "type": "keyword" },
                 "EventData.SourceAddress": { "type": "keyword" },