add fields

spsocprime · spsocprime · commit bd83e64dd971 · 2024-05-22T16:36:53.000+03:00
diff --git a/uncoder-core/app/translator/mappings/platforms/qradar/linux_auditd.yml b/uncoder-core/app/translator/mappings/platforms/qradar/linux_auditd.yml
@@ -13,4 +13,9 @@ field_mapping:
   a1: Command
   a2: Command
   a3: Command
-  exe: Process Path
+  exe: Process Path
+  Process CommandLine: Command
+  Image: Process Path
+  username: username
+  LogonId: Logon ID
+  ParentImage: Parent Process Path
