upd qradar linux auditd config

spsocprime · spsocprime · commit 2b5f70596f51 · 2024-05-22T14:00:27.000+03:00
diff --git a/uncoder-core/app/translator/mappings/platforms/qradar/linux_auditd.yml b/uncoder-core/app/translator/mappings/platforms/qradar/linux_auditd.yml
@@ -1,6 +1,6 @@
 platform: Qradar
 source: linux_auditd
-description: Text that describe current mapping
+description: Auditd field mappings to QRadar default CEPs.
 
 log_source:
   devicetype: [11]
@@ -9,8 +9,8 @@ default_log_source:
   devicetype: 11
 
 field_mapping:
-  a0:  a0
-  a1: a1
-  a2: a2
-  a3: a3
-  exe: exe
+  a0: Command
+  a1: Command
+  a2: Command
+  a3: Command
+  exe: Process Path
