Better display of EDR name
@@ -23,7 +23,11 @@ filter {
if [pstools][psx][security_products] {
grok {
- match => { "[pstools][psx][security_products]" => "%{GREEDYDATA}Product:\t %{GREEDYDATA:[pstools][psx][edr_name]}" }
+ match => { "[pstools][psx][security_products]" => "%{GREEDYDATA}Vendor:\t (?<[pstools][psx][edr_name]>(.|\r|\n)*)" }
+ }
+ # clean up the tab and "Product" string
+ mutate {
+ gsub => ["[pstools][psx][edr_name]", "\n Product:\t", " -"]
}
# now duplicate this specific log line to record into bluecheck index - remove useless info for that index
# also copy the value from [pstools][psx][security_products] to [message]
