updated event.dataset to "c2"
# In this file we configure the logstash filtes for CobaltStrike teamserver logs
#
# Author: Outflank B.V. / Marc Smeets
+# Contributor: Lorenzo Bernardi
#
filter {
@@ -333,7 +334,7 @@ filter {
"[event][kind]" => "event"
"[event][category]" => "host"
"[event][module]" => "redelk"
- "[event][dataset]" => "cslog"
+ "[event][dataset]" => "c2"
"[event][action]" => "%{[c2][log][type]}"
}
copy => {
