Correct DAEMON_END event.type to be ECS compliant

elastic · Jun 26, 2024 · 102965a · 102965a
1 parent 1058b00
commit 102965a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/aucoalesce/normalizations.yaml b/aucoalesce/normalizations.yaml
@@ -1287,7 +1287,7 @@ normalizations:
       what: service
     ecs:
       <<: *ecs-process
-      type: stop
+      type: end
   # AUDIT_DAEMON_ERR - Auditd internal error
   - record_types: DAEMON_ERR
     action: audit-error