Correct DAEMON_ABORT event.type to be ECS compliant

elastic · Jun 26, 2024 · 1058b00 · 1058b00
1 parent 3d7f13c
commit 1058b00
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/aucoalesce/normalizations.yaml b/aucoalesce/normalizations.yaml
@@ -1251,7 +1251,7 @@ normalizations:
       what: service
     ecs:
       <<: *ecs-process
-      type: stop
+      type: end
   # AUDIT_DAEMON_ACCEPT - Auditd accepted remote connection
   - record_types: DAEMON_ACCEPT
     action: remote-audit-connected