Skip to content

Commit 841428f

Browse files
mjabascal10mjabascal10
committed
feat(windows-visualizations): update field names in Windows visualizations for consistency
1 parent 03eee3b commit 841428f

File tree

2 files changed

+230
-0
lines changed

2 files changed

+230
-0
lines changed

‎backend/src/main/resources/config/liquibase/changelog/20260212004_update_windows_visualizations.xml‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
6+
http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
7+
8+
<changeSet id="20260212004" author="Manuel Abascal">
9+
10+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
11+
<![CDATA[
12+
13+
------------------------------------------------------------------
14+
-- AccessList
15+
-------------------------------------------------------------------
16+
UPDATE utm_visualization
17+
SET filters = REPLACE(filters,
18+
'"field":"log.winlog.event_data.AccessList.keyword"',
19+
'"field":"log.winlogEventDataAccessList.keyword"')
20+
WHERE filters LIKE '%"field":"log.winlog.event_data.AccessList.keyword"%';
21+
22+
UPDATE utm_visualization
23+
SET aggregation = REPLACE(aggregation,
24+
'"field":"log.winlog.event_data.AccessList.keyword"',
25+
'"field":"log.winlogEventDataAccessList.keyword"')
26+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.AccessList.keyword"%';
27+
28+
29+
------------------------------------------------------------------
30+
-- SubjectLogonId
31+
-------------------------------------------------------------------
32+
UPDATE utm_visualization
33+
SET filters = REPLACE(filters,
34+
'"field":"log.winlog.event_data.SubjectLogonId.keyword"',
35+
'"field":"log.winlogEventDataSubjectLogonId.keyword"')
36+
WHERE filters LIKE '%"field":"log.winlog.event_data.SubjectLogonId.keyword"%';
37+
38+
UPDATE utm_visualization
39+
SET aggregation = REPLACE(aggregation,
40+
'"field":"log.winlog.event_data.SubjectLogonId.keyword"',
41+
'"field":"log.winlogEventDataSubjectLogonId.keyword"')
42+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.SubjectLogonId.keyword"%';
43+
44+
45+
------------------------------------------------------------------
46+
-- ProviderName
47+
-------------------------------------------------------------------
48+
UPDATE utm_visualization
49+
SET filters = REPLACE(filters,
50+
'"field":"log.winlog.event_data.ProviderName.keyword"',
51+
'"field":"log.winlogEventDataProviderName.keyword"')
52+
WHERE filters LIKE '%"field":"log.winlog.event_data.ProviderName.keyword"%';
53+
54+
UPDATE utm_visualization
55+
SET aggregation = REPLACE(aggregation,
56+
'"field":"log.winlog.event_data.ProviderName.keyword"',
57+
'"field":"log.winlogEventDataProviderName.keyword"')
58+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.ProviderName.keyword"%';
59+
60+
61+
------------------------------------------------------------------
62+
-- AlgorithmName
63+
-------------------------------------------------------------------
64+
UPDATE utm_visualization
65+
SET filters = REPLACE(filters,
66+
'"field":"log.winlog.event_data.AlgorithmName.keyword"',
67+
'"field":"log.winlogEventDataAlgorithmName.keyword"')
68+
WHERE filters LIKE '%"field":"log.winlog.event_data.AlgorithmName.keyword"%';
69+
70+
UPDATE utm_visualization
71+
SET aggregation = REPLACE(aggregation,
72+
'"field":"log.winlog.event_data.AlgorithmName.keyword"',
73+
'"field":"log.winlogEventDataAlgorithmName.keyword"')
74+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.AlgorithmName.keyword"%';
75+
76+
77+
------------------------------------------------------------------
78+
-- KeyType
79+
-------------------------------------------------------------------
80+
UPDATE utm_visualization
81+
SET filters = REPLACE(filters,
82+
'"field":"log.winlog.event_data.KeyType.keyword"',
83+
'"field":"log.winlogEventDataKeyType.keyword"')
84+
WHERE filters LIKE '%"field":"log.winlog.event_data.KeyType.keyword"%';
85+
86+
UPDATE utm_visualization
87+
SET aggregation = REPLACE(aggregation,
88+
'"field":"log.winlog.event_data.KeyType.keyword"',
89+
'"field":"log.winlogEventDataKeyType.keyword"')
90+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.KeyType.keyword"%';
91+
92+
93+
------------------------------------------------------------------
94+
-- Operation
95+
-------------------------------------------------------------------
96+
UPDATE utm_visualization
97+
SET filters = REPLACE(filters,
98+
'"field":"log.winlog.event_data.Operation.keyword"',
99+
'"field":"log.winlogEventDataOperation.keyword"')
100+
WHERE filters LIKE '%"field":"log.winlog.event_data.Operation.keyword"%';
101+
102+
UPDATE utm_visualization
103+
SET aggregation = REPLACE(aggregation,
104+
'"field":"log.winlog.event_data.Operation.keyword"',
105+
'"field":"log.winlogEventDataOperation.keyword"')
106+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.Operation.keyword"%';
107+
108+
109+
------------------------------------------------------------------
110+
-- ReturnCode
111+
-------------------------------------------------------------------
112+
UPDATE utm_visualization
113+
SET filters = REPLACE(filters,
114+
'"field":"log.winlog.event_data.ReturnCode.keyword"',
115+
'"field":"log.winlogEventDataReturnCode.keyword"')
116+
WHERE filters LIKE '%"field":"log.winlog.event_data.ReturnCode.keyword"%';
117+
118+
UPDATE utm_visualization
119+
SET aggregation = REPLACE(aggregation,
120+
'"field":"log.winlog.event_data.ReturnCode.keyword"',
121+
'"field":"log.winlogEventDataReturnCode.keyword"')
122+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.ReturnCode.keyword"%';
123+
124+
125+
------------------------------------------------------------------
126+
-- opcode → log.winlogOpcode.keyword
127+
-------------------------------------------------------------------
128+
UPDATE utm_visualization
129+
SET filters = REPLACE(filters,
130+
'"field":"log.winlog.opcode.keyword"',
131+
'"field":"log.winlogOpcode.keyword"')
132+
WHERE filters LIKE '%"field":"log.winlog.opcode.keyword"%';
133+
134+
UPDATE utm_visualization
135+
SET aggregation = REPLACE(aggregation,
136+
'"field":"log.winlog.opcode.keyword"',
137+
'"field":"log.winlogOpcode.keyword"')
138+
WHERE aggregation LIKE '%"field":"log.winlog.opcode.keyword"%';
139+
140+
141+
------------------------------------------------------------------
142+
-- param2
143+
-------------------------------------------------------------------
144+
UPDATE utm_visualization
145+
SET filters = REPLACE(filters,
146+
'"field":"log.winlog.event_data.param2.keyword"',
147+
'"field":"log.winlogEventDataParam2.keyword"')
148+
WHERE filters LIKE '%"field":"log.winlog.event_data.param2.keyword"%';
149+
150+
UPDATE utm_visualization
151+
SET aggregation = REPLACE(aggregation,
152+
'"field":"log.winlog.event_data.param2.keyword"',
153+
'"field":"log.winlogEventDataParam2.keyword"')
154+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.param2.keyword"%';
155+
156+
157+
------------------------------------------------------------------
158+
-- TaskName
159+
-------------------------------------------------------------------
160+
UPDATE utm_visualization
161+
SET filters = REPLACE(filters,
162+
'"field":"log.winlog.event_data.TaskName.keyword"',
163+
'"field":"log.winlogEventDataTaskName.keyword"')
164+
WHERE filters LIKE '%"field":"log.winlog.event_data.TaskName.keyword"%';
165+
166+
UPDATE utm_visualization
167+
SET aggregation = REPLACE(aggregation,
168+
'"field":"log.winlog.event_data.TaskName.keyword"',
169+
'"field":"log.winlogEventDataTaskName.keyword"')
170+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.TaskName.keyword"%';
171+
172+
173+
------------------------------------------------------------------
174+
-- ClientProcessId
175+
-------------------------------------------------------------------
176+
UPDATE utm_visualization
177+
SET filters = REPLACE(filters,
178+
'"field":"log.winlog.event_data.ClientProcessId.keyword"',
179+
'"field":"log.winlogEventDataClientProcessId.keyword"')
180+
WHERE filters LIKE '%"field":"log.winlog.event_data.ClientProcessId.keyword"%';
181+
182+
UPDATE utm_visualization
183+
SET aggregation = REPLACE(aggregation,
184+
'"field":"log.winlog.event_data.ClientProcessId.keyword"',
185+
'"field":"log.winlogEventDataClientProcessId.keyword"')
186+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.ClientProcessId.keyword"%';
187+
188+
189+
------------------------------------------------------------------
190+
-- ParentProcessId
191+
-------------------------------------------------------------------
192+
UPDATE utm_visualization
193+
SET filters = REPLACE(filters,
194+
'"field":"log.winlog.event_data.ParentProcessId.keyword"',
195+
'"field":"log.winlogEventDataParentProcessId.keyword"')
196+
WHERE filters LIKE '%"field":"log.winlog.event_data.ParentProcessId.keyword"%';
197+
198+
UPDATE utm_visualization
199+
SET aggregation = REPLACE(aggregation,
200+
'"field":"log.winlog.event_data.ParentProcessId.keyword"',
201+
'"field":"log.winlogEventDataParentProcessId.keyword"')
202+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.ParentProcessId.keyword"%';
203+
204+
205+
------------------------------------------------------------------
206+
-- FQDN
207+
-------------------------------------------------------------------
208+
UPDATE utm_visualization
209+
SET filters = REPLACE(filters,
210+
'"field":"log.winlog.event_data.FQDN.keyword"',
211+
'"field":"log.winlogEventDataFQDN.keyword"')
212+
WHERE filters LIKE '%"field":"log.winlog.event_data.FQDN.keyword"%';
213+
214+
UPDATE utm_visualization
215+
SET aggregation = REPLACE(aggregation,
216+
'"field":"log.winlog.event_data.FQDN.keyword"',
217+
'"field":"log.winlogEventDataFQDN.keyword"')
218+
WHERE aggregation LIKE '%"field":"log.winlog.event_data.FQDN.keyword"%';
219+
220+
221+
222+
223+
]]>
224+
</sql>
225+
226+
</changeSet>
227+
228+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/master.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,8 @@
421421

422422
<include file="/config/liquibase/changelog/20260212003_update_windows_visualizations.xml" relativeToChangelogFile="false"/>
423423

424+
<include file="/config/liquibase/changelog/20260212004_update_windows_visualizations.xml" relativeToChangelogFile="false"/>
425+
424426

425427

426428
</databaseChangeLog>

0 commit comments

Comments
 (0)