updated sample results

bhargavnariyanicrest · Dec 25, 2024 · 11f2bbd · 11f2bbd
1 parent 809c75a
commit 11f2bbd
Show file tree

Hide file tree

Showing 2 changed files with 429 additions and 146 deletions.
diff --git a/tenable_io/assets/logs/tenable-io.yaml b/tenable_io/assets/logs/tenable-io.yaml
@@ -3,19 +3,44 @@ metric_id: tenable-io
 backend_only: false
 facets:
   - groups:
-      - User
-    name: User Name
-    path: usr.name
+      - Event
+    name: Event Name
+    path: evt.name
     source: log
   - groups:
-      - User
-    name: User ID
-    path: usr.id
+      - Geoip
+    name: City Name
+    path: network.client.geoip.city.name
     source: log
   - groups:
-      - Event
-    name: Event Name
-    path: evt.name
+      - Geoip
+    name: Continent Code
+    path: network.client.geoip.continent.code
+    source: log
+  - groups:
+      - Geoip
+    name: Continent Name
+    path: network.client.geoip.continent.name
+    source: log
+  - groups:
+      - Geoip
+    name: Country ISO Code
+    path: network.client.geoip.country.iso_code
+    source: log
+  - groups:
+      - Geoip
+    name: Country Name
+    path: network.client.geoip.country.name
+    source: log
+  - groups:
+      - Geoip
+    name: Subdivision ISO Code
+    path: network.client.geoip.subdivision.iso_code
+    source: log
+  - groups:
+      - Geoip
+    name: Subdivision Name
+    path: network.client.geoip.subdivision.name
     source: log
   - groups:
       - Web Access
@@ -27,6 +52,16 @@ facets:
     name: Client Port
     path: network.client.port
     source: log
+  - groups:
+      - User
+    name: User ID
+    path: usr.id
+    source: log
+  - groups:
+      - User
+    name: User Name
+    path: usr.name
+    source: log
 pipeline:
   type: pipeline
   name: Tenable.io
@@ -107,7 +142,7 @@ pipeline:
           preserveSource: false
           overrideOnConflict: false
         - type: attribute-remapper
-          name: Map `port.port` to `network.clienp.port`
+          name: Map `port.port` to `network.client.port`
           enabled: true
           sources:
             - port.port