Describe the bug
While using --siem-friendly output, within output.ndjson, we find findings like this:

{"WAF": {"url": "https://www.thisismysite.com/", "host": "www.thisismysite.com", "WAF": "This is our waf"}}

Expected behavior
Following the capitalization scheme used for event types, the second "WAF" should be lowercased because it is not an event type.