For powershell_operational datastream the translate_sid processor is missing the mandatory field
processors:
- translate_sid:
account_name_target: winlog.event_data._MemberUserName
domain_target: winlog.event_data._MemberDomain
account_type_target: winlog.event_data._MemberAccountType
ignore_missing: true
ignore_failure: true
should be:
- translate_sid:
field: winlog.event_data.MemberSid
account_name_target: winlog.event_data._MemberUserName
domain_target: winlog.event_data._MemberDomain
account_type_target: winlog.event_data._MemberAccountType
ignore_missing: true
ignore_failure: true
For
powershell_operationaldatastream thetranslate_sidprocessor is missing the mandatoryfieldshould be: