processors:
  - set:
      field: event.kind
      value: alert
  - append:
      field: event.category
      value: [malware]
  - append:
      field: event.type
      value: [info]
  - set:
      field: event.dataset
      value: crowdstrike.falcon_endpoint
  - set:
      field: agent.type
      value: falcon
  - convert:
      field: crowdstrike.event.LocalIP
      target_field: source.ip
      type: ip
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.ProcessId
      target_field: process.pid
      ignore_failure: true
      type: long
      ignore_missing: true
  - convert:
      field: crowdstrike.event.ParentImageFileName
      target_field: process.parent.executable
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.ParentCommandLine
      target_field: process.parent.command_line
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.PatternDispositionDescription
      target_field: event.action
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.FalconHostLink
      target_field: event.url
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.Severity
      target_field: event.severity
      type: long
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.DetectDescription
      target_field: message
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.FileName
      target_field: process.name
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.UserName
      target_field: user.name
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.MachineDomain
      target_field: user.domain
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.SensorId
      target_field: agent.id
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.ComputerName
      target_field: host.name
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.SHA256String
      target_field: file.hash.sha256
      type: string
      ignore_failure: true
      ignore_missing: true
  - append:
      field: related.hash
      value: "{{file.hash.sha256}}"
      allow_duplicates: false
      ignore_failure: true
      if: ctx?.file?.hash?.sha256 != null && ctx?.file?.hash?.sha256 != "" && !(/^0+$/.matcher(ctx.file.hash.sha256).matches())
  - convert:
      field: crowdstrike.event.MD5String
      target_field: file.hash.md5
      type: string
      ignore_failure: true
      ignore_missing: true
  - append:
      field: related.hash
      value: "{{file.hash.md5}}"
      allow_duplicates: false
      ignore_failure: true
      if: ctx?.file?.hash?.md5 != null && ctx?.file?.hash?.md5 != "" && !(/^0+$/.matcher(ctx.file.hash.md5).matches())
  - convert:
      field: crowdstrike.event.SHA1String
      target_field: file.hash.sha1
      type: string
      ignore_failure: true
      ignore_missing: true
  - append:
      field: related.hash
      value: "{{file.hash.sha1}}"
      allow_duplicates: false
      ignore_failure: true
      if: ctx?.file?.hash?.sha1 != null && ctx?.file?.hash?.sha1 != "" && !(/^0+$/.matcher(ctx.file.hash.sha1).matches())
  - convert:
      field: crowdstrike.event.DetectName
      target_field: rule.name
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.DetectDescription
      target_field: rule.description
      type: string
      ignore_failure: true
      ignore_missing: true
  - convert:
      field: crowdstrike.event.Technique
      target_field: threat.technique.name
      type: string
      ignore_failure: true
      ignore_missing: true
  - lowercase:
      field: threat.technique.name
      ignore_missing: true
      ignore_failure: true
  - convert:
      field: crowdstrike.event.Tactic
      target_field: threat.tactic.name
      type: string
      ignore_failure: true
      ignore_missing: true
  - lowercase:
      field: threat.tactic.name
      ignore_missing: true
      ignore_failure: true
