File tree Expand file tree Collapse file tree 1 file changed +4
-2
lines changed Expand file tree Collapse file tree 1 file changed +4
-2
lines changed Original file line number Diff line number Diff line change @@ -35,8 +35,10 @@ Here's the recommended approach for converting an existing implementation to {ec
3535
3636 - Review your original event data again
3737 - Consider populating the field based on additional meta-data such as static
38- information (e.g. add `event.type:syslog` even if syslog events don't mention this fact),
39- or information gathered from the environment (e.g. host information).
38+ information (e.g. add `event.category:authentication` even if your auth events
39+ don't mention the word "authentication")
40+ - Consider capturing additional environment meta-data, such as information about the
41+ host, container or cloud instance.
4042
4143. Review other extended fields from any field set you are already using, and
4244 attempt to populate it as well.
You can’t perform that action at this time.
0 commit comments