Wazuh - Adding field to index pattern
Good day,
i wanna add a new field to my wazuh-alerts-* for specific events "A network share object was accessed." - Event ID 5140.
I have following as field in my events:
But i need the "Accesses" field as well:
Any hint how to achieve this?
data.win.eventdata.Accesses = ReadData
data.win.eventdata.accessMask = 0x1
Cheers & thanks in regards
Posted Oct 30, 2025, 4:07 PM UTC
36