| Value (RecordType) |
Member name |
Description |
Export for SIEM
Usage tips:
-
Splunk: place CSV in
$SPLUNK_HOME/etc/system/lookups (or app
directory), configure transforms.conf and
props.conf to lookup by
RecordType.
-
Elastic: use mapping JSON in an index template and
import the CSV via an ingest pipeline / enrich processor.
-
Logstash: drop the filter snippet into your pipeline
to translate RecordType → human-readable
audit_log_type.