Can anyone please explain what does it means
I have Symantec antimalware logs on index pattern logstash-sepm*. In json document I don't have event.category field but I want to create a correlation rule what if the same malware detects on multiple hosts. So I have to first select a value present in event.category like "process" or anything else. I want to declear field "type" as my event.catoegory but it deoesnot work.
Can anyone please explain me how can I define custom event.category here ^