I am not sure I am making the correct assumption but I thought that if I added
processors: - add_host_metadata: - add_cloud_metadata: ~ - add_fields: when.network.source.ip: 10.10.10.10/24 fields: source.geo.location: lat: something.number_here lon: -something.number_here target: ''
to the filebeat yml, that I would be able to see the machine appear in the SIEM's Network Map tab - but that's not happening. Question is, was I wrong to believe that adding those fields would make the machine show up in the Network Map? Or am I missing a step somewhere?
Also, wasnt sure what value "target" would receive.