add sample field

elastic · Sep 19, 2024 · f5ea10c · f5ea10c
1 parent aea7ecb
commit f5ea10c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/package/endpoint/data_stream/api/sample_event.json b/package/endpoint/data_stream/api/sample_event.json
@@ -176,7 +176,8 @@
                     "consumer_name": "ExampleConsumer",
                     "consumer_type": "CommandLineEventConsumer",
                     "consumer_details": "CommandLineEventConsumer{Name = \"ExampleConsumer\";};",
-                    "namespace": "root\\Microsoft\\Windows\\DeviceGuard"
+                    "namespace": "root\\Microsoft\\Windows\\DeviceGuard",
+                    "operation": "Win32_Process::Create"                
                 },
                 "summary": "VirtualAllocEx( charmap.exe, NULL, 0x10, COMMIT|RESERVE, R-X )"
             },