diff --git a/sigma/pipelines/logpoint/logpoint_mapping.py b/sigma/pipelines/logpoint/logpoint_mapping.py index 2d60c7c..989d444 100644 --- a/sigma/pipelines/logpoint/logpoint_mapping.py +++ b/sigma/pipelines/logpoint/logpoint_mapping.py @@ -2460,12 +2460,16 @@ } logpoint_m365_mapping = { - "eventSource": "event_source", + "Application": "application_id", + "eventSource": "event_source", "eventName": "alert_name", "workload": "application", "Workload": "application", "ResultStatus": "status", - "Operation": "operation", + "ObjectId": "object_id", + "Operation": "action", + "ResultStatus": "status", + "RequestType": "request_type", } # TODO: remove automatic snake conversions after pySigma framework is updated.