fix selector syntax (#952)

panther-labs · Nov 17, 2023 · 407e6dc · 407e6dc
1 parent b5b0a49
commit 407e6dc
Showing 1 changed file with 20 additions and 20 deletions.
diff --git a/lookup_tables/greynoise/basic/riot_basic.yml b/lookup_tables/greynoise/basic/riot_basic.yml
@@ -221,44 +221,44 @@ LogTypeMap:
         - "src_ip"
     - LogType: Zeek.Conn
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.DNS
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.DPD
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.HTTP
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.Notice
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.NTP
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.Ssh
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.Ssl
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.Tunnel
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zeek.Weird
       Selectors:
-        - '$id.orig_h'
-        - '$id.resp_h'
+        - '$.id.orig_h'
+        - '$.id.resp_h'
     - LogType: Zendesk.Audit
       Selectors:
         - "ip_address"