diff --git a/stix_shifter_modules/qradar/stix_translation/json/aql_events_fields.json b/stix_shifter_modules/qradar/stix_translation/json/aql_events_fields.json index e872fc321..6392b9131 100644 --- a/stix_shifter_modules/qradar/stix_translation/json/aql_events_fields.json +++ b/stix_shifter_modules/qradar/stix_translation/json/aql_events_fields.json @@ -47,18 +47,18 @@ "DOMAINNAME(domainid) as qradardomain", "\"DNS Request Domain\" as dnsdomainname", "EventID", - "Image", - "ParentImage", + "\"Process Path\" as Image", + "\"Parent Process Path\" as ParentImage", "\"Process CommandLine\" as ProcessCommandLine", - "ParentCommandLine", - "TargetImage", + "\"Parent Command\" as ParentCommandLine", + "\"Target Process Path\" as TargetImage", "Message", "\"Registry Value Name\" as RegistryValueName", "\"IMP Hash\" as IMPHash", - "ServiceFileName", + "\"Service Filename\" as ServiceFileName", "\"Registry Key\" as RegistryKey", "ObjectName", - "UrlHost", + "\"URL Host\" as UrlHost", "\"Process Name\" as ProcessName", "\"Process ID\" as ProcessId", "\"Parent Process ID\" as ParentProcessId",