Clarify asset field names in shuffle-integration.md
Updated field names in Shuffle's alert context examples for clarity.
taylor_socfortress committed
Feb 20, 2026 at 12:55 UTC
683442dd9b1d4833ea3c603c782c0484feb2f331
1 file changed
+2
-2
docs/user/shuffle-integration.md
+2
-2
@@ -71,8 +71,8 @@ The most important concept for operators/admins:
71
72
That’s why CoPilot can support wildly different log types:
73
74
-- Wazuh endpoint events → asset might be `agent.name`
75
-- O365 events → asset might be `o365.recipients` or `user_id`
74
+- Wazuh endpoint events → asset might be `agent_name`
75
+- O365 events → asset might be `data_o365_recipients` or `user_id`
76
77
You choose which fields are “headline context” for that Source, and those same fields become the default “automation payload” for Shuffle.
78