tweak

defensivedepth · defensivedepth · commit f3a0f66b6a6e · 2025-05-29T16:07:14.000-04:00
diff --git a/playbook/dev/sigma/category/process_creation.yaml b/playbook/dev/sigma/category/process_creation.yaml
@@ -138,7 +138,7 @@ questions:
       fields:
         - source.ip
         - source.port
-        destination.ip
+        - destination.ip
         - destination.port
         - initiated
 
