Modify Sigma field mappings

[3isenHeiM]

How can I restrict the Sigma mapping rules to only match on data from specific indices ?

I have an SO infra where 90% of the logs are from a network traffic capture, and the rest is syslogs and other sysmon logs.
So a lot of hewavy so-zeek-* indices, and a few so-beats-*

How can I restrict the sigma mapping so to trigger only on the so-beats-* indices ?|

I can't find the file https://github.com/Security-Onion-Solutions/securityonion-image/blob/master/so-soctopus/so-soctopus/playbook/securityonion-baseline.yml in my deployment.

[InfosecGoon]

Unfortunately, this is not currently possible. It is on the TODO list, so please watch our release notes for updates.