From e2574cc696fa892c7cad883fee7e53c36da117d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20S=C3=A1nchez?= <sanchez.saez.alex01@gmail.com>
Date: Mon, 3 Aug 2026 14:10:02 -0600
Subject: [PATCH] feat[frontend](user-auditor): changed logexplorer filters on
 linux branch

---
 frontend/src/features/user-auditor/pages/UserAuditorPage.tsx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/features/user-auditor/pages/UserAuditorPage.tsx b/frontend/src/features/user-auditor/pages/UserAuditorPage.tsx
index 881c05d4b..f54a97a1a 100644
--- a/frontend/src/features/user-auditor/pages/UserAuditorPage.tsx
+++ b/frontend/src/features/user-auditor/pages/UserAuditorPage.tsx
@@ -627,8 +627,8 @@ function logExplorerHref(user: ADUser): string {
   const p: Record<string, string> = { tenantId: user.tenantId, '@timestamp': '30d' }
   if (user.source === 'linux') {
     p.dataType = 'linux'
-    if (user.username) p.username = user.username
-    if (user.hostname) p.hostname = user.hostname
+    if (user.username) p['origin.user'] = user.username
+    if (user.hostname) p['origin.host'] = user.hostname
   } else {
     p.dataType = 'wineventlog'
     p.eventCode = '4720,4726,4624'