diff --git a/CybeReason/malop-json/ingest/parser.yml b/CybeReason/malop-json/ingest/parser.yml
index 80803a753..9f716126d 100644
--- a/CybeReason/malop-json/ingest/parser.yml
+++ b/CybeReason/malop-json/ingest/parser.yml
@@ -61,19 +61,43 @@ stages:
       - set:
           observer.vendor: "Cybereason"
           observer.product: "Cybereason"
+
   handle_malop:
     actions:
       - set:
           "@timestamp": "{{parsed_timestamp.datetime}}"
         filter: "{{parsed_event.message.lastUpdateTime != null}}"
+
       - set:
           file.name: "{{parsed_event.message.primaryRootCauseName}}"
           file.hash.sha1: "{{parsed_event.message.rootCauseElementHashes}}"
         filter: '{{parsed_event.message.rootCauseElementType == "File"}}'
+
       - set:
           process.name: "{{parsed_event.message.primaryRootCauseName}}"
           process.hash.sha1: "{{parsed_event.message.rootCauseElementHashes}}"
         filter: '{{parsed_event.message.rootCauseElementType == "Process"}}'
+
+      - set:
+          host.os.type: "{{parsed_event.message.machines[0].get('osType', '').lower()}}"
+          host.name: "{{parsed_event.message.machines[0].get('displayName')}}"
+          host.domain: "{{parsed_event.message.machines[0].get('adDNSHostName')}}"
+          cybereason.malop.host.id: "{{parsed_event.message.machines[0].get('guid')}}"
+          cybereason.malop.host.is_online: "{{parsed_event.message.machines[0].get('connected')}}"
+          cybereason.malop.host.is_isolated: "{{parsed_event.message.machines[0].get('isolated')}}"
+        filter: "{{parsed_event.message.get('machines', []) != []}}"
+
+      - set:
+          user.name: "{{parsed_event.message.users[0].get('displayName')}}"
+          cybereason.malop.user.id: "{{parsed_event.message.users[0].get('guid')}}"
+          cybereason.malop.user.is_admin: "{{parsed_event.message.users[0].get('admin')}}"
+        filter: "{{parsed_event.message.get('users', []) != []}}"
+
+      - set:
+          user.name: '{{parsed_event.message.users[0].displayName.split("\\")[1]}}'
+          user.domain: '{{parsed_event.message.users[0].displayName.split("\\")[0]}}'
+        filter: '{{parsed_event.message.get("users", []) != [] and "\\" in parsed_event.message.users[0].get("displayName")}}'
+
       - set:
           event.kind: "alert"
           event.category: ["malware"]
@@ -88,22 +112,28 @@ stages:
           cybereason.malop.root_cause.type: "{{parsed_event.message.rootCauseElementType}}"
           cybereason.malop.root_cause.name: "{{parsed_event.message.primaryRootCauseName}}"
           cybereason.malop.is_edr: "{{parsed_event.message.edr}}"
+
       - set:
           cybereason.malop.created_at: "{{parsed_creation_time.datetime}}"
         filter: "{{parsed_event.message.malopCloseTime != null}}"
+
       - set:
           cybereason.malop.modified_at: "{{parsed_timestamp.datetime}}"
         filter: "{{parsed_event.message.creationTime != null}}"
+
       - set:
           cybereason.malop.closed_at: "{{parsed_closing_time.datetime}}"
         filter: "{{parsed_event.message.malopCloseTime != null}}"
+
   handle_model:
     actions:
       - set:
           "@timestamp": "{{parsed_timestamp.datetime}}"
         filter: "{{parsed_event.message.metadata.timestamp != null}}"
+
       - set:
           cybereason.malop.id: "{{parsed_event.message.metadata.malopGuid}}"
+
   handle_machine_model:
     actions:
       - set:
@@ -118,6 +148,7 @@ stages:
       - set:
           host.os.type: "{{parsed_event.message.osType.lower()}}"
         filter: "{{parsed_event.message.osType != null}}"
+
   handle_user_model:
     actions:
       - set:
@@ -127,10 +158,12 @@ stages:
           user.name: "{{parsed_event.message.displayName}}"
           cybereason.malop.user.id: "{{parsed_event.message.guid}}"
           cybereason.malop.user.is_admin: "{{parsed_event.message.admin}}"
+
       - set:
           user.name: '{{parsed_event.message.displayName.split("\\")[1]}}'
           user.domain: '{{parsed_event.message.displayName.split("\\")[0]}}'
         filter: '{{parsed_event.message.displayName != null and "\\" in parsed_event.message.displayName}}'
+
   handle_file_suspect_model:
     actions:
       - set:
diff --git a/CybeReason/malop-json/tests/test_malop.json b/CybeReason/malop-json/tests/test_malop.json
index b7ad07bb9..a5df9c14f 100644
--- a/CybeReason/malop-json/tests/test_malop.json
+++ b/CybeReason/malop-json/tests/test_malop.json
@@ -24,6 +24,11 @@
           ],
           "type": "CUSTOM_RULE"
         },
+        "host": {
+          "id": "-576002811.1198775089551518743",
+          "is_isolated": false,
+          "is_online": true
+        },
         "id": "11.-6654920844431693523",
         "is_edr": "true",
         "modified_at": "2022-11-20T12:02:17.625000Z",
@@ -33,7 +38,17 @@
           "type": "Process"
         },
         "severity": "High",
-        "status": "Active"
+        "status": "Active",
+        "user": {
+          "id": "0.2548072792133848559",
+          "is_admin": true
+        }
+      }
+    },
+    "host": {
+      "name": "win-cybereason",
+      "os": {
+        "type": "windows"
       }
     },
     "observer": {
@@ -42,6 +57,15 @@
     },
     "process": {
       "name": "cymulateagent.exe"
+    },
+    "related": {
+      "user": [
+        "administrator"
+      ]
+    },
+    "user": {
+      "domain": "win-cybereason",
+      "name": "administrator"
     }
   }
 }
\ No newline at end of file
diff --git a/CybeReason/malop-json/tests/test_malop_detail.json b/CybeReason/malop-json/tests/test_malop_detail.json
index a009d865f..532ff8e73 100644
--- a/CybeReason/malop-json/tests/test_malop_detail.json
+++ b/CybeReason/malop-json/tests/test_malop_detail.json
@@ -24,6 +24,11 @@
           ],
           "type": "KNOWN_MALWARE"
         },
+        "host": {
+          "id": "-576002811.1198775089551518743",
+          "is_isolated": false,
+          "is_online": false
+        },
         "id": "11.7498520112250262440",
         "is_edr": "false",
         "modified_at": "2022-11-14T02:19:45.000000Z",
@@ -33,7 +38,11 @@
           "type": "File"
         },
         "severity": "Low",
-        "status": "Closed"
+        "status": "Closed",
+        "user": {
+          "id": "0.2548072792133848559",
+          "is_admin": false
+        }
       }
     },
     "file": {
@@ -42,6 +51,13 @@
       },
       "name": "kprocesshacker.sys"
     },
+    "host": {
+      "domain": "desktop-aaaaaa.example.org",
+      "name": "desktop-aaaaaa",
+      "os": {
+        "type": "windows"
+      }
+    },
     "observer": {
       "product": "Cybereason",
       "vendor": "Cybereason"
@@ -49,7 +65,14 @@
     "related": {
       "hash": [
         "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc"
+      ],
+      "user": [
+        "system"
       ]
+    },
+    "user": {
+      "domain": "desktop-aaaaa",
+      "name": "system"
     }
   }
 }
\ No newline at end of file
diff --git a/Fortinet/fortigate/ingest/parser.yml b/Fortinet/fortigate/ingest/parser.yml
index 311e0deb0..cbb9b311a 100644
--- a/Fortinet/fortigate/ingest/parser.yml
+++ b/Fortinet/fortigate/ingest/parser.yml
@@ -191,7 +191,7 @@ stages:
           event.action: "{{parsed_event.message.name or parsed_event.message.FTNTFGTaction or parsed_event.message.FortinetFortiGateaction or parsed_event.message.act or parsed_event.message.action or parsed_event.message.reason}}"
           destination.address: "{{parsed_event.message.dstip or parsed_event.message.dst}}"
           destination.bytes: "{{parsed_event.message.rcvdbyte or parsed_event.message.in}}"
-          destination.domain: "{{parsed_event.message.hostname or parsed_event.message.dhost}}"
+          destination.domain: "{{parsed_event.message.remotename or parsed_event.message.dhost or parsed_event.message.hostname}}"
           destination.mac: "{{parsed_event.message.dstmac}}"
           destination.nat.port: "{{parsed_event.message.destinationTranslatedPort}}"
           destination.packets: "{{parsed_event.message.rcvdpkt or parsed_event.message.FTNTFGTrcvpkt or parsed_event.message.FortinetFortiGatercvdpkt or parsed_event.message.get('Packets Received')}}"