@@ -14,14 +14,13 @@ Sysmon is a freely available program from Microsoft that is provided as part of
1414
1515## Data Model Coverage
1616
17- ### [thread ](../data_model/thread )
17+ ### [process ](../data_model/process )
1818
19- | | `hostname` | `src_pid` | `src_tid` | `stack_base` | `stack_limit` | `start_address` | `start_function` | `start_module` | `start_module_name` | `tgt_pid` | `tgt_tid` | `uid` | `user` | `user_stack_base` | `user_stack_limit` |
20- |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
21- | `create` | ✓|✓| | | |✓|✓|✓| |✓|✓| | | | |
22- | `remote_create` | ✓|✓| | | |✓|✓|✓| |✓|✓| | | | |
23- | `suspend` | | | | | | | | | | | | | | | |
24- | `terminate` | | | | | | | | | | | | | | | |
19+ | | `access_level` | `call_trace` | `command_line` | `current_working_directory` | `env_vars` | `exe` | `fqdn` | `guid` | `hostname` | `image_path` | `integrity_level` | `md5_hash` | `parent_command_line` | `parent_exe` | `parent_guid` | `parent_image_path` | `pid` | `ppid` | `sha1_hash` | `sha256_hash` | `sid` | `signature_valid` | `signer` | `target_address` | `target_guid` | `target_name` | `target_pid` | `uid` | `user` |
20+ |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
21+ | `access` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
22+ | `create` | | |✓|✓| | |✓| | |✓|✓|✓|✓| | |✓|✓|✓|✓|✓| | | | | | | | |✓|
23+ | `terminate` | | | | | | |✓| | |✓| | | | | | |✓| | | | | | | | | | | | |
2524
2625### [registry](../data_model/registry)
2726
@@ -32,18 +31,6 @@ Sysmon is a freely available program from Microsoft that is provided as part of
3231| `remove` | |✓|✓| |✓|✓| |✓| | |✓|
3332| `value_edit` | | | | | | | | | | | |
3433
35- ### [file](../data_model/file)
36-
37- | | `company` | `content` | `creation_time` | `extension` | `file_name` | `file_path` | `fqdn` | `gid` | `group` | `hostname` | `image_path` | `link_target` | `md5_hash` | `mime_type` | `mode` | `owner` | `owner_uid` | `pid` | `ppid` | `previous_creation_time` | `sha1_hash` | `sha256_hash` | `signature_valid` | `signer` | `uid` | `user` |
38- |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
39- | `acl_modify` | | | | | | | | | | | | | | | | | | | | | | | | | | |
40- | `create` | | |✓| |✓| |✓| | | |✓| | | | | | |✓| | | | | | | | |
41- | `delete` | | | | | | | | | | | | | | | | | | | | | | | | | | |
42- | `modify` | | | | | | | | | | | | | | | | | | | | | | | | | | |
43- | `read` | | | | | | | | | | | | | | | | | | | | | | | | | | |
44- | `timestomp` | | |✓| |✓| |✓| | | |✓| | | | | | |✓| |✓| | | | | | |
45- | `write` | | | | | | | | | | | | | | | | | | | | | | | | | | |
46-
4734### [driver](../data_model/driver)
4835
4936| | `base_address` | `fqdn` | `hostname` | `image_path` | `md5_hash` | `module_name` | `pid` | `sha1_hash` | `sha256_hash` | `signature_valid` | `signer` |
@@ -58,6 +45,15 @@ Sysmon is a freely available program from Microsoft that is provided as part of
5845| `load` | |✓| |✓|✓| |✓|✓|✓|✓| |✓| |
5946| `unload` | | | | | | | | | | | | | |
6047
48+ ### [thread](../data_model/thread)
49+
50+ | | `hostname` | `src_pid` | `src_tid` | `stack_base` | `stack_limit` | `start_address` | `start_function` | `start_module` | `start_module_name` | `tgt_pid` | `tgt_tid` | `uid` | `user` | `user_stack_base` | `user_stack_limit` |
51+ |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
52+ | `create` | ✓|✓| | | |✓|✓|✓| |✓|✓| | | | |
53+ | `remote_create` | ✓|✓| | | |✓|✓|✓| |✓|✓| | | | |
54+ | `suspend` | | | | | | | | | | | | | | | |
55+ | `terminate` | | | | | | | | | | | | | | | |
56+
6157### [flow](../data_model/flow)
6258
6359| | `application_protocol` | `content` | `dest_fqdn` | `dest_hostname` | `dest_ip` | `dest_port` | `end_time` | `exe` | `fqdn` | `hostname` | `image_path` | `in_bytes` | `network_direction` | `out_bytes` | `packet_count` | `pid` | `ppid` | `proto_info` | `src_fqdn` | `src_hostname` | `src_ip` | `src_port` | `start_time` | `tcp_flags` | `transport_protocol` | `uid` | `user` |
@@ -66,13 +62,17 @@ Sysmon is a freely available program from Microsoft that is provided as part of
6662| `message` | | | | | | | | | | | | | | | | | | | | | | | | | | | |
6763| `start` | | | |✓|✓|✓| | | | |✓| | | | |✓| | | |✓|✓|✓|✓| | | |✓|
6864
69- ### [process ](../data_model/process )
65+ ### [file ](../data_model/file )
7066
71- | | `access_level` | `call_trace` | `command_line` | `current_working_directory` | `env_vars` | `exe` | `fqdn` | `guid` | `hostname` | `image_path` | `integrity_level` | `md5_hash` | `parent_command_line` | `parent_exe` | `parent_guid` | `parent_image_path` | `pid` | `ppid` | `sha1_hash` | `sha256_hash` | `sid` | `signature_valid` | `signer` | `target_address` | `target_guid` | `target_name` | `target_pid` | `uid` | `user` |
72- |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
73- | `access` | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
74- | `create` | | |✓|✓| | |✓| | |✓|✓|✓|✓| | |✓|✓|✓|✓|✓| | | | | | | | |✓|
75- | `terminate` | | | | | | |✓| | |✓| | | | | | |✓| | | | | | | | | | | | |
67+ | | `company` | `content` | `creation_time` | `extension` | `file_name` | `file_path` | `fqdn` | `gid` | `group` | `hostname` | `image_path` | `link_target` | `md5_hash` | `mime_type` | `mode` | `owner` | `owner_uid` | `pid` | `ppid` | `previous_creation_time` | `sha1_hash` | `sha256_hash` | `signature_valid` | `signer` | `uid` | `user` |
68+ |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
69+ | `acl_modify` | | | | | | | | | | | | | | | | | | | | | | | | | | |
70+ | `create` | | |✓| |✓| |✓| | | |✓| | | | | | |✓| | | | | | | | |
71+ | `delete` | | | | | | | | | | | | | | | | | | | | | | | | | | |
72+ | `modify` | | | | | | | | | | | | | | | | | | | | | | | | | | |
73+ | `read` | | | | | | | | | | | | | | | | | | | | | | | | | | |
74+ | `timestomp` | | |✓| |✓| |✓| | | |✓| | | | | | |✓| |✓| | | | | | |
75+ | `write` | | | | | | | | | | | | | | | | | | | | | | | | | | |
7676
7777
7878
0 commit comments