Skip to content

Commit a11c9b8

Browse files
patel-bhavinpatel-bhavin
committed
udpating asr fields
1 parent 7689f47 commit a11c9b8

7 files changed

+427
-1
lines changed

‎data_sources/windows_event_log_defender_1125.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,4 @@ supported_TA:
1414
fields:
1515
- _time
1616
example_log: |-
17+
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-26T23:43:08.7101401Z'/><EventRecordID>3701</EventRecordID><Correlation ActivityID='{b68511a1-ec5f-4bc7-a9bb-2bd601338de2}'/><Execution ProcessID='3512' ThreadID='5936'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>E6DB77E5-3DF2-4CF1-B95A-636979351E5B</Data><Data Name='Detection Time'>2023-11-26T23:43:08.709Z</Data><Data Name='User'>(unknown user)</Data><Data Name='Path'></Data><Data Name='Process Name'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Security intelligence Version'>1.401.1247.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'></Data><Data Name='Parent Commandline'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event>

‎data_sources/windows_event_log_defender_1126.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,89 @@ supported_TA:
1313
version: 9.0.1
1414
fields:
1515
- _time
16+
- ActivityID
17+
- CategoryString
18+
- Channel
19+
- Computer
20+
- Detection_Time
21+
- Engine_Version
22+
- EventCode
23+
- EventData_Xml
24+
- EventID
25+
- EventRecordID
26+
- Guid
27+
- ID
28+
- Image_File_Name
29+
- Inhertiance_Flags
30+
- Involved_File
31+
- Keywords
32+
- Level
33+
- Message
34+
- Name
35+
- Opcode
36+
- Parent_Commandline
37+
- Path
38+
- ProcessID
39+
- Process_Name
40+
- Product_Name
41+
- Product_Version
42+
- RecordNumber
43+
- RenderingInfo_Xml
44+
- RuleType
45+
- Security_intelligence_Version
46+
- SourceName
47+
- SubStatus
48+
- SystemTime
49+
- System_Props_Xml
50+
- Target_Commandline
51+
- Task
52+
- TaskCategory
53+
- ThreadID
54+
- Unused
55+
- User
56+
- UserID
57+
- Version
58+
- action
59+
- category
60+
- dvc
61+
- dvc_nt_host
62+
- event_id
63+
- eventtype
64+
- host
65+
- id
66+
- index
67+
- linecount
68+
- name
69+
- parent_process
70+
- process_name
71+
- punct
72+
- result
73+
- service
74+
- service_id
75+
- service_name
76+
- severity
77+
- severity_id
78+
- signature
79+
- signature_id
80+
- source
81+
- sourcetype
82+
- splunk_server
83+
- splunk_server_group
84+
- subject
85+
- tag
86+
- tag::action
87+
- tag::eventtype
88+
- timestamp
89+
- user_group_id
90+
- user_id
91+
- vendor_product
92+
- _bkt
93+
- _cd
94+
- _eventtype_color
95+
- _indextime
96+
- _pre_msg
97+
- _raw
98+
- _serial
99+
- _si
100+
- _sourcetype
16101
example_log: |-

‎data_sources/windows_event_log_defender_1129.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,4 +58,4 @@ fields:
5858
- timeendpos
5959
- timestartpos
6060
- vendor_product
61-
example_log: 11/17/2023 05:23:37 PM
61+
example_log: |-

‎data_sources/windows_event_log_defender_1131.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,90 @@ supported_TA:
1212
url: https://splunkbase.splunk.com/app/742
1313
version: 9.0.1
1414
fields:
15+
- ActivityID
16+
- CategoryString
17+
- Channel
18+
- Computer
19+
- Detection_Time
20+
- Engine_Version
21+
- EventCode
22+
- EventData_Xml
23+
- EventID
24+
- EventRecordID
25+
- Guid
26+
- ID
27+
- Image_File_Name
28+
- Inhertiance_Flags
29+
- Involved_File
30+
- Keywords
31+
- Level
32+
- Message
33+
- Name
34+
- Opcode
35+
- Parent_Commandline
36+
- Path
37+
- ProcessID
38+
- Process_Name
39+
- Product_Name
40+
- Product_Version
41+
- RecordNumber
42+
- RenderingInfo_Xml
43+
- RuleType
44+
- Security_intelligence_Version
45+
- SourceName
46+
- SubStatus
47+
- SystemTime
48+
- System_Props_Xml
49+
- Target_Commandline
50+
- Task
51+
- TaskCategory
52+
- ThreadID
53+
- Unused
54+
- User
55+
- UserID
56+
- Version
57+
- action
58+
- category
59+
- dvc
60+
- dvc_nt_host
61+
- event_id
62+
- eventtype
63+
- host
64+
- id
65+
- index
66+
- linecount
67+
- name
68+
- parent_process
69+
- process_name
70+
- punct
71+
- result
72+
- service
73+
- service_id
74+
- service_name
75+
- severity
76+
- severity_id
77+
- signature
78+
- signature_id
79+
- source
80+
- sourcetype
81+
- splunk_server
82+
- splunk_server_group
83+
- subject
84+
- tag
85+
- tag::action
86+
- tag::eventtype
87+
- timestamp
88+
- user_group_id
89+
- user_id
90+
- vendor_product
91+
- _bkt
92+
- _cd
93+
- _eventtype_color
94+
- _indextime
95+
- _pre_msg
96+
- _raw
97+
- _serial
98+
- _si
99+
- _sourcetype
15100
- _time
16101
example_log: |-

‎data_sources/windows_event_log_defender_1132.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,90 @@ supported_TA:
1212
url: https://splunkbase.splunk.com/app/742
1313
version: 9.0.1
1414
fields:
15+
- ActivityID
16+
- CategoryString
17+
- Channel
18+
- Computer
19+
- Detection_Time
20+
- Engine_Version
21+
- EventCode
22+
- EventData_Xml
23+
- EventID
24+
- EventRecordID
25+
- Guid
26+
- ID
27+
- Image_File_Name
28+
- Inhertiance_Flags
29+
- Involved_File
30+
- Keywords
31+
- Level
32+
- Message
33+
- Name
34+
- Opcode
35+
- Parent_Commandline
36+
- Path
37+
- ProcessID
38+
- Process_Name
39+
- Product_Name
40+
- Product_Version
41+
- RecordNumber
42+
- RenderingInfo_Xml
43+
- RuleType
44+
- Security_intelligence_Version
45+
- SourceName
46+
- SubStatus
47+
- SystemTime
48+
- System_Props_Xml
49+
- Target_Commandline
50+
- Task
51+
- TaskCategory
52+
- ThreadID
53+
- Unused
54+
- User
55+
- UserID
56+
- Version
57+
- action
58+
- category
59+
- dvc
60+
- dvc_nt_host
61+
- event_id
62+
- eventtype
63+
- host
64+
- id
65+
- index
66+
- linecount
67+
- name
68+
- parent_process
69+
- process_name
70+
- punct
71+
- result
72+
- service
73+
- service_id
74+
- service_name
75+
- severity
76+
- severity_id
77+
- signature
78+
- signature_id
79+
- source
80+
- sourcetype
81+
- splunk_server
82+
- splunk_server_group
83+
- subject
84+
- tag
85+
- tag::action
86+
- tag::eventtype
87+
- timestamp
88+
- user_group_id
89+
- user_id
90+
- vendor_product
91+
- _bkt
92+
- _cd
93+
- _eventtype_color
94+
- _indextime
95+
- _pre_msg
96+
- _raw
97+
- _serial
98+
- _si
99+
- _sourcetype
15100
- _time
16101
example_log: |-

‎data_sources/windows_event_log_defender_1133.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,90 @@ supported_TA:
1212
url: https://splunkbase.splunk.com/app/742
1313
version: 9.0.1
1414
fields:
15+
- ActivityID
16+
- CategoryString
17+
- Channel
18+
- Computer
19+
- Detection_Time
20+
- Engine_Version
21+
- EventCode
22+
- EventData_Xml
23+
- EventID
24+
- EventRecordID
25+
- Guid
26+
- ID
27+
- Image_File_Name
28+
- Inhertiance_Flags
29+
- Involved_File
30+
- Keywords
31+
- Level
32+
- Message
33+
- Name
34+
- Opcode
35+
- Parent_Commandline
36+
- Path
37+
- ProcessID
38+
- Process_Name
39+
- Product_Name
40+
- Product_Version
41+
- RecordNumber
42+
- RenderingInfo_Xml
43+
- RuleType
44+
- Security_intelligence_Version
45+
- SourceName
46+
- SubStatus
47+
- SystemTime
48+
- System_Props_Xml
49+
- Target_Commandline
50+
- Task
51+
- TaskCategory
52+
- ThreadID
53+
- Unused
54+
- User
55+
- UserID
56+
- Version
57+
- action
58+
- category
59+
- dvc
60+
- dvc_nt_host
61+
- event_id
62+
- eventtype
63+
- host
64+
- id
65+
- index
66+
- linecount
67+
- name
68+
- parent_process
69+
- process_name
70+
- punct
71+
- result
72+
- service
73+
- service_id
74+
- service_name
75+
- severity
76+
- severity_id
77+
- signature
78+
- signature_id
79+
- source
80+
- sourcetype
81+
- splunk_server
82+
- splunk_server_group
83+
- subject
84+
- tag
85+
- tag::action
86+
- tag::eventtype
87+
- timestamp
88+
- user_group_id
89+
- user_id
90+
- vendor_product
91+
- _bkt
92+
- _cd
93+
- _eventtype_color
94+
- _indextime
95+
- _pre_msg
96+
- _raw
97+
- _serial
98+
- _si
99+
- _sourcetype
15100
- _time
16101
example_log: |-

0 commit comments

Comments
 (0)