2020-02-28 09:56:48 +00:00
|
|
|
title: CarbonBlack field mapping
|
|
|
|
|
order: 20
|
|
|
|
|
backends:
|
|
|
|
|
- carbonblack
|
2020-03-18 09:49:44 +00:00
|
|
|
- cb
|
2020-02-28 09:56:48 +00:00
|
|
|
fieldmappings:
|
|
|
|
|
AccountName: username
|
|
|
|
|
CommandLine: cmdline
|
|
|
|
|
ComputerName: hostname
|
|
|
|
|
CurrentDirectory: path
|
|
|
|
|
Description: product_name
|
2020-11-26 03:17:28 +00:00
|
|
|
DestinationHostname: domain
|
2020-02-28 09:56:48 +00:00
|
|
|
DestinationIp: ipaddr
|
|
|
|
|
DestinationIsIpv6: ipaddr
|
|
|
|
|
DestinationPort: ipport
|
2020-08-17 08:05:44 +00:00
|
|
|
Image: path
|
2020-02-28 09:56:48 +00:00
|
|
|
ImageLoaded: modload
|
|
|
|
|
ImagePath: path
|
2020-03-18 09:49:44 +00:00
|
|
|
#NewProcessName: process_name
|
2020-02-28 09:56:48 +00:00
|
|
|
#ParentCommandLine: NONE??
|
|
|
|
|
ParentProcessName: parent_name
|
|
|
|
|
ParentImage: parent_name
|
|
|
|
|
Path: path
|
|
|
|
|
ProcessCommandLine: cmdline
|
|
|
|
|
ProcessName: process_name
|
2020-03-18 09:49:44 +00:00
|
|
|
#Signature: digsig_result
|
|
|
|
|
SourceIp: ipaddr
|
|
|
|
|
DestinationAddress: ipaddr
|
|
|
|
|
DestinationPort: ipport
|
|
|
|
|
DestPort: ipport
|
|
|
|
|
TargetObject: regmod
|
|
|
|
|
TargetFilename: filemod
|
|
|
|
|
TargetFileName: filemod
|
|
|
|
|
Targetfilename: filemod
|
|
|
|
|
SourceImage: parent_name
|
|
|
|
|
TargetImage: childproc_name
|
|
|
|
|
NewProcessName: childproc_name
|
|
|
|
|
Product: product_name
|
|
|
|
|
Signature: digsig_publisher
|
|
|
|
|
CallTrace: modload
|
|
|
|
|
DestinationHostname: domain
|
|
|
|
|
User: username
|
|
|
|
|
StartModule: modload
|
|
|
|
|
Company: company_name
|
|
|
|
|
Description: file_desc
|
|
|
|
|
FileVersion: file_version
|
2020-02-28 09:56:48 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# DestinationHostname: hostname
|
|
|
|
|
# DestinationIp: ipaddr
|
|
|
|
|
# DestinationPort: ipport
|
|
|
|
|
#
|
|
|
|
|
# SourceIp: ipaddr
|
|
|
|
|
# SourcePort: ipport
|
|
|
|
|
#
|
|
|
|
|
# IpAddress: ipaddr
|
|
|
|
|
# IpPort: ipport
|
|
|
|
|
#
|
|
|
|
|
# ProcessName: process_name
|
|
|
|
|
# ParentProcessName: parent_name
|
|
|
|
|
#
|
|
|
|
|
# TargetDomainName: domain
|
|
|
|
|
#
|
|
|
|
|
# Image: path
|
|
|
|
|
# ImagePath: path
|
|
|
|
|
# ImageLoaded: path
|
|
|
|
|
# Path: path
|
|
|
|
|
# TargetFilename: path
|
|
|
|
|
#
|
|
|
|
|
# Hashes: md5
|
|
|
|
|
# Imphash: md5
|
|
|
|
|
#
|
|
|
|
|
#
|
|
|
|
|
# User: username
|
|
|
|
|
# SubjectDomainName: domain
|
|
|
|
|
# SubjectUserName: username
|
|
|
|
|
#
|
|
|
|
|
# WorkstationName: domain
|
|
|
|
|
#
|
|
|
|
|
# CommandLine: cmdline
|
|
|
|
|
# ComputerName: hostname
|
|
|
|
|
#
|
|
|
|
|
# FileVersion: product_version
|
|
|
|
|
# Description: product_desc
|
|
|
|
|
# Product: product_name
|
|
|
|
|
# Company: company_name
|
|
|
|
|
#
|
|
|
|
|
# Keywords: process_name
|
|
|
|
|
# Computer: host_type
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
excludedfields:
|
|
|
|
|
- EventID
|
|
|
|
|
- Robot2
|
2020-03-18 09:49:44 +00:00
|
|
|
- TargetObject
|
|
|
|
|
- CallTrace
|
|
|
|
|
- Imphash
|
