2020-10-27 18:02:00 +00:00
|
|
|
title: FireEye Helix
|
|
|
|
|
order: 20
|
|
|
|
|
backends:
|
|
|
|
|
- fireeye-helix
|
|
|
|
|
logsources:
|
|
|
|
|
windows:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
windows-application:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: application
|
|
|
|
|
conditions:
|
|
|
|
|
channel: Application
|
|
|
|
|
windows-security:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: security
|
|
|
|
|
conditions:
|
|
|
|
|
channel: Security
|
|
|
|
|
windows-sysmon:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: sysmon
|
|
|
|
|
conditions:
|
|
|
|
|
channel: Microsoft-Windows-Sysmon
|
|
|
|
|
windows-dns-server:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: dns-server
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'DNS Server'
|
|
|
|
|
windows-driver-framework:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: driver-framework
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
|
|
|
|
windows-dhcp:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: dhcp
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'Microsoft-Windows-DHCP-Server/Operational'
|
|
|
|
|
windows-defender:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: windefend
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'Microsoft-Windows-Windows Defender/Operational'
|
|
|
|
|
windows-ntlm:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: ntlm
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'Microsoft-Windows-NTLM/Operational'
|
|
|
|
|
windows-applocker:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: applocker
|
|
|
|
|
conditions:
|
|
|
|
|
channel:
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/MSI and Script'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/EXE and DLL'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Deployment'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Execution'
|
2021-03-20 07:49:59 +00:00
|
|
|
windows-msexchange-management:
|
|
|
|
|
product: windows
|
2021-03-20 08:09:45 +00:00
|
|
|
index: windows
|
2021-03-20 07:49:59 +00:00
|
|
|
service: msexchange-management
|
|
|
|
|
conditions:
|
2021-03-20 08:04:38 +00:00
|
|
|
channel: 'MSExchange Management'
|
2021-06-30 12:22:40 +00:00
|
|
|
windows-printservice-admin:
|
2021-06-30 12:09:44 +00:00
|
|
|
product: windows
|
2021-06-30 12:16:26 +00:00
|
|
|
index: windows
|
2021-06-30 12:22:40 +00:00
|
|
|
service: printservice-admin
|
2021-06-30 12:09:44 +00:00
|
|
|
conditions:
|
2021-06-30 12:22:40 +00:00
|
|
|
channel: 'Microsoft-Windows-PrintService/Admin'
|
2021-07-01 07:55:15 +00:00
|
|
|
windows-printservice-operational:
|
|
|
|
|
product: windows
|
|
|
|
|
service: printservice-operational
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'Microsoft-Windows-PrintService/Operational'
|
2021-06-30 12:16:26 +00:00
|
|
|
windows-smbclient-security:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: smbclient-security
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'Microsoft-Windows-SmbClient/Security'
|
2020-10-27 18:02:00 +00:00
|
|
|
windows-powershell:
|
|
|
|
|
product: windows
|
|
|
|
|
index: windows
|
|
|
|
|
service: powershell
|
|
|
|
|
conditions:
|
|
|
|
|
channel: 'Microsoft-Windows-Powershell'
|
|
|
|
|
linux:
|
|
|
|
|
product: linux
|
|
|
|
|
index: posix
|
|
|
|
|
unix:
|
|
|
|
|
product: unix
|
|
|
|
|
index: posix
|
|
|
|
|
dns:
|
|
|
|
|
category: dns
|
|
|
|
|
index: dns
|
|
|
|
|
firewall:
|
|
|
|
|
category: firewall
|
|
|
|
|
index: firewall
|
|
|
|
|
connection:
|
|
|
|
|
category: netflow
|
|
|
|
|
index: connection
|
|
|
|
|
proxy:
|
|
|
|
|
category: proxy
|
|
|
|
|
index: http_proxy
|
|
|
|
|
antivirus:
|
|
|
|
|
product: antivirus
|
|
|
|
|
index: antivirus
|
|
|
|
|
webserver:
|
|
|
|
|
category: webserver
|
|
|
|
|
index: http_server
|
|
|
|
|
fieldmappings:
|
|
|
|
|
AccessMask: accessmask
|
|
|
|
|
AccountName: username
|
|
|
|
|
cs-host: domain
|
|
|
|
|
cs-method: method
|
|
|
|
|
c-uri: url
|
|
|
|
|
c-uri-extension: uri
|
|
|
|
|
c-uri-path: uri
|
|
|
|
|
c-uri-query: uri
|
|
|
|
|
c-uri-stem: url
|
|
|
|
|
c-useragent: useragent
|
|
|
|
|
ClientAddress: ~srcipv4
|
|
|
|
|
ClientIPAddress: ~srcipv4
|
|
|
|
|
ClientIP: ~srcipv4
|
|
|
|
|
CommandLine: args
|
|
|
|
|
ComputerName: username
|
|
|
|
|
CurrentDirectory: cwd
|
|
|
|
|
DestAddress: ~dstipv4
|
|
|
|
|
DestinationHostname: dsthost
|
|
|
|
|
DestinationIp: ~dstipv4
|
|
|
|
|
DestinationPort: dstport
|
|
|
|
|
destination.port: dstport
|
|
|
|
|
dst: ~dstipv4
|
|
|
|
|
dst_ip: ~dstipv4
|
|
|
|
|
dst_port: dstport
|
|
|
|
|
EventID: eventid
|
|
|
|
|
EventType: eventtype
|
|
|
|
|
file_hash: ~hash
|
|
|
|
|
FileName: filename
|
|
|
|
|
FileVersion: version
|
|
|
|
|
HostVersion: version
|
|
|
|
|
Image: process
|
|
|
|
|
Imphash: imphash
|
|
|
|
|
ipAddress: ~dstipv4
|
|
|
|
|
IpAddress: ~srcipv4
|
|
|
|
|
IPString: ~srcipv4
|
|
|
|
|
LogonType: logontype
|
|
|
|
|
NewProcessName: process
|
|
|
|
|
ObjectName: object
|
|
|
|
|
ObjectType: object_type
|
|
|
|
|
ParentImage: pprocess
|
|
|
|
|
ParentProcessName: pprocess
|
|
|
|
|
Path: filepath
|
|
|
|
|
ProcessName: process
|
|
|
|
|
ProcessCommandLine: args
|
|
|
|
|
Product: product
|
|
|
|
|
r-dns: domain
|
|
|
|
|
sc-status: status
|
|
|
|
|
ServiceFileName: filepath
|
|
|
|
|
ShareName: filename
|
|
|
|
|
SourceAddress: ~srcipv4
|
|
|
|
|
SourceHostname: srchost
|
|
|
|
|
SourceImage: process
|
|
|
|
|
SourceIp: ~srcipv4
|
|
|
|
|
SourcePort: srcport
|
|
|
|
|
src: ~srcipv4
|
|
|
|
|
src_ip: ~srcipv4
|
|
|
|
|
src_port: srcport
|
|
|
|
|
Status: status
|
|
|
|
|
SubjectUserName: username
|
|
|
|
|
TargetServer: ~dstipv4
|
|
|
|
|
TaskName: task
|
|
|
|
|
TargetFilename: filepath
|
|
|
|
|
TargetImage: filepath
|
|
|
|
|
TargetObject: object
|
|
|
|
|
USER: username
|
|
|
|
|
User: accountname
|
|
|
|
|
UserAgent: useragent
|
|
|
|
|
UserName: username
|
|
|
|
|
username: username
|
|
|
|
|
Version: version
|
|
|
|
|
Workstation: srchost
|
|
|
|
|
WorkstationName: srchost
|
