SigmaHQ/tools/config/splunk-windows-all.yml

logsources:
  windows-application:
    product: windows
    service: application
    conditions:
      source: 'WinEventLog:Application'
  windows-security:
    product: windows
    service: security
    conditions:
      source: 'WinEventLog:Security'
  windows-system:
    product: windows
    service: system
    conditions:
      source: 'WinEventLog:System'
  windows-sysmon:
    product: windows
    service: sysmon
    conditions:
      source: 'WinEventLog:Microsoft-Windows-Sysmon/Operational'
  windows-powershell:
    product: windows
    service: powershell
    conditions:
      source: 'WinEventLog:Microsoft-Windows-PowerShell/Operational'
  windows-classicpowershell:
    product: windows
    service: powershell-classic
    conditions:
      source: 'Windows PowerShell'
  windows-taskscheduler:
    product: windows
    service: taskscheduler
    conditions:
      source: 'WinEventLog:Microsoft-Windows-TaskScheduler/Operational'
  windows-wmi:
    product: windows
    service: wmi
    conditions:
      source: 'WinEventLog:Microsoft-Windows-WMI-Activity/Operational'
  windows-dns-server:
    product: windows
    service: dns-server
    category: dns
    conditions:
      source: 'DNS Server'
  windows-dns-server-audit:
    product: windows
    service: dns-server-audit
    conditions:
      source: 'Microsoft-Windows-DNS-Server/Audit'
  windows-driver-framework:
    product: windows
    service: driver-framework
    conditions:
      source: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
  windows-ntlm:
    product: windows
    service: ntlm
    conditions:
      source: 'Microsoft-Windows-NTLM/Operational'
fieldmappings:
    EventID: EventCode