valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1686 from leegengyu/patch-12

Browse Source 
Update winlogbeat-modules-enabled.yml
This commit is contained in:
Florian Roth 2021-07-15 08:37:09 +02:00 committed by GitHub
commit 680e01d309
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/config/winlogbeat-modules-enabled.yml
View File

@ -106,7 +106,7 @@ defaultindex: winlogbeat-*
# yq -r '.detection | del(.condition) | map(keys) | .[][]' $(find sigma/rules/windows -name '*.yml') | sort -u | grep -v ^EventID$ | sed 's/^\(.*\)/ \1: winlog.event_data.\1/g'
# Keep EventID! Clean up the list afterwards!
fieldmappings:
EventID: winlog.event_id
EventID: event.code
AccessMask: winlog.event_data.AccessMask
AccountName: winlog.event_data.AccountName
AllowedToDelegateTo: winlog.event_data.AllowedToDelegateTo
@ -189,7 +189,7 @@ fieldmappings:
SubjectUserSid: user.id
TargetFilename: file.path
TargetImage: winlog.event_data.TargetImage
TargetObject: winlog.event_data.TargetObject
TargetObject: registry.path
TicketEncryptionType: winlog.event_data.TicketEncryptionType
TicketOptions: winlog.event_data.TicketOptions
TargetDomainName: user.domain