valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

DHCP log source in sigmac configs

Browse Source
This commit is contained in:
Florian Roth 2019-02-05 14:35:16 +01:00
parent dfd4ce878f
commit a276d3083d
10 changed files with 49 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tools/config/arcsight.yml
View File

@ -46,6 +46,11 @@ logsources:
service: powershell
conditions:
deviceVendor: Microsoft
windows-dhcp:
product: windows
service: dhcp
conditions:
deviceVendor: Microsoft
windows-system:
product: windows
service: system

5
tools/config/elk-windows.yml
View File

@ -27,4 +27,9 @@ logsources:
service: driver-framework
conditions:
source: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
windows-dhcp:
product: windows
service: dhcp
conditions:
source: 'Microsoft-Windows-DHCP-Server/Operational'
defaultindex: logstash-*

5
tools/config/elk-winlogbeat.yml
View File

@ -27,6 +27,11 @@ logsources:
service: driver-framework
conditions:
source: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
windows-dhcp:
product: windows
service: dhcp
conditions:
source: 'Microsoft-Windows-DHCP-Server/Operational'
defaultindex: winlogbeat-*
# Extract all field names qith yq:
# yq -r '.detection | del(.condition) | map(keys) | .[][]' $(find sigma/rules/windows -name '*.yml') | sort -u | grep -v ^EventID$ | sed 's/^\(.*\)/ \1: event_data.\1/g'

1
tools/config/helk.yml
View File

@ -27,6 +27,7 @@ logsources:
product: windows
service: powershell-classic
index: logs-endpoint-winevent-powershell-*
defaultindex: logs-*
fieldmappings:
AccessMask: object_access_mask_requested

6
tools/config/logpoint-windows-all.yml
View File

@ -19,6 +19,12 @@ logsources:
service: driver-framework
conditions:
source: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
windows-dhcp:
product: windows
service: dhcp
conditions:
source: 'Microsoft-Windows-DHCP-Server/Operational'
fieldmappings:
EventID: event_id
FailureCode: result_code

6
tools/config/netwitness.yml
View File

@ -30,6 +30,12 @@ logsources:
service: powershell
conditions:
device.type: winevent_nic
windows-dhcp:
product: windows
service: dhcp
conditions:
device.type: winevent_nic
event.source: microsoft-windows-dhcp-server
windows-sec:
product: windows
service: security

5
tools/config/powershell-windows-all.yml
View File

@ -60,3 +60,8 @@ logsources:
service: ntlm
conditions:
LogName: 'Microsoft-Windows-NTLM/Operational'
windows-dhcp:
product: windows
service: dhcp
conditions:
LogName: 'Microsoft-Windows-DHCP-Server/Operational'

5
tools/config/spark.yml
View File

@ -34,6 +34,11 @@ logsources:
service: wmi
sources:
- 'WinEventLog:Microsoft-Windows-WMI-Activity/Operational'
windows-dhcp:
product: windows
service: dhcp
sources:
- 'Microsoft-Windows-DHCP-Server'
apache:
category: webserver
sources:

5
tools/config/splunk-windows-all.yml
View File

@ -60,5 +60,10 @@ logsources:
service: ntlm
conditions:
source: 'Microsoft-Windows-NTLM/Operational'
windows-dhcp:
product: windows
service: dhcp
conditions:
source: 'Microsoft-Windows-DHCP-Server/Operational'
fieldmappings:
EventID: EventCode

6
tools/config/sumologic.yml
View File

@ -44,6 +44,12 @@ logsources:
conditions:
EventChannel: System
index: WINDOWS
windows-dhcp:
product: windows
service: dhcp
conditions:
EventChannel: Microsoft-Windows-DHCP-Server
index: WINDOWS
apache:
product: apache
service: apache