valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

LogPoint windows mapping

Browse Source
This commit is contained in:
Ben de Haan 2017-03-20 16:57:19 +01:00 committed by GitHub
parent 1bf11dc471
commit c3c405a95e
1 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
tools/config/logpoint-windows-all.yml Normal file
View File

@ -0,0 +1,20 @@
logsources:
windows-security:
product: windows
service: security
conditions:
event_source: 'Microsoft-Windows-Security-Auditing'
windows-security:
product: windows
service: system
conditions:
event_source: 'Microsoft-Windows-Security-Auditing'
fieldmappings:
EventID: event_id
FailureCode: result_code
GroupName: group_name
ServiceName: service
SubjectAccountName: target_user
TicketOptions: ticket_options
TicketEnctyption: ticket_encryption
Type: event_type