valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1757 from wietze/fix/carbon-black-eedr/field_renames

Browse Source 
[CarbonBlack EEDR] Several updates to config file
This commit is contained in:
Florian Roth 2021-07-29 18:13:47 +02:00 committed by GitHub
commit f06f8a1191
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
tools/config/carbon-black-eedr.yml
View File

@ -16,50 +16,38 @@ fieldmappings:
- process_product_version
- process_publisher
- process_file_description
DestPort:
- netconn_port
- netconn_remote_port
DestPort: netconn_port
Destination:
- netconn_domain
DestinationAddress:
- netconn_domain
- netconn_ipv4
- netconn_ipv6
- netconn_remote_ipv4
- netconn_remote_ipv6
DestinationHostname:
- netconn_domain
- netconn_proxy_domain
DestinationIp:
- netconn_ipv4
- netconn_ipv6
- netconn_remote_ipv4
- netconn_remote_ipv6
DestinationPort:
- netconn_port
- netconn_remote_port
DestinationPort: netconn_port
Device: device_name
FileName:
- process_internal_name
- process_name
- process_original_filename
FileVersion: process_product_version
Image:
- process_name
- process_internal_name
IntegrityLevel: process_integrity_level
IpAddress:
- netconn_ipv4
- netconn_ipv6
- netconn_local_ipv4
- netconn_local_ipv6
- netconn_remote_ipv4
- netconn_remote_ipv6
LogonId:
- childproc_username
- process_username
md5: hash
NewName: regmod_new_name
NewName: regmod_name
OriginalFileName: process_original_filename
ParentCommandLine: parent_cmdline
ParentImage: parent_name
@ -98,27 +86,17 @@ fieldmappings:
- netconn_local_port
- netconn_port
SourceWorkstation: device_name
TargetFilename:
- filemod_name
- crossproc_name
TargetImage:
- filemod_name
- crossproc_name
TargetName:
- filemod_name
- crossproc_name
TargetFilename: filemod_name
TargetImage: filemod_name
TargetName: filemod_name
TargetUserName:
- childproc_username
- process_username
TargetObject:
- regmod_name
- regmod_new_name
TargetObject: regmod_name
User:
- childproc_username
- process_username
Value:
- regmod_name
- regmod_new_name
Value: regmod_name
Workstation: device_name
WorkstationName: device_name
@ -127,15 +105,9 @@ fieldmappings:
- netconn_ipv6
- netconn_local_ipv4
- netconn_local_ipv6
- netconn_remote_ipv4
- netconn_remote_ipv6
dst_port:
- netconn_port
- netconn_remote_port
dst_port: netconn_port
src_ip:
- netconn_ipv4
- netconn_ipv6
- netconn_local_ipv4
- netconn_local_ipv6
- netconn_remote_ipv4
- netconn_remote_ipv6