- Updated log_source to Microsoft-Windows-Sysmon. Aligned with OSSEM-DM
- Added User (UserName) if required.
- Added sample events (friendly view and xml). Sample events contain user data field.
- Event 4688: Added event sample.
- Event 4715: Added event sample and updated standard names with audit_policy entity
- Event 4719: Added event sample and updated standard names with audit_policy entity
- Event 4902: Added event sample and updated standard names with audit_policy entity
- Event 4904: Added event sample and updated standard names with audit_policy entity. Updated process_path attribute to process_file_path.
- Event 4906: Added link. Added event sample and updated standard names with audit_policy entity
- Event 4908: Added event sample and updated standard names with audit_policy entity
- Event 4912: Added event sample and updated standard names with audit_policy entity
- Event 104 - A log file was cleared: Added standard names, descriptions, sample values, and event sample in xml format.
- Event 1100 - Windows Event Log service has shut down: Added dictionary without event fields and added event sample in xml format.
- Event 1102 - The audit log was cleared: standard names, descriptions, sample values, and event sample in xml format.
- Event 6005 - The event log service was started: Added dictionary with event sample in xml format. We still need to review the event fields section of dictionary.
- Event 6006 - The event log service was stopped: Added dictionary with event sample in xml format. We still need to review the event fields section of dictionary.
- Event 4656 - Handle requested to registry object: updated descriptions to make reference to registry objects.
- Event 4656 - handle requested to service object: Added dictionary with event sample in xml format.
- Event 4697 - a service was installed in the system: Removed double quotation marks from descriptions and added event sample in xml format.
- Security 4656: Created dictionary for Object Type = Key. This is still a work in progress.
- Security 4657: Aligned standard names with Registry entity.
- Sysmon 12: Aligned standard names with Registry entity and add User event field.
- Sysmon 13: Aligned standard names with Registry entity and add User event field.
- added gitignore file
License exists on OSSEM-DD, OSSEM-DM and OSSEM-CDM. Current one on all of them is GPLv3. We are updating the LICENSE to MIT in order to unlock additional collaboration opportunities.
Jose Rodriguez