admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

add cim data model information

Browse Source
This commit is contained in:
P4T12ICK
2022-09-28 12:53:42 +02:00
parent c7279f298b
commit 138583bdb8
1 changed files with 15 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/endpoint/Sysmon_Event_ID_1.yml
+15 -14
View File
@@ -12,17 +12,18 @@ supported_TA:
references:
- https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
field_mappings:
cim:
ProcessGuid: process_guid
ProcessId: process_id
Image: process_path
CommandLine: process
CurrentDirectory: process_current_directory
User: user
IntegrityLevel: process_integrity_level
Hashes: process_hash
ParentProcessGuid: parent_process_guid
ParentProcessId: parent_process_id
ParentImage: parent_process_path
ParentCommandLine: parent_process
Computer: dest
- data_model: Endpoint.Processes
cim:
ProcessGuid: Processes.process_guid
ProcessId: Processes.process_id
Image: Processes.process_path
CommandLine: Processes.process
CurrentDirectory: Processes.process_current_directory
User: Processes.user
IntegrityLevel: Processes.process_integrity_level
Hashes: Processes.process_hash
ParentProcessGuid: Processes.parent_process_guid
ParentProcessId: Processes.parent_process_id
ParentImage: Processes.parent_process_path
ParentCommandLine: Processes.parent_process
Computer: Processes.dest