From f479e762e6d6dcc9bac8cfb5cda1711abecfb007 Mon Sep 17 00:00:00 2001 From: Patrick Date: Wed, 31 Jul 2024 09:58:03 +0200 Subject: [PATCH 1/3] Improve TA names to match the naming in Splunk --- data_sources/aws_cloudfront.yml | 4 +- data_sources/aws_cloudtrail.yml | 4 +- .../aws_cloudtrail_assumerolewithsaml.yml | 4 +- data_sources/aws_cloudtrail_consolelogin.yml | 4 +- data_sources/aws_cloudtrail_copyobject.yml | 4 +- .../aws_cloudtrail_createaccesskey.yml | 4 +- data_sources/aws_cloudtrail_createkey.yml | 4 +- .../aws_cloudtrail_createloginprofile.yml | 4 +- .../aws_cloudtrail_createnetworkaclentry.yml | 4 +- .../aws_cloudtrail_createpolicyversion.yml | 4 +- .../aws_cloudtrail_createsnapshot.yml | 4 +- data_sources/aws_cloudtrail_createtask.yml | 4 +- .../aws_cloudtrail_createvirtualmfadevice.yml | 4 +- .../aws_cloudtrail_deactivatemfadevice.yml | 4 +- ...cloudtrail_deleteaccountpasswordpolicy.yml | 4 +- .../aws_cloudtrail_deletedetector.yml | 4 +- data_sources/aws_cloudtrail_deletegroup.yml | 4 +- data_sources/aws_cloudtrail_deleteipset.yml | 4 +- .../aws_cloudtrail_deleteloggroup.yml | 4 +- .../aws_cloudtrail_deletelogstream.yml | 4 +- .../aws_cloudtrail_deletenetworkaclentry.yml | 4 +- data_sources/aws_cloudtrail_deletepolicy.yml | 4 +- data_sources/aws_cloudtrail_deleterule.yml | 4 +- data_sources/aws_cloudtrail_deletetrail.yml | 4 +- .../aws_cloudtrail_deletevirtualmfadevice.yml | 4 +- data_sources/aws_cloudtrail_deletewebacl.yml | 4 +- ...aws_cloudtrail_describeeventaggregates.yml | 4 +- ...s_cloudtrail_describeimagescanfindings.yml | 4 +- ...ws_cloudtrail_getaccountpasswordpolicy.yml | 4 +- data_sources/aws_cloudtrail_getobject.yml | 4 +- .../aws_cloudtrail_getpassworddata.yml | 4 +- data_sources/aws_cloudtrail_jobcreated.yml | 4 +- .../aws_cloudtrail_modifydbinstance.yml | 4 +- .../aws_cloudtrail_modifyimageattribute.yml | 4 +- ...aws_cloudtrail_modifysnapshotattribute.yml | 4 +- data_sources/aws_cloudtrail_putbucketacl.yml | 4 +- .../aws_cloudtrail_putbucketlifecycle.yml | 4 +- .../aws_cloudtrail_putbucketreplication.yml | 4 +- .../aws_cloudtrail_putbucketversioning.yml | 4 +- data_sources/aws_cloudtrail_putimage.yml | 4 +- data_sources/aws_cloudtrail_putkeypolicy.yml | 4 +- .../aws_cloudtrail_replacenetworkaclentry.yml | 4 +- ...aws_cloudtrail_setdefaultpolicyversion.yml | 4 +- data_sources/aws_cloudtrail_stoplogging.yml | 4 +- ...cloudtrail_updateaccountpasswordpolicy.yml | 4 +- .../aws_cloudtrail_updateloginprofile.yml | 4 +- .../aws_cloudtrail_updatesamlprovider.yml | 4 +- data_sources/aws_cloudtrail_updatetrail.yml | 4 +- data_sources/aws_cloudwatchlogs_vpcflow.yml | 68 +++++++++++++ data_sources/aws_security_hub.yml | 4 +- data_sources/azure_active_directory.yml | 2 +- ...p_role_assignment_to_service_principal.yml | 2 +- ...re_active_directory_add_member_to_role.yml | 2 +- ...ive_directory_add_owner_to_application.yml | 2 +- ...active_directory_add_service_principal.yml | 2 +- ...active_directory_add_unverified_domain.yml | 2 +- ...ctive_directory_consent_to_application.yml | 2 +- ...irectory_disable_strong_authentication.yml | 2 +- .../azure_active_directory_enable_account.yml | 2 +- ..._active_directory_invite_external_user.yml | 2 +- ...ve_directory_reset_password_(by_admin).yml | 2 +- ...ve_directory_set_domain_authentication.yml | 2 +- ...zure_active_directory_sign_in_activity.yml | 2 +- ...re_active_directory_update_application.yml | 2 +- ..._directory_update_authorization_policy.yml | 2 +- .../azure_active_directory_update_user.yml | 2 +- ...irectory_user_registered_security_info.yml | 2 +- ..._or_update_an_azure_automation_account.yml | 2 +- ..._or_update_an_azure_automation_runbook.yml | 2 +- ..._or_update_an_azure_automation_webhook.yml | 2 +- data_sources/bro.yml | 3 +- data_sources/crowdstrike_processrollup2.yml | 2 +- data_sources/crushftp.yml | 3 +- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/github.yml | 2 +- .../google_workspace_login_failure.yml | 2 +- .../google_workspace_login_success.yml | 2 +- data_sources/kubernetes_audit.yml | 3 +- data_sources/kubernetes_falco.yml | 3 +- data_sources/linux_secure.yml | 3 +- data_sources/nginx_access.yml | 3 +- data_sources/osquery.yml | 3 +- data_sources/palo_alto_network_threat.yml | 4 +- data_sources/palo_alto_network_traffic.yml | 4 +- .../powershell_installed_iis_modules.yml | 3 +- .../powershell_script_block_logging_4104.yml | 2 +- data_sources/powershell_sip_inventory.yml | 3 +- data_sources/splunk_stream_http.yml | 4 +- data_sources/splunk_stream_ip.yml | 4 +- data_sources/splunk_stream_tcp.yml | 4 +- data_sources/suricata.yml | 3 +- data_sources/sysmon_eventid_1.yml | 3 +- data_sources/sysmon_eventid_10.yml | 3 +- data_sources/sysmon_eventid_11.yml | 3 +- data_sources/sysmon_eventid_12.yml | 3 +- data_sources/sysmon_eventid_13.yml | 3 +- data_sources/sysmon_eventid_15.yml | 3 +- data_sources/sysmon_eventid_17.yml | 3 +- data_sources/sysmon_eventid_18.yml | 3 +- data_sources/sysmon_eventid_20.yml | 3 +- data_sources/sysmon_eventid_21.yml | 3 +- data_sources/sysmon_eventid_22.yml | 3 +- data_sources/sysmon_eventid_23.yml | 3 +- data_sources/sysmon_eventid_3.yml | 3 +- data_sources/sysmon_eventid_5.yml | 3 +- data_sources/sysmon_eventid_6.yml | 3 +- data_sources/sysmon_eventid_7.yml | 3 +- data_sources/sysmon_eventid_8.yml | 3 +- data_sources/sysmon_eventid_9.yml | 3 +- .../windows_active_directory_admon.yml | 2 +- .../windows_event_log_application_2282.yml | 2 +- .../windows_event_log_application_3000.yml | 2 +- data_sources/windows_event_log_capi2_70.yml | 2 +- data_sources/windows_event_log_capi2_81.yml | 2 +- ...ent_log_certificateservicesclient_1007.yml | 2 +- .../windows_event_log_defender_1121.yml | 2 +- .../windows_event_log_defender_1122.yml | 2 +- .../windows_event_log_defender_1129.yml | 2 +- .../windows_event_log_defender_5007.yml | 2 +- .../windows_event_log_printservice_316.yml | 2 +- .../windows_event_log_printservice_808.yml | 2 +- ...event_log_remoteconnectionmanager_1149.yml | 2 +- .../windows_event_log_security_1100.yml | 2 +- .../windows_event_log_security_1102.yml | 2 +- .../windows_event_log_security_4624.yml | 2 +- .../windows_event_log_security_4625.yml | 2 +- .../windows_event_log_security_4627.yml | 2 +- .../windows_event_log_security_4648.yml | 2 +- .../windows_event_log_security_4662.yml | 2 +- .../windows_event_log_security_4663.yml | 2 +- .../windows_event_log_security_4672.yml | 2 +- .../windows_event_log_security_4688.yml | 3 +- .../windows_event_log_security_4698.yml | 2 +- .../windows_event_log_security_4699.yml | 2 +- .../windows_event_log_security_4703.yml | 2 +- .../windows_event_log_security_4719.yml | 2 +- .../windows_event_log_security_4720.yml | 2 +- .../windows_event_log_security_4724.yml | 2 +- .../windows_event_log_security_4725.yml | 2 +- .../windows_event_log_security_4726.yml | 2 +- .../windows_event_log_security_4732.yml | 2 +- .../windows_event_log_security_4738.yml | 2 +- .../windows_event_log_security_4739.yml | 2 +- .../windows_event_log_security_4741.yml | 2 +- .../windows_event_log_security_4742.yml | 2 +- .../windows_event_log_security_4768.yml | 2 +- .../windows_event_log_security_4769.yml | 2 +- .../windows_event_log_security_4771.yml | 2 +- .../windows_event_log_security_4776.yml | 2 +- .../windows_event_log_security_4781.yml | 2 +- .../windows_event_log_security_4794.yml | 2 +- .../windows_event_log_security_4798.yml | 2 +- .../windows_event_log_security_4876.yml | 2 +- .../windows_event_log_security_4886.yml | 2 +- .../windows_event_log_security_4887.yml | 2 +- .../windows_event_log_security_5136.yml | 2 +- .../windows_event_log_security_5137.yml | 2 +- .../windows_event_log_security_5140.yml | 2 +- .../windows_event_log_security_5141.yml | 2 +- .../windows_event_log_security_5145.yml | 2 +- .../windows_event_log_system_4720.yml | 2 +- .../windows_event_log_system_4726.yml | 2 +- .../windows_event_log_system_4728.yml | 99 +++++++++++++++++++ .../windows_event_log_system_7036.yml | 2 +- .../windows_event_log_system_7040.yml | 2 +- .../windows_event_log_system_7045.yml | 2 +- .../windows_event_log_taskscheduler_200.yml | 2 +- data_sources/windows_iis.yml | 2 +- data_sources/windows_iis_29.yml | 2 +- 170 files changed, 408 insertions(+), 232 deletions(-) create mode 100644 data_sources/aws_cloudwatchlogs_vpcflow.yml create mode 100644 data_sources/windows_event_log_system_4728.yml diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index f97be5b2b4..2ae90e54e6 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -7,9 +7,9 @@ description: Data source object for AWS Cloudfront source: aws sourcetype: aws:cloudfront:accesslogs supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index c22708e508..5230cb083b 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -8,7 +8,7 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index f18e90df40..c5738f8dee 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 76f955a0be..cdbe7a49df 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index d523b69f1e..b632e6926d 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 2585e83466..71199a2ca4 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 5279b10239..0470b8cb3b 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 639885e9fd..abeb97372b 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index dc1fe88ad0..52a545ca68 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 1f73639beb..47e1dcbf41 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index 72c39f0b7b..883dbf7df6 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index a1f33c5b39..7bbd4c6690 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index 7820bed6ed..734e236dca 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 21dcced0f2..98f7b43725 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index e27f2b78ca..d05dfd1796 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 3c62564018..66f43c2593 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index f9e225a9b4..2bd9310f35 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 78c912c368..29c2dd686f 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index f8325f0e05..32d487d65f 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index 693f606fd2..8f7a92c3e0 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 87aa8f17ff..534106dc32 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 0c47f50789..7012fa6ed9 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index e7bae91f05..d857e41e47 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 5c3bcc1690..07f58db804 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 87d90da25f..821f144e7f 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 1c1ed0c711..a177153e90 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - apiVersion diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 63a8197dbe..919a2d3be2 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 7f7ac31579..831d5975da 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 27644d074d..52c3247f8f 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index c7277dc3ab..202531ea99 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 7f2aa377f6..16185f9770 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index c81ed19015..0c12590897 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 577d375168..2accf99155 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 3b1b59efe1..b2bdddff08 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index a2c70947e4..dc09302ede 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index c3deffdc38..2a31c5adbe 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index d392e87cdd..fc20e9a7aa 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index b0863404ed..3a0a6e093c 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 32c9cfd1d1..b4019b7926 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - additionalEventData.AuthenticationMethod diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index c7897407fb..2f99322eba 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index eea4b02dda..28d36464c3 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index a507126200..4544f65574 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 0a522fb620..6193228164 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 3426d95f4e..db15c8e372 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 4080c90e4e..6e2cab06ca 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index dcdab36afe..0f21f975bb 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 018f6fe6dc..40c704a7be 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - action diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index 5da5e0619d..448209d713 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -8,9 +8,9 @@ source: aws_cloudtrail sourcetype: aws:cloudtrail separator: eventName supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - app diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml new file mode 100644 index 0000000000..2bf06edc58 --- /dev/null +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -0,0 +1,68 @@ +name: AWS CloudWatchLogs VPCflow +id: 38a34fc4-e128-4478-a8f4-7835d51d5135 +version: 1 +author: Bhavin Patel, Splunk +date: '2024-07-18' +description: Data source object for AWS CloudWatchLogs VPCflow +source: aws_cloudwatchlogs_vpcflow +sourcetype: aws:cloudwatchlogs:vpcflow +separator: eventName +supported_TA: + - name: Splunk Add-on for AWS + version: 7.6.0 + url: https://splunkbase.splunk.com/app/1876 +fields: +- _raw +- _time +- account_id +- action +- app +- aws_account_id +- bytes +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- dest +- dest_ip +- dest_port +- duration +- dvc +- end_time +- eventtype +- host +- index +- interface_id +- linecount +- log_status +- packets +- protocol +- protocol_code +- protocol_full_name +- protocol_version +- punct +- region +- source +- sourcetype +- splunk_server +- splunk_server_group +- src +- src_ip +- src_port +- start_time +- tag +- tag::action +- tag::eventtype +- timeendpos +- timestartpos +- transport +- user_id +- vendor_account +- vendor_product +- version +- vpcflow_action +example_log: '2 123397614277 eni-0b0f9f261f45e6489 10.0.1.30 10.0.1.1 47254 22 17 2 98 1697608042 1697608070 ACCEPT OK' diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 7d78a1de32..a37b28ca37 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -7,9 +7,9 @@ description: Data source object for AWS Security Hub source: aws_securityhub_finding sourcetype: aws:securityhub:finding supported_TA: -- name: Splunk Add-on for Amazon Web Services (AWS) +- name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 7.4.1 + version: 7.6.0 fields: - _time - AwsAccountId diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index c7e338765b..fbff00a6f1 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -10,4 +10,4 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index a0a468ad65..d5c3d1c6e3 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index ae7be77cc6..2b74e1c675 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index fb86357ca7..217628fe43 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index c0a5ff1085..0ab3dce9b4 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index f25e92be67..d79e6c2487 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index e8015f8161..39e5152084 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index eee28e781d..ca458fdfe2 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 276c8accce..9b49a046f8 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 5e3cd3df64..77922a5fc4 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index f0906c6408..e9f6811c23 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index e8276c7521..ccb241befa 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 8f4d42c2e2..4cfc1d5bcf 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 6f09efb5bc..ca88315d92 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 564ac6d8fa..ada7e7f690 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 5d26614a9b..bd060f57ba 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 9d5329b76d..661d97faf4 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 4d8f8966a3..fb361d5afa 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index f9054728e3..ebf50592d2 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 80bbd24828..934ba0d8ff 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.2.2 + version: 5.3.1 fields: - _time - authorization.action diff --git a/data_sources/bro.yml b/data_sources/bro.yml index 100d017f03..72d2cd5415 100644 --- a/data_sources/bro.yml +++ b/data_sources/bro.yml @@ -6,5 +6,4 @@ author: Patrick Bareiss, Splunk description: Data source object for Bro source: bro:http:json sourcetype: bro:http:json -supported_TA: -- {} +supported_TA: [] diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index d05927785e..d3ce7e3a7d 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -8,7 +8,7 @@ source: crowdstrike sourcetype: crowdstrike:events:sensor separator: event_simpleName supported_TA: -- name: CrowdStrike Falcon Event Streams Technical Add-On +- name: CrowdStrike Falcon Event Streams url: https://splunkbase.splunk.com/app/5082 version: 3.2.1 fields: diff --git a/data_sources/crushftp.yml b/data_sources/crushftp.yml index e868f787d8..7c3f19a528 100644 --- a/data_sources/crushftp.yml +++ b/data_sources/crushftp.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for CrushFTP source: crushftp sourcetype: crushftp:sessionlogs -supported_TA: -- {} +supported_TA: [] fields: - _time - _raw diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index 1d32fab60e..283f1372e0 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -9,7 +9,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.6.3 + version: 2.8.0 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 3249163deb..0232b56c23 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -9,7 +9,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.6.3 + version: 2.8.0 fields: - _time - action_type diff --git a/data_sources/github.yml b/data_sources/github.yml index 0b5fd01c40..5114322fa2 100644 --- a/data_sources/github.yml +++ b/data_sources/github.yml @@ -9,7 +9,7 @@ sourcetype: aws:firehose:json supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 2.2.1 + version: 3.0.0 fields: - _time - action diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index 575f5de469..4b827e5f02 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -10,7 +10,7 @@ separator: event.name supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.6.3 + version: 2.8.0 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 7a7d7f42f3..dd5c386fb0 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -10,7 +10,7 @@ separator: event.name supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.6.3 + version: 2.8.0 fields: - _time - actor.email diff --git a/data_sources/kubernetes_audit.yml b/data_sources/kubernetes_audit.yml index acc709438e..9ca3815448 100644 --- a/data_sources/kubernetes_audit.yml +++ b/data_sources/kubernetes_audit.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for Kubernetes Audit source: kubernetes sourcetype: _json -supported_TA: -- {} +supported_TA: [] fields: - _time - annotations.authorization.k8s.io/decision diff --git a/data_sources/kubernetes_falco.yml b/data_sources/kubernetes_falco.yml index 731a1915c8..568d4be771 100644 --- a/data_sources/kubernetes_falco.yml +++ b/data_sources/kubernetes_falco.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for Kubernetes Falco source: kubernetes sourcetype: kube:container:falco -supported_TA: -- {} +supported_TA: [] fields: - _time - command diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 03bdd2458e..cd08575aa2 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for Linux Secure source: /var/log/secure sourcetype: linux_secure -supported_TA: -- {} +supported_TA: [] fields: - _time - action diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 0009ef0fea..87238e5c67 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for Nginx Access source: /var/log/nginx/access.log sourcetype: nginx:plus:kv -supported_TA: -- {} +supported_TA: [] fields: - _time - action diff --git a/data_sources/osquery.yml b/data_sources/osquery.yml index 8bcd9cdd79..7244b5e8ce 100644 --- a/data_sources/osquery.yml +++ b/data_sources/osquery.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for osquery source: osquery sourcetype: osquery:results -supported_TA: -- {} +supported_TA: [] fields: - _time - calendarTime diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index 13ba7cecd1..37d07f372d 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -7,9 +7,9 @@ description: Data source object for Palo Alto Network Threat source: pan:threat sourcetype: pan:threat supported_TA: -- name: Palo Alto Networks Add-on for Splunk +- name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/2757 - version: 8.1.1 + version: 8.1.3 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 773e2b1afa..7f42b934b2 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -7,9 +7,9 @@ description: Data source object for Palo Alto Network Traffic source: screenconnect_palo_traffic sourcetype: pan:traffic supported_TA: -- name: Palo Alto Networks Add-on for Splunk +- name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/2757 - version: 8.1.1 + version: 8.1.3 fields: - _time - date_hour diff --git a/data_sources/powershell_installed_iis_modules.yml b/data_sources/powershell_installed_iis_modules.yml index 663658c8a6..a27822830a 100644 --- a/data_sources/powershell_installed_iis_modules.yml +++ b/data_sources/powershell_installed_iis_modules.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for Powershell Installed IIS Modules source: powershell://AppCmdModules sourcetype: Pwsh:InstalledIISModules -supported_TA: -- {} +supported_TA: [] fields: - _time - Schema diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 7e31c1dbbc..87b7c769ea 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -9,7 +9,7 @@ sourcetype: xmlwineventlog supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/powershell_sip_inventory.yml b/data_sources/powershell_sip_inventory.yml index f5dfea49f6..dc02c04217 100644 --- a/data_sources/powershell_sip_inventory.yml +++ b/data_sources/powershell_sip_inventory.yml @@ -6,5 +6,4 @@ author: Patrick Bareiss, Splunk description: Data source object for Powershell SIP Inventory source: powershell://SubjectInterfacePackage sourcetype: PwSh:SubjectInterfacePackage -supported_TA: -- {} +supported_TA: [] diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index 832dea60ff..29db818262 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -7,9 +7,9 @@ description: Data source object for Splunk Stream HTTP source: stream:http sourcetype: stream:http supported_TA: -- name: Splunk App for Stream +- name: Splunk Stream url: https://splunkbase.splunk.com/app/1809 - version: 8.1.1 + version: 8.1.3 fields: - _time - bytes diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index 5e6a83beeb..d722002f17 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -7,9 +7,9 @@ description: Data source object for Splunk Stream IP source: stream:ip sourcetype: stream:ip supported_TA: -- name: Splunk App for Stream +- name: Splunk Stream url: https://splunkbase.splunk.com/app/1809 - version: 8.1.1 + version: 8.1.3 fields: - _time - action diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index 5b8f4de4a6..685c0f6931 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -7,6 +7,6 @@ description: Data source object for Splunk Stream TCP source: stream:tcp sourcetype: stream:tcp supported_TA: -- name: Splunk App for Stream +- name: Splunk Stream url: https://splunkbase.splunk.com/app/1809 - version: 8.1.1 + version: 8.1.3 diff --git a/data_sources/suricata.yml b/data_sources/suricata.yml index b27ac0af4b..6ad1b8e80c 100644 --- a/data_sources/suricata.yml +++ b/data_sources/suricata.yml @@ -6,8 +6,7 @@ author: Patrick Bareiss, Splunk description: Data source object for Suricata source: suricata sourcetype: suricata -supported_TA: -- {} +supported_TA: [] fields: - _time - app_proto diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index 6e279b4518..f06d173edf 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 1 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index bef6271097..7e62bbdcdb 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 10 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - CallTrace diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index bb79434a86..247a454c9a 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 11 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index 87f7af49cd..0327b55ea5 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 12 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index ae37b20a13..640a5c247d 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 13 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 2a2740c8d3..6c6f26ab50 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 15 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index 7157b87ee5..9b168b78d4 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 17 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 411884fad5..7c0b36037e 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 18 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml index f90ebcd91c..edfbeac9b1 100644 --- a/data_sources/sysmon_eventid_20.yml +++ b/data_sources/sysmon_eventid_20.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 20 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml index 26a6f6af57..a45d6f9f6f 100644 --- a/data_sources/sysmon_eventid_21.yml +++ b/data_sources/sysmon_eventid_21.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 21 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index 0a321131f8..abde460c2b 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 22 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index 9e45d94b4b..5e6e558713 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 23 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Archived diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 258a07fb4c..4f17b2b38a 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 3 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml index 2472edb510..e54ad2dad3 100644 --- a/data_sources/sysmon_eventid_5.yml +++ b/data_sources/sysmon_eventid_5.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 5 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index 943e48837d..cf69ff13a1 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 6 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index 9cc83be7e4..de0f3e9300 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 7 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index 8657567471..4daea4b08e 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 8 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml index 5fa985f0a0..388869cb15 100644 --- a/data_sources/sysmon_eventid_9.yml +++ b/data_sources/sysmon_eventid_9.yml @@ -7,10 +7,11 @@ description: Data source object for Sysmon EventID 9 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog separator: EventID +configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709/ - version: 4.0.0 + version: 4.0.1 fields: - _time - Channel diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 59abc1131f..591eac8fb6 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -9,7 +9,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index f7d9a9569e..e304ac0df4 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 2415bb058a..43ec8ca515 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 173081847f..47db13d6ab 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index 8bca7cbb19..5ed24eb289 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 2eb2327c11..8545b32e9b 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 6e83bfaa1e..b3147767b3 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 214fdd95e7..73594c09b9 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index cf2d254758..b191570988 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index a2cd143893..1fb3983cb9 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index ff94ae97f1..ed12dfe02a 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 2ecb0dbc9b..90d3e80d2c 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 8fada924c2..499520e805 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 16052bd22c..5eac0482df 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index c2164817b4..f4e090f7f9 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 0864fb4d62..b377daf317 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 7824f0dfee..321dfdaebb 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 0682bbbc29..399d944750 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index a5840b93d3..9fcade9e88 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index 004e36888c..6d2a77ae22 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 44fa5cf912..aeb64b9849 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 2a3942729b..66c953ff1d 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index bb84aab318..273a4ec8fc 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -7,10 +7,11 @@ description: Data source object for Windows Event Log Security 4688 source: XmlWinEventLog:Security sourcetype: xmlwineventlog separator: EventCode +configuration: Enabling Windows event log process command line logging via group policy object https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_Windows_event_log_process_command_line_logging_via_group_policy_object supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 4da1f09347..2d23899632 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 46eb5e7e31..f7c7c00c52 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index b1c75815b6..75c6bc1ad2 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index f2fce95f77..d3bd23a31c 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index c66b7a7ab9..976a1c8ce1 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 85fbadeebc..68dcf6a49f 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index f9b68e4c9f..f2718026ac 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 9dcfc00b39..75e43e4a94 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 490f96750f..9af1fd6d61 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index a0a4cd9ef0..92492a2d18 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index ede3cf72fd..fcf04236d9 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 9794e770dd..9976c94880 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 5f6027fe5a..3c7a617af6 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 400aa553d4..dbc74e1d2b 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 353f71515d..8215487700 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 1b622c319e..04cb621bcd 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 355bc68f64..dc74add04f 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index 0ea1b71cf7..fbd50f8147 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index d640de4776..ecdc4c46db 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index d488917f96..f923fc486a 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 8c3fc3750b..181c1b241c 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 6ea033bbef..eb9cbbdea0 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index f01243b726..80421384fc 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index 4fd9d9ce60..0b2759349f 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 57b73d835c..7076b1bbcf 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index d0b23360d3..1c8500f5c7 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 09f144cdb4..3ec7c1cbc8 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 39fdae2cff..83c50c2e9f 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 1464d969e3..dd9230d0ef 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 8e6fcf020f..85030c1641 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml new file mode 100644 index 0000000000..2b4b917048 --- /dev/null +++ b/data_sources/windows_event_log_system_4728.yml @@ -0,0 +1,99 @@ +name: Windows Event Log System 4728 +id: 4549f0ac-3df9-4bfb-bea5-1459690c8040 +version: 1 +date: '2024-07-18' +author: Patrick Bareiss, Splunk +description: Data source object for Windows Event Log System 4728 +source: XmlWinEventLog:System +sourcetype: xmlwineventlog +separator: EventCode +supported_TA: +- name: Splunk Add-on for Microsoft Windows + url: https://splunkbase.splunk.com/app/742 + version: 8.9.0 +fields: +- _time +- Account_Domain +- Account_Name +- CategoryString +- ComputerName +- Error_Code +- EventCode +- EventType +- Keywords +- LogName +- Logon_ID +- Message +- OpCode +- RecordNumber +- Security_ID +- SourceName +- Subject_Account_Domain +- Subject_Account_Name +- Subject_Logon_ID +- Subject_Security_ID +- Target_Account_Domain +- Target_Account_Name +- Target_Security_ID +- TaskCategory +- Type +- action +- app +- body +- category +- change_type +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- dest +- dest_nt_domain +- dest_nt_host +- dvc +- dvc_nt_host +- event_id +- eventtype +- host +- id +- index +- linecount +- member_dn +- member_id +- member_nt_domain +- msad_action +- name +- object +- object_attrs +- object_category +- object_id +- product +- punct +- result +- session_id +- severity +- severity_id +- signature +- signature_id +- source +- sourcetype +- splunk_server +- src_nt_domain +- src_user +- src_user_name +- status +- subject +- ta_windows_action +- ta_windows_security_CategoryString +- tag +- tag::eventtype +- timeendpos +- timestartpos +- user +- user_group +- user_name +- vendor +- vendor_product diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0dac45adea..bbc47d514b 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 3cdcf9d06b..9c2fe0b263 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index d515b774eb..cc9dce8d16 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index f08316f364..4aadd5eef7 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -10,7 +10,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ActionName diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 75fd6472f6..4b60956cbb 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -10,4 +10,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index c2ae08d1c0..6db0557ffb 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -10,7 +10,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 8.8.0 + version: 8.9.0 fields: - _time - ComputerName From bf1d25af3862cfb75a4770dc4970084bbab0e140 Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Mon, 5 Aug 2024 10:12:12 +0200 Subject: [PATCH 2/3] improved data source TA version --- data_sources/azure_active_directory.yml | 2 +- ...e_directory_add_app_role_assignment_to_service_principal.yml | 2 +- data_sources/azure_active_directory_add_member_to_role.yml | 2 +- .../azure_active_directory_add_owner_to_application.yml | 2 +- data_sources/azure_active_directory_add_service_principal.yml | 2 +- data_sources/azure_active_directory_add_unverified_domain.yml | 2 +- data_sources/azure_active_directory_consent_to_application.yml | 2 +- .../azure_active_directory_disable_strong_authentication.yml | 2 +- data_sources/azure_active_directory_enable_account.yml | 2 +- data_sources/azure_active_directory_invite_external_user.yml | 2 +- .../azure_active_directory_reset_password_(by_admin).yml | 2 +- .../azure_active_directory_set_domain_authentication.yml | 2 +- data_sources/azure_active_directory_sign_in_activity.yml | 2 +- data_sources/azure_active_directory_update_application.yml | 2 +- .../azure_active_directory_update_authorization_policy.yml | 2 +- data_sources/azure_active_directory_update_user.yml | 2 +- .../azure_active_directory_user_registered_security_info.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_account.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_runbook.yml | 2 +- ...azure_audit_create_or_update_an_azure_automation_webhook.yml | 2 +- data_sources/g_suite_drive.yml | 2 +- data_sources/g_suite_gmail.yml | 2 +- data_sources/google_workspace_login_failure.yml | 2 +- data_sources/google_workspace_login_success.yml | 2 +- data_sources/sysmon_eventid_1.yml | 2 +- data_sources/sysmon_eventid_10.yml | 2 +- data_sources/sysmon_eventid_11.yml | 2 +- data_sources/sysmon_eventid_12.yml | 2 +- data_sources/sysmon_eventid_13.yml | 2 +- data_sources/sysmon_eventid_15.yml | 2 +- data_sources/sysmon_eventid_17.yml | 2 +- data_sources/sysmon_eventid_18.yml | 2 +- data_sources/sysmon_eventid_20.yml | 2 +- data_sources/sysmon_eventid_21.yml | 2 +- data_sources/sysmon_eventid_22.yml | 2 +- data_sources/sysmon_eventid_23.yml | 2 +- data_sources/sysmon_eventid_3.yml | 2 +- data_sources/sysmon_eventid_5.yml | 2 +- data_sources/sysmon_eventid_6.yml | 2 +- data_sources/sysmon_eventid_7.yml | 2 +- data_sources/sysmon_eventid_8.yml | 2 +- data_sources/sysmon_eventid_9.yml | 2 +- 42 files changed, 42 insertions(+), 42 deletions(-) diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index fbff00a6f1..50475e64cf 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -10,4 +10,4 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index d5c3d1c6e3..17ca92f9ba 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 2b74e1c675..f8f27d98b7 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 217628fe43..0f9e90f7eb 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 0ab3dce9b4..6df2599dd6 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index d79e6c2487..b33e692636 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 39e5152084..036aeea13d 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index ca458fdfe2..072a4d2e8c 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 9b49a046f8..a179b646b3 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 77922a5fc4..aee2bc6551 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index e9f6811c23..bb16971e48 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index ccb241befa..636e68cbec 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 4cfc1d5bcf..6cc0316ff6 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index ca88315d92..f0b58b2128 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index ada7e7f690..91a4acf629 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index bd060f57ba..ac67236f75 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 661d97faf4..82c6763b06 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fb361d5afa..e40db27da9 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index ebf50592d2..d4a30dbd73 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 934ba0d8ff..34d0e2afab 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.3.1 + version: 5.3.2 fields: - _time - authorization.action diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index 283f1372e0..c54aa6cf12 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -9,7 +9,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.8.0 + version: 2.8.1 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 0232b56c23..e6de43d7bc 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -9,7 +9,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.8.0 + version: 2.8.1 fields: - _time - action_type diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index 4b827e5f02..a194abe490 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -10,7 +10,7 @@ separator: event.name supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.8.0 + version: 2.8.1 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index dd5c386fb0..1537e212a5 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -10,7 +10,7 @@ separator: event.name supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 2.8.0 + version: 2.8.1 fields: - _time - actor.email diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index f06d173edf..b08464460d 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index 7e62bbdcdb..b27ee17fa7 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 247a454c9a..9395e9fdbd 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index 0327b55ea5..130f6b5fbf 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index 640a5c247d..3e08eaa473 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 6c6f26ab50..4f294cdf46 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index 9b168b78d4..43bc1e998c 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 7c0b36037e..6093ea2726 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml index edfbeac9b1..c1f2309d03 100644 --- a/data_sources/sysmon_eventid_20.yml +++ b/data_sources/sysmon_eventid_20.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml index a45d6f9f6f..b813ae573b 100644 --- a/data_sources/sysmon_eventid_21.yml +++ b/data_sources/sysmon_eventid_21.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index abde460c2b..553de9b48f 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index 5e6e558713..e26a030729 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 4f17b2b38a..8b4e47e79d 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml index e54ad2dad3..818d150bb4 100644 --- a/data_sources/sysmon_eventid_5.yml +++ b/data_sources/sysmon_eventid_5.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index cf69ff13a1..a1d7faf0f9 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index de0f3e9300..1489ba8474 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index 4daea4b08e..fb712bf9ba 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml index 388869cb15..75c7fde496 100644 --- a/data_sources/sysmon_eventid_9.yml +++ b/data_sources/sysmon_eventid_9.yml @@ -10,7 +10,7 @@ separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon - url: https://splunkbase.splunk.com/app/5709/ + url: https://splunkbase.splunk.com/app/5709 version: 4.0.1 fields: - _time From 19a1470d14b0f0f62325153f5531f8027545aa11 Mon Sep 17 00:00:00 2001 From: pyth0n1c Date: Mon, 5 Aug 2024 16:42:40 -0700 Subject: [PATCH 3/3] Update crowdstrike ta --- data_sources/crowdstrike_processrollup2.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 9f93eb1443..3d1d80bc8d 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -10,7 +10,7 @@ separator: event_simpleName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 1.5.0 + version: 2.0.0 fields: - AuthenticationId - AuthenticationId_meaning