admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

edit the data source example

Browse Source
This commit is contained in:
Gowthamaraj rajendran
2024-09-24 10:03:31 -07:00
parent 19f81c24ef
commit 8451aead4f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/windows_defender_alerts.yml
+2 -2
View File
@@ -54,7 +54,7 @@ fields:
- AttackTechniques
- DetectionSource
- Severity
example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish",
example_log: '{"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish",
"category": "AdvancedHunting-AlertEvidence", "properties": {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25",
"EntityType": "CloudResource", "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": null,
"RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": null, "AccountObjectId": null, "DeviceId": null,
@@ -64,4 +64,4 @@ example_log: {"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-ab
"Microsoft Defender for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": null, "ApplicationId": null, "Application":
null, "DeviceName": null, "FileSize": null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, "AccountUpn": null, "OAuthApplicationId":
null, "Categories": "[\"InitialAccess\"]", "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": "DefenderForServers",
"Severity": "High"}, "Tenant": "DefaultTenant"}
"Severity": "High"}, "Tenant": "DefaultTenant"}'