admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-10-09 11:12:24 -07:00
committed by GitHub
parent f7ee25c5a8 47f2827fec
commit 88e170ce56
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
data_sources/crowdstrike_processrollup2.yml
+11 -11
View File
@@ -10,7 +10,7 @@ separator: event_simpleName
supported_TA:
- name: Splunk Add-on for CrowdStrike FDR
url: https://splunkbase.splunk.com/app/5579
version: 2.0.0
version: 2.0.1
fields:
- AuthenticationId
- AuthenticationId_meaning
@@ -91,16 +91,16 @@ fields:
- user_id
- vendor_product
field_mappings:
- data_model: cim
data_set: Endpoint.Processes
mapping:
CommandLine: Processes.process
ImageFileName: Processes.process_path
ParentBaseFileName: Processes.parent_process_name
ParentProcessId: Processes.parent_process_id
RawProcessId: Processes.process_id
SHA256HashData: Processes.process_hash
UserSid: Processes.user
- data_model: cim
data_set: Endpoint.Processes
mapping:
CommandLine: Processes.process
ImageFileName: Processes.process_path
ParentBaseFileName: Processes.parent_process_name
ParentProcessId: Processes.parent_process_id
RawProcessId: Processes.process_id
SHA256HashData: Processes.process_hash
UserSid: Processes.user
example_log: '{"LinkName":"C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start
Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk","ProcessCreateFlags":"67634196","IntegrityLevel":"12288","ParentProcessId":"5459598860","SourceProcessId":"5459598860","aip":"3.126.231.40","SHA1HashData":"0000000000000000000000000000000000000000","UserSid":"S-1-5-21-586445407-708991241-1829972403-500","event_platform":"Win","TokenType":"1","ProcessEndTime":"","AuthenticodeHashData":"3b98faafc17b47beb9027c437fceeafdf0624a1c","ParentBaseFileName":"explorer.exe","EventOrigin":"1","ImageSubsystem":"3","id":"e2210781-0e8f-47d2-bf6a-56d2c59f38ee","EffectiveTransmissionClass":"3","SessionId":"2","ShowWindowFlags":"1","Tags":"27,
40, 151, 874, 924, 12094627905582, 12094627906234, 211106232533012, 212205744161605,