From cdc2ae5ed2a58c7bb5a8e7e43af896259b491663 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 2 Jun 2025 16:21:05 -0700
Subject: [PATCH] Update windows_event_log_security_5145.yml

---
 data_sources/windows_event_log_security_5145.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml
index 6e86281790..41befe43b5 100644
--- a/data_sources/windows_event_log_security_5145.yml
+++ b/data_sources/windows_event_log_security_5145.yml
@@ -1,7 +1,7 @@
 name: Windows Event Log Security 5145
 id: 0746479b-7b82-4d7e-8811-0b35da00f798
-version: 2
-date: '2025-01-23'
+version: 3
+date: '2025-06-02'
 author: Patrick Bareiss, Splunk
 description: Logs detailed information about access to a network share, including
   the user, share path, accessed file, and access permissions.
@@ -121,6 +121,7 @@ field_mappings:
     SubjectLogonId: user_logon_id
     SubjectUserSid: user_sid
     ShareName: share
+    Computer: dest
 - data_model: ocsf
   mapping:
     AccessList: access_list
@@ -135,6 +136,7 @@ field_mappings:
     SubjectLogonId: actor.session.uid
     SubjectUserSid: actor.user.uid
     ShareName: share
+    Computer: device.hostname
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>5145</EventID><Version>0</Version><Level>0</Level><Task>12811</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated
   SystemTime='2024-03-11T03:06:39.742608600Z'/><EventRecordID>2018939</EventRecordID><Correlation/><Execution