From f77751098e501936cff135bc29e2a49ffeb442dc Mon Sep 17 00:00:00 2001
From: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Date: Sat, 7 Jun 2025 06:57:43 +0000
Subject: [PATCH] Updated TAs

---
 contentctl.yml                                |  8 +-
 .../ms365_defender_incident_alerts.yml        |  2 +-
 data_sources/ms_defender_atp_alerts.yml       |  2 +-
 data_sources/sysmon_eventid_1.yml             | 81 ++++++++++---------
 data_sources/sysmon_eventid_10.yml            | 22 ++---
 data_sources/sysmon_eventid_11.yml            | 18 ++---
 data_sources/sysmon_eventid_12.yml            | 20 ++---
 data_sources/sysmon_eventid_13.yml            | 24 +++---
 data_sources/sysmon_eventid_14.yml            |  4 +-
 data_sources/sysmon_eventid_15.yml            | 28 +++----
 data_sources/sysmon_eventid_17.yml            | 24 +++---
 data_sources/sysmon_eventid_18.yml            | 24 +++---
 data_sources/sysmon_eventid_20.yml            | 24 +++---
 data_sources/sysmon_eventid_21.yml            | 26 +++---
 data_sources/sysmon_eventid_22.yml            | 14 ++--
 data_sources/sysmon_eventid_23.yml            | 34 ++++----
 data_sources/sysmon_eventid_26.yml            | 36 ++++-----
 data_sources/sysmon_eventid_3.yml             | 30 +++----
 data_sources/sysmon_eventid_5.yml             | 20 ++---
 data_sources/sysmon_eventid_6.yml             | 16 ++--
 data_sources/sysmon_eventid_7.yml             | 34 ++++----
 data_sources/sysmon_eventid_8.yml             | 30 +++----
 data_sources/sysmon_eventid_9.yml             | 22 ++---
 23 files changed, 272 insertions(+), 271 deletions(-)

diff --git a/contentctl.yml b/contentctl.yml
index 2d92004d97..d2acd7ae8f 100644
--- a/contentctl.yml
+++ b/contentctl.yml
@@ -71,9 +71,9 @@ apps:
 - uid: 5709
   title: Splunk Add-on for Sysmon
   appid: Splunk_TA_microsoft_sysmon
-  version: 4.0.2
+  version: 4.0.3
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-sysmon_402.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-sysmon_403.tgz
 - uid: 833
   title: Splunk Add-on for Unix and Linux
   appid: Splunk_TA_nix
@@ -185,9 +185,9 @@ apps:
 - uid: 6207
   title: Splunk Add-on for Microsoft Security
   appid: Splunk_TA_MS_Security
-  version: 2.5.0
+  version: 2.5.1
   description: description of app
-  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_250.tgz
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-security_251.tgz
 - uid: 2734
   title: URL Toolbox
   appid: URL_TOOLBOX
diff --git a/data_sources/ms365_defender_incident_alerts.yml b/data_sources/ms365_defender_incident_alerts.yml
index 81bc243003..58c9d6c552 100644
--- a/data_sources/ms365_defender_incident_alerts.yml
+++ b/data_sources/ms365_defender_incident_alerts.yml
@@ -16,7 +16,7 @@ sourcetype: ms365:defender:incident:alerts
 supported_TA:
 - name: Splunk Add-on for Microsoft Security
   url: https://splunkbase.splunk.com/app/6207
-  version: 2.5.0
+  version: 2.5.1
 fields:
 - actorName
 - alertId
diff --git a/data_sources/ms_defender_atp_alerts.yml b/data_sources/ms_defender_atp_alerts.yml
index 1655a48af7..3f6eac12ca 100644
--- a/data_sources/ms_defender_atp_alerts.yml
+++ b/data_sources/ms_defender_atp_alerts.yml
@@ -16,7 +16,7 @@ sourcetype: ms:defender:atp:alerts
 supported_TA:
 - name: Splunk Add-on for Microsoft Security
   url: https://splunkbase.splunk.com/app/6207
-  version: 2.5.0
+  version: 2.5.1
 fields:
 - column
 - accountName
diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml
index a2c51e613c..ad3df482ac 100644
--- a/data_sources/sysmon_eventid_1.yml
+++ b/data_sources/sysmon_eventid_1.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -118,26 +118,26 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-  - action 
-  - dest 
-  - original_file_name 
-  - parent_process 
-  - parent_process_exec 
-  - parent_process_guid 
-  - parent_process_id 
-  - parent_process_name 
-  - parent_process_path 
-  - process 
-  - process_exec 
-  - process_guid 
-  - process_hash 
-  - process_id 
-  - process_integrity_level 
-  - process_name 
-  - process_path 
-  - user 
-  - user_id
-  - vendor_product
+- action
+- dest
+- original_file_name
+- parent_process
+- parent_process_exec
+- parent_process_guid
+- parent_process_id
+- parent_process_name
+- parent_process_path
+- process
+- process_exec
+- process_guid
+- process_hash
+- process_id
+- process_integrity_level
+- process_name
+- process_path
+- user
+- user_id
+- vendor_product
 field_mappings:
 - data_model: cim
   data_set: Endpoint.Processes
@@ -178,22 +178,23 @@ convert_to_log_source:
     User: UserSid
     ParentProcessId: ParentProcessId
     ParentImage: ParentBaseFileName
-example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
-  Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
-  SystemTime='2020-10-08T11:03:46.617920300Z'/><EventRecordID>4522</EventRecordID><Correlation/><Execution
-  ProcessID='2912' ThreadID='3424'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-dc-6764986.attackrange.local</Computer><Security
-  UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2020-10-08
-  11:03:46.615</Data><Data Name='ProcessGuid'>{96128EA2-F212-5F7E-E400-000000007F01}</Data><Data
-  Name='ProcessId'>2296</Data><Data Name='Image'>C:\Windows\System32\cmd.exe</Data><Data
-  Name='FileVersion'>10.0.14393.0 (rs1_release.160715-1616)</Data><Data Name='Description'>Windows
-  Command Processor</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data
-  Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>Cmd.Exe</Data><Data
-  Name='CommandLine'>"C:\Windows\system32\cmd.exe" /c "reg save HKLM\sam %%temp%%\sam
-  &amp; reg save HKLM\system %%temp%%\system &amp; reg save HKLM\security %%temp%%\security"
-  </Data><Data Name='CurrentDirectory'>C:\Users\ADMINI~1\AppData\Local\Temp\</Data><Data
-  Name='User'>ATTACKRANGE\Administrator</Data><Data Name='LogonGuid'>{96128EA2-F210-5F7E-ACD4-080000000000}</Data><Data
-  Name='LogonId'>0x8d4ac</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>High</Data><Data
-  Name='Hashes'>MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A</Data><Data
-  Name='ParentProcessGuid'>{96128EA2-F211-5F7E-DF00-000000007F01}</Data><Data Name='ParentProcessId'>4624</Data><Data
-  Name='ParentImage'>C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data><Data
-  Name='ParentCommandLine'>"powershell.exe" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==</Data></EventData></Event>
+example_log: "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider\
+  \ Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated\
+  \ SystemTime='2020-10-08T11:03:46.617920300Z'/><EventRecordID>4522</EventRecordID><Correlation/><Execution\
+  \ ProcessID='2912' ThreadID='3424'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>win-dc-6764986.attackrange.local</Computer><Security\
+  \ UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='UtcTime'>2020-10-08\
+  \ 11:03:46.615</Data><Data Name='ProcessGuid'>{96128EA2-F212-5F7E-E400-000000007F01}</Data><Data\
+  \ Name='ProcessId'>2296</Data><Data Name='Image'>C:\\Windows\\System32\\cmd.exe</Data><Data\
+  \ Name='FileVersion'>10.0.14393.0 (rs1_release.160715-1616)</Data><Data Name='Description'>Windows\
+  \ Command Processor</Data><Data Name='Product'>Microsoft\xAE Windows\xAE Operating\
+  \ System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>Cmd.Exe</Data><Data\
+  \ Name='CommandLine'>\"C:\\Windows\\system32\\cmd.exe\" /c \"reg save HKLM\\sam\
+  \ %%temp%%\\sam &amp; reg save HKLM\\system %%temp%%\\system &amp; reg save HKLM\\\
+  security %%temp%%\\security\" </Data><Data Name='CurrentDirectory'>C:\\Users\\ADMINI~1\\\
+  AppData\\Local\\Temp\\</Data><Data Name='User'>ATTACKRANGE\\Administrator</Data><Data\
+  \ Name='LogonGuid'>{96128EA2-F210-5F7E-ACD4-080000000000}</Data><Data Name='LogonId'>0x8d4ac</Data><Data\
+  \ Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>High</Data><Data\
+  \ Name='Hashes'>MD5=F4F684066175B77E0C3A000549D2922C,SHA256=935C1861DF1F4018D698E8B65ABFA02D7E9037D8F68CA3C2065B6CA165D44AD2,IMPHASH=3062ED732D4B25D1C64F084DAC97D37A</Data><Data\
+  \ Name='ParentProcessGuid'>{96128EA2-F211-5F7E-DF00-000000007F01}</Data><Data Name='ParentProcessId'>4624</Data><Data\
+  \ Name='ParentImage'>C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe</Data><Data\
+  \ Name='ParentCommandLine'>\"powershell.exe\" -noninteractive -encodedcommand WwBDAG8AbgBzAG8AbABlAF0AOgA6AEkAbgBwAHUAdABFAG4AYwBvAGQAaQBuAGcAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlADsAIABJAG0AcABvAHIAdAAtAE0AbwBkAHUAbABlACAAIgBDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAaQBuAHYAbwBrAGUALQBhAHQAbwBtAGkAYwByAGUAZAB0AGUAYQBtAFwASQBuAHYAbwBrAGUALQBBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAC4AcABzAGQAMQAiACAALQBGAG8AcgBjAGUACgBJAG4AdgBvAGsAZQAtAEEAdABvAG0AaQBjAFQAZQBzAHQAIAAiAFQAMQAwADAAMwAuADAAMAAyACIAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwBvAG4AZABzACAAMwAwADAAIAAtAEUAeABlAGMAdQB0AGkAbwBuAEwAbwBnAFAAYQB0AGgAIABDADoAXABBAHQAbwBtAGkAYwBSAGUAZABUAGUAYQBtAFwAYQB0AGMAXwBlAHgAZQBjAHUAdABpAG8AbgAuAGMAcwB2AA==</Data></EventData></Event>"
diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml
index 9a2c613618..afcb3ffd8a 100644
--- a/data_sources/sysmon_eventid_10.yml
+++ b/data_sources/sysmon_eventid_10.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - CallTrace
@@ -101,16 +101,16 @@ fields:
 output_fields:
 - dest
 - user_id
-- parent_process_name 
-- parent_process_guid 
-- process_name 
-- process_guid 
-- process_id 
-- signature 
-- SourceImage 
-- TargetImage 
-- GrantedAccess 
-- CallTrace 
+- parent_process_name
+- parent_process_guid
+- process_name
+- process_guid
+- process_id
+- signature
+- SourceImage
+- TargetImage
+- GrantedAccess
+- CallTrace
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>10</EventID><Version>3</Version><Level>4</Level><Task>10</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
   SystemTime='2022-02-01T21:01:44.672666100Z'/><EventRecordID>150624412</EventRecordID><Correlation/><Execution
diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml
index 2030a5982a..1d993007aa 100644
--- a/data_sources/sysmon_eventid_11.yml
+++ b/data_sources/sysmon_eventid_11.yml
@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -93,14 +93,14 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- dest 
-- file_name 
-- file_path 
-- process_guid 
-- process_id 
-- user 
-- vendor_product 
+- action
+- dest
+- file_name
+- file_path
+- process_guid
+- process_id
+- user
+- vendor_product
 field_mappings:
 - data_model: cim
   data_set: Endpoint.Filesystem
diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml
index 05cf165013..f335d5252d 100644
--- a/data_sources/sysmon_eventid_12.yml
+++ b/data_sources/sysmon_eventid_12.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -95,15 +95,15 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- dest 
-- process_guid 
-- process_id 
-- registry_hive 
-- registry_path 
-- registry_key_name 
-- status 
-- user 
+- action
+- dest
+- process_guid
+- process_id
+- registry_hive
+- registry_path
+- registry_key_name
+- status
+- user
 - vendor_product
 field_mappings:
 - data_model: cim
diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml
index c0b9c8184e..e5b70e2218 100644
--- a/data_sources/sysmon_eventid_13.yml
+++ b/data_sources/sysmon_eventid_13.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -102,17 +102,17 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- dest 
-- process_guid 
-- process_id 
-- registry_hive 
-- registry_path 
-- registry_key_name 
-- registry_value_data 
-- registry_value_name 
-- status 
-- user 
+- action
+- dest
+- process_guid
+- process_id
+- registry_hive
+- registry_path
+- registry_key_name
+- registry_value_data
+- registry_value_name
+- status
+- user
 - vendor_product
 field_mappings:
 - data_model: cim
diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml
index dcec0bd324..5d559c6177 100644
--- a/data_sources/sysmon_eventid_14.yml
+++ b/data_sources/sysmon_eventid_14.yml
@@ -11,7 +11,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
-example_log: |-
+example_log: ''
diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml
index a2fcb496b7..34f0df8a9c 100644
--- a/data_sources/sysmon_eventid_15.yml
+++ b/data_sources/sysmon_eventid_15.yml
@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -98,19 +98,19 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- dest 
-- dvc 
-- file_hash 
-- file_name 
-- file_path 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
-- user_id 
+- dest
+- dvc
+- file_hash
+- file_name
+- file_path
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>15</EventID><Version>2</Version><Level>4</Level><Task>15</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml
index f863d5223d..61010cb40b 100644
--- a/data_sources/sysmon_eventid_17.yml
+++ b/data_sources/sysmon_eventid_17.yml
@@ -14,7 +14,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -86,17 +86,17 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- dest 
-- dvc 
-- pipe_name 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
-- user_id 
+- dest
+- dvc
+- pipe_name
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>17</EventID><Version>1</Version><Level>4</Level><Task>17</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml
index bd57ce9086..463f73d3b6 100644
--- a/data_sources/sysmon_eventid_18.yml
+++ b/data_sources/sysmon_eventid_18.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -90,17 +90,17 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- dest 
-- dvc 
-- pipe_name 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
-- user_id 
+- dest
+- dvc
+- pipe_name
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>18</EventID><Version>1</Version><Level>4</Level><Task>18</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml
index 1c39b1cc7a..1326fca049 100644
--- a/data_sources/sysmon_eventid_20.yml
+++ b/data_sources/sysmon_eventid_20.yml
@@ -17,7 +17,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -92,17 +92,17 @@ fields:
 - user_name
 - vendor_product
 output_fields:
-- dest 
-- dvc 
-- object 
-- object_category 
-- object_path 
-- signature 
-- signature_id 
-- src 
-- status 
-- user 
-- user_id 
+- dest
+- dvc
+- object
+- object_category
+- object_path
+- signature
+- signature_id
+- src
+- status
+- user
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>20</EventID><Version>3</Version><Level>4</Level><Task>20</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml
index 43b2160f51..75eec7cc6d 100644
--- a/data_sources/sysmon_eventid_21.yml
+++ b/data_sources/sysmon_eventid_21.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -95,18 +95,18 @@ fields:
 - user_name
 - vendor_product
 output_fields:
-- dest 
-- dvc 
-- object 
-- object_attrs 
-- object_category 
-- object_path 
-- signature 
-- signature_id 
-- src 
-- status 
-- user 
-- user_id 
+- dest
+- dvc
+- object
+- object_attrs
+- object_category
+- object_path
+- signature
+- signature_id
+- src
+- status
+- user
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>21</EventID><Version>3</Version><Level>4</Level><Task>21</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml
index d13419f5a8..5bdc35761e 100644
--- a/data_sources/sysmon_eventid_22.yml
+++ b/data_sources/sysmon_eventid_22.yml
@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 field_mappings:
 - data_model: cim
   data_set: DNS
@@ -96,12 +96,12 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- answer 
-- answer_count 
-- query 
-- query_count 
-- reply_code_id 
-- src 
+- answer
+- answer_count
+- query
+- query_count
+- reply_code_id
+- src
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>22</EventID><Version>5</Version><Level>4</Level><Task>22</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml
index b5bf573eb8..eec4f5d944 100644
--- a/data_sources/sysmon_eventid_23.yml
+++ b/data_sources/sysmon_eventid_23.yml
@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Archived
@@ -101,22 +101,22 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- dest 
-- dvc 
-- file_path 
-- file_hash 
-- file_name 
-- file_modify_time 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
-- user 
-- user_id 
+- action
+- dest
+- dvc
+- file_path
+- file_hash
+- file_name
+- file_modify_time
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
+- user
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>23</EventID><Version>5</Version><Level>4</Level><Task>23</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml
index 5c050dcd0c..c98fa18aee 100644
--- a/data_sources/sysmon_eventid_26.yml
+++ b/data_sources/sysmon_eventid_26.yml
@@ -11,25 +11,25 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 output_fields:
-- action 
-- dest 
-- dvc 
-- file_path 
-- file_hash 
-- file_name 
-- file_modify_time 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
-- user 
-- user_id 
+- action
+- dest
+- dvc
+- file_path
+- file_hash
+- file_name
+- file_modify_time
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
+- user
+- user_id
 - vendor_product
-example_log: |-
+example_log: ''
diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml
index d382ab2fce..742a7ec0c7 100644
--- a/data_sources/sysmon_eventid_3.yml
+++ b/data_sources/sysmon_eventid_3.yml
@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -115,20 +115,20 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- action 
-- app 
-- dest 
-- dest_ip 
-- dest_port 
-- direction 
-- dvc 
-- protocol 
-- protocol_version 
-- src 
-- src_ip 
-- src_port 
-- transport 
-- user 
+- action
+- app
+- dest
+- dest_ip
+- dest_port
+- direction
+- dvc
+- protocol
+- protocol_version
+- src
+- src_ip
+- src_port
+- transport
+- user
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>3</EventID><Version>5</Version><Level>4</Level><Task>3</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml
index ec70d4b650..00394ae64f 100644
--- a/data_sources/sysmon_eventid_5.yml
+++ b/data_sources/sysmon_eventid_5.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -87,15 +87,15 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- dest 
-- process 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
+- dest
+- process
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
 - user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml
index 02c905fe0d..c2a19f0179 100644
--- a/data_sources/sysmon_eventid_6.yml
+++ b/data_sources/sysmon_eventid_6.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -89,13 +89,13 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- dest 
-- dvc 
-- process_hash 
-- process_path 
-- signature 
-- signature_id 
-- user_id 
+- dest
+- dvc
+- process_hash
+- process_path
+- signature
+- signature_id
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>6</EventID><Version>4</Version><Level>4</Level><Task>6</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml
index c84c3642c4..8dca2d914b 100644
--- a/data_sources/sysmon_eventid_7.yml
+++ b/data_sources/sysmon_eventid_7.yml
@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -109,22 +109,22 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- Image 
-- ImageLoaded 
-- dest 
-- loaded_file 
-- loaded_file_path 
-- process_exec 
-- process_guid 
-- process_hash 
-- process_id 
-- process_name 
-- process_path 
-- service_dll_signature_exists 
-- service_dll_signature_verified 
-- signature 
-- signature_id 
-- user_id 
+- Image
+- ImageLoaded
+- dest
+- loaded_file
+- loaded_file_path
+- process_exec
+- process_guid
+- process_hash
+- process_id
+- process_name
+- process_path
+- service_dll_signature_exists
+- service_dll_signature_verified
+- signature
+- signature_id
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>7</EventID><Version>3</Version><Level>4</Level><Task>7</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml
index c6202e0818..310399c3bc 100644
--- a/data_sources/sysmon_eventid_8.yml
+++ b/data_sources/sysmon_eventid_8.yml
@@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -101,20 +101,20 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- dest 
-- parent_process_exec 
-- parent_process_guid 
-- parent_process_id 
-- parent_process_name 
-- parent_process_path 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
-- user_id 
+- dest
+- parent_process_exec
+- parent_process_guid
+- parent_process_id
+- parent_process_name
+- parent_process_path
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>8</EventID><Version>2</Version><Level>4</Level><Task>8</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml
index 2f2cee60e9..cb15723191 100644
--- a/data_sources/sysmon_eventid_9.yml
+++ b/data_sources/sysmon_eventid_9.yml
@@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config
 supported_TA:
 - name: Splunk Add-on for Sysmon
   url: https://splunkbase.splunk.com/app/5709
-  version: 4.0.2
+  version: 4.0.3
 fields:
 - _time
 - Channel
@@ -88,16 +88,16 @@ fields:
 - user_id
 - vendor_product
 output_fields:
-- dest 
-- dvc 
-- process_exec 
-- process_guid 
-- process_id 
-- process_name 
-- process_path 
-- signature 
-- signature_id 
-- user_id 
+- dest
+- dvc
+- process_exec
+- process_guid
+- process_id
+- process_name
+- process_path
+- signature
+- signature_id
+- user_id
 - vendor_product
 example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
   Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>9</EventID><Version>2</Version><Level>4</Level><Task>9</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated