name: Sysmon for Linux EventID 11
id: 14672fed-235a-411f-8062-ace9696fb2af
version: 1
date: '2024-07-18'
author: Patrick Bareiss, Splunk
description: Data source object for Sysmon for Linux EventID 11
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon:linux
separator: EventID
supported_TA:
- name: Splunk Add-on for Sysmon for Linux
  url: https://splunkbase.splunk.com/app/6652
  version: 1.0.0
fields:
- _time
- Channel
- Computer
- CreationUtcTime
- EventChannel
- EventCode
- EventData_Xml
- EventDescription
- EventID
- EventRecordID
- Guid
- Image
- Keywords
- Level
- Name
- Opcode
- ProcessGuid
- ProcessID
- ProcessId
- RecordID
- RuleName
- SystemTime
- System_Props_Xml
- TargetFilename
- Task
- ThreadID
- User
- UserId
- UtcTime
- Version
- action
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- eventtype
- file_create_time
- file_name
- file_path
- host
- index
- linecount
- object_category
- process_exec
- process_guid
- process_id
- process_name
- process_path
- punct
- signature
- signature_id
- source
- sourcetype
- splunk_server
- tag
- tag::eventtype
- tag::object_category
- timeendpos
- timestartpos
- user
- vendor_product
example_log: <Event><System><Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/><EventID>11</EventID><Version>2</Version><Level>4</Level><Task>11</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated
  SystemTime="2021-12-20T16:07:17.927963000Z"/><EventRecordID>792913</EventRecordID><Correlation/><Execution
  ProcessID="4372" ThreadID="4372"/><Channel>Linux-Sysmon/Operational</Channel><Computer>sysmonlinux-tcontreras-attack-range-4134</Computer><Security
  UserId="0"/></System><EventData><Data Name="RuleName">-</Data><Data Name="UtcTime">2021-12-20
  16:07:17.929</Data><Data Name="ProcessGuid">{ec2c97d1-6aa9-61c0-3038-618238560000}</Data><Data
  Name="ProcessId">5256</Data><Data Name="Image">/opt/splunkforwarder/bin/splunkd</Data><Data
  Name="TargetFilename">/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbed9d351dcc1806</Data><Data
  Name="CreationUtcTime">2021-12-20 16:07:17.929</Data><Data Name="User">root</Data></EventData></Event>