mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
51 lines
2.3 KiB
YAML
51 lines
2.3 KiB
YAML
name: Sysmon EventID
|
|
id: 848aec1b-90aa-48a9-ae52-31d3a2e79697
|
|
author: Patrick Bareiss, Splunk
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|
|
separator: EventID
|
|
configuration: https://github.com/SwiftOnSecurity/sysmon-config
|
|
supported_TA:
|
|
name: Splunk Add-on for Sysmon
|
|
version: 4.0.0
|
|
url: https://splunkbase.splunk.com/app/5709/
|
|
event_names:
|
|
- event_name: Sysmon EventID 1
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_1.yml
|
|
- event_name: Sysmon EventID 10
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_10.yml
|
|
- event_name: Sysmon EventID 11
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_11.yml
|
|
- event_name: Sysmon EventID 12
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_12.yml
|
|
- event_name: Sysmon EventID 13
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_13.yml
|
|
- event_name: Sysmon EventID 14
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_14.yml
|
|
- event_name: Sysmon EventID 15
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_15.yml
|
|
- event_name: Sysmon EventID 17
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_17.yml
|
|
- event_name: Sysmon EventID 18
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_18.yml
|
|
- event_name: Sysmon EventID 20
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_20.yml
|
|
- event_name: Sysmon EventID 21
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_21.yml
|
|
- event_name: Sysmon EventID 22
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_22.yml
|
|
- event_name: Sysmon EventID 23
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_23.yml
|
|
- event_name: Sysmon EventID 3
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_3.yml
|
|
- event_name: Sysmon EventID 5
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_5.yml
|
|
- event_name: Sysmon EventID 6
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_6.yml
|
|
- event_name: Sysmon EventID 7
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_7.yml
|
|
- event_name: Sysmon EventID 8
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_8.yml
|
|
- event_name: Sysmon EventID 9
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_EventID_9.yml
|