mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
88 lines
5.2 KiB
YAML
88 lines
5.2 KiB
YAML
name: Windows Event Log Security
|
|
id: e3e44de1-57b1-462d-b57c-c7657af7ae6e
|
|
author: Patrick Bareiss, Splunk
|
|
source: XmlWinEventLog:Security
|
|
sourcetype: xmlwineventlog
|
|
separator: EventCode
|
|
supported_TA:
|
|
name: Splunk Add-on for Microsoft Windows
|
|
version: 8.8.0
|
|
url: https://splunkbase.splunk.com/app/742
|
|
event_names:
|
|
- event_name: Windows Event Log Security 1100
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_1100.yml
|
|
- event_name: Windows Event Log Security 1102
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_1102.yml
|
|
- event_name: Windows Event Log Security 4624
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4624.yml
|
|
- event_name: Windows Event Log Security 4625
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4625.yml
|
|
- event_name: Windows Event Log Security 4627
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4627.yml
|
|
- event_name: Windows Event Log Security 4648
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4648.yml
|
|
- event_name: Windows Event Log Security 4662
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4662.yml
|
|
- event_name: Windows Event Log Security 4663
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4663.yml
|
|
- event_name: Windows Event Log Security 4672
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4672.yml
|
|
- event_name: Windows Event Log Security 4688
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4688.yml
|
|
- event_name: Windows Event Log Security 4698
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4698.yml
|
|
- event_name: Windows Event Log Security 4699
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4699.yml
|
|
- event_name: Windows Event Log Security 4703
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4703.yml
|
|
- event_name: Windows Event Log Security 4719
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4719.yml
|
|
- event_name: Windows Event Log Security 4720
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4720.yml
|
|
- event_name: Windows Event Log Security 4724
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4724.yml
|
|
- event_name: Windows Event Log Security 4725
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4725.yml
|
|
- event_name: Windows Event Log Security 4726
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4726.yml
|
|
- event_name: Windows Event Log Security 4732
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4732.yml
|
|
- event_name: Windows Event Log Security 4738
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4738.yml
|
|
- event_name: Windows Event Log Security 4739
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4739.yml
|
|
- event_name: Windows Event Log Security 4741
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4741.yml
|
|
- event_name: Windows Event Log Security 4742
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4742.yml
|
|
- event_name: Windows Event Log Security 4768
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4768.yml
|
|
- event_name: Windows Event Log Security 4769
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4769.yml
|
|
- event_name: Windows Event Log Security 4771
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4771.yml
|
|
- event_name: Windows Event Log Security 4776
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4776.yml
|
|
- event_name: Windows Event Log Security 4781
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4781.yml
|
|
- event_name: Windows Event Log Security 4794
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4794.yml
|
|
- event_name: Windows Event Log Security 4798
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4798.yml
|
|
- event_name: Windows Event Log Security 4876
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4876.yml
|
|
- event_name: Windows Event Log Security 4886
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4886.yml
|
|
- event_name: Windows Event Log Security 4887
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_4887.yml
|
|
- event_name: Windows Event Log Security 5136
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_5136.yml
|
|
- event_name: Windows Event Log Security 5137
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_5137.yml
|
|
- event_name: Windows Event Log Security 5140
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_5140.yml
|
|
- event_name: Windows Event Log Security 5141
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_5141.yml
|
|
- event_name: Windows Event Log Security 5145
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Security_5145.yml
|