mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
16 lines
569 B
YAML
16 lines
569 B
YAML
name: Sysmon for Linux EventID
|
|
id: da9fc0c9-4b15-4537-aa91-19ca0cb1eba5
|
|
author: Patrick Bareiss, Splunk
|
|
source: Syslog:Linux-Sysmon/Operational
|
|
sourcetype: sysmon:linux
|
|
separator: EventID
|
|
supported_TA:
|
|
name: Splunk Add-on for Sysmon for Linux
|
|
version: 1.0.0
|
|
url: https://splunkbase.splunk.com/app/6652
|
|
event_names:
|
|
- event_name: Sysmon for Linux EventID 1
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_for_Linux_EventID_1.yml
|
|
- event_name: Sysmon for Linux EventID 11
|
|
data_source: data_sources/endpoint/event_sources/Sysmon_for_Linux_EventID_11.yml
|