mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
32 lines
1.6 KiB
YAML
32 lines
1.6 KiB
YAML
name: Windows Event Log Defender
|
|
id: 4bae37e2-b347-4d76-b05d-f97066a8aa88
|
|
author: Patrick Bareiss, Splunk
|
|
source: WinEventLog:Microsoft-Windows-Windows Defender/Operational
|
|
sourcetype: xmlwineventlog
|
|
separator: EventCode
|
|
supported_TA:
|
|
name: Splunk Add-on for Microsoft Windows
|
|
version: 8.8.0
|
|
url: https://splunkbase.splunk.com/app/742
|
|
event_names:
|
|
- event_name: Windows Event Log Defender 1121
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1121.yml
|
|
- event_name: Windows Event Log Defender 1122
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1122.yml
|
|
- event_name: Windows Event Log Defender 1125
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1125.yml
|
|
- event_name: Windows Event Log Defender 1126
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1126.yml
|
|
- event_name: Windows Event Log Defender 1129
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1129.yml
|
|
- event_name: Windows Event Log Defender 1131
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1131.yml
|
|
- event_name: Windows Event Log Defender 1132
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1132.yml
|
|
- event_name: Windows Event Log Defender 1133
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1133.yml
|
|
- event_name: Windows Event Log Defender 1134
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_1134.yml
|
|
- event_name: Windows Event Log Defender 5007
|
|
data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Defender_5007.yml
|