mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
40 lines
1.0 KiB
YAML
40 lines
1.0 KiB
YAML
name: Crowdstrike Process
|
|
id: 82e05359-6158-4e2a-abb7-4c9e99771379
|
|
date: '2022-10-10'
|
|
author: Patrick Bareiss, Splunk
|
|
type: crowdstrike
|
|
source: crowdstrike
|
|
sourcetype: crowdstrike:events:sensor
|
|
category: process_creation
|
|
product: windows
|
|
supported_TA:
|
|
- name: Splunk Add-on for CrowdStrike FDR
|
|
version: 1.2.0
|
|
url: https://splunkbase.splunk.com/app/5579
|
|
references: []
|
|
supported_targets:
|
|
- Endpoint.Processes
|
|
raw_fields:
|
|
- CommandLine
|
|
- GrandParentBaseFileName
|
|
- ImageFileName
|
|
- MD5HashData
|
|
- ParentBaseFileName
|
|
- ParentProcessId
|
|
- RawProcessId
|
|
- SHA1HashData
|
|
- SHA256HashData
|
|
- SourceProcessId
|
|
- TargetProcessId
|
|
- UserSid
|
|
field_mappings:
|
|
- data_model: cim
|
|
data_set: Endpoint.Processes
|
|
mapping:
|
|
CommandLine: Processes.process
|
|
ImageFileName: Processes.process_path
|
|
ParentBaseFileName: Processes.parent_process_name
|
|
ParentProcessId: Processes.parent_process_id
|
|
RawProcessId: Processes.process_id
|
|
SHA256HashData: Processes.process_hash
|
|
UserSid: Processes.user |