2019-05-16 23:33:51 +02:00
|
|
|
title: Logpoint
|
2019-04-23 00:54:10 +02:00
|
|
|
order: 20
|
2019-05-20 01:00:33 +02:00
|
|
|
backends:
|
|
|
|
|
- logpoint
|
2017-03-20 16:57:19 +01:00
|
|
|
logsources:
|
|
|
|
|
windows-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: security
|
|
|
|
|
conditions:
|
|
|
|
|
event_source: 'Microsoft-Windows-Security-Auditing'
|
2017-11-09 08:42:58 +01:00
|
|
|
windows-system:
|
2017-03-20 16:57:19 +01:00
|
|
|
product: windows
|
|
|
|
|
service: system
|
|
|
|
|
conditions:
|
|
|
|
|
event_source: 'Microsoft-Windows-Security-Auditing'
|
2017-05-08 13:09:17 +02:00
|
|
|
windows-dns-server:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dns-server
|
|
|
|
|
conditions:
|
|
|
|
|
event_source: 'DNS Server'
|
2017-11-09 08:42:58 +01:00
|
|
|
windows-driver-framework:
|
|
|
|
|
product: windows
|
|
|
|
|
service: driver-framework
|
|
|
|
|
conditions:
|
|
|
|
|
source: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
2019-02-05 14:35:16 +01:00
|
|
|
windows-dhcp:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dhcp
|
|
|
|
|
conditions:
|
|
|
|
|
source: 'Microsoft-Windows-DHCP-Server/Operational'
|
|
|
|
|
|
2017-03-20 16:57:19 +01:00
|
|
|
fieldmappings:
|
|
|
|
|
EventID: event_id
|
|
|
|
|
FailureCode: result_code
|
|
|
|
|
GroupName: group_name
|
2019-09-11 04:53:30 -04:00
|
|
|
GroupSid: group_sid
|
2017-03-30 10:49:36 +02:00
|
|
|
KeyLength: key_length
|
2018-03-26 22:53:38 +02:00
|
|
|
LogonProcessName: logon_process
|
2017-03-30 10:49:36 +02:00
|
|
|
LogonType: logon_type
|
2017-03-20 16:57:19 +01:00
|
|
|
ServiceName: service
|
2017-03-24 00:58:11 +01:00
|
|
|
SubjectAccountName:
|
2017-03-30 09:51:32 +02:00
|
|
|
EventID=4611:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4624:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4625:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4634:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4648:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4662:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4672:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4688:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4719:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4720:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4722:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4723:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4724:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4728:
|
|
|
|
|
- user
|
|
|
|
|
- member
|
|
|
|
|
EventID=4729:
|
|
|
|
|
- user
|
|
|
|
|
- member
|
|
|
|
|
EventID=4731:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4732:
|
|
|
|
|
- user
|
|
|
|
|
- member
|
|
|
|
|
EventID=4735:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4737:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4738:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4740:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4742:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4755:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4756:
|
|
|
|
|
- user
|
|
|
|
|
- member
|
|
|
|
|
EventID=4757:
|
|
|
|
|
- user
|
|
|
|
|
- member
|
|
|
|
|
EventID=4767:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4768:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4769:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4770:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4771:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4774:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4776:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4781:
|
|
|
|
|
- target_user
|
|
|
|
|
- caller_user
|
|
|
|
|
EventID=4904:
|
|
|
|
|
- user
|
|
|
|
|
EventID=4905:
|
|
|
|
|
- user
|
|
|
|
|
EventID=5061:
|
|
|
|
|
- user
|
|
|
|
|
EventID=5136:
|
|
|
|
|
- user
|
|
|
|
|
EventID=5137:
|
|
|
|
|
- user
|
2017-03-25 00:27:29 +01:00
|
|
|
default:
|
|
|
|
|
- caller_user
|
|
|
|
|
- target_user
|
|
|
|
|
- user
|
|
|
|
|
- member
|
2017-03-20 16:57:19 +01:00
|
|
|
TicketOptions: ticket_options
|
|
|
|
|
TicketEnctyption: ticket_encryption
|
|
|
|
|
Type: event_type
|
2017-03-30 10:49:36 +02:00
|
|
|
UserName:
|
|
|
|
|
default:
|
|
|
|
|
- caller_user
|
|
|
|
|
- target_user
|
|
|
|
|
- user
|
|
|
|
|
- member
|
|
|
|
|
SourceWorkstation: workstation
|
