2019-05-16 23:33:51 +02:00
|
|
|
title: Splunk Windows log source conditions
|
2019-04-23 00:54:10 +02:00
|
|
|
order: 20
|
2019-05-20 01:00:33 +02:00
|
|
|
backends:
|
|
|
|
|
- splunk
|
|
|
|
|
- splunkxml
|
2017-03-17 10:00:56 +01:00
|
|
|
logsources:
|
|
|
|
|
windows-application:
|
|
|
|
|
product: windows
|
|
|
|
|
service: application
|
|
|
|
|
conditions:
|
2017-05-26 22:40:06 +02:00
|
|
|
source: 'WinEventLog:Application'
|
2017-03-17 10:00:56 +01:00
|
|
|
windows-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: security
|
|
|
|
|
conditions:
|
2017-05-26 22:40:06 +02:00
|
|
|
source: 'WinEventLog:Security'
|
2017-11-09 08:41:07 +01:00
|
|
|
windows-system:
|
2017-03-17 10:00:56 +01:00
|
|
|
product: windows
|
|
|
|
|
service: system
|
|
|
|
|
conditions:
|
2017-05-26 22:40:06 +02:00
|
|
|
source: 'WinEventLog:System'
|
2017-03-17 10:00:56 +01:00
|
|
|
windows-sysmon:
|
|
|
|
|
product: windows
|
|
|
|
|
service: sysmon
|
|
|
|
|
conditions:
|
2017-05-26 22:40:06 +02:00
|
|
|
source: 'WinEventLog:Microsoft-Windows-Sysmon/Operational'
|
2017-03-17 10:00:56 +01:00
|
|
|
windows-powershell:
|
|
|
|
|
product: windows
|
|
|
|
|
service: powershell
|
|
|
|
|
conditions:
|
2017-05-26 22:40:06 +02:00
|
|
|
source: 'WinEventLog:Microsoft-Windows-PowerShell/Operational'
|
2017-03-22 11:17:34 +01:00
|
|
|
windows-classicpowershell:
|
|
|
|
|
product: windows
|
|
|
|
|
service: powershell-classic
|
|
|
|
|
conditions:
|
2017-08-22 10:04:56 +02:00
|
|
|
source: 'Windows PowerShell'
|
2017-11-09 08:41:07 +01:00
|
|
|
windows-taskscheduler:
|
2017-03-17 10:00:56 +01:00
|
|
|
product: windows
|
|
|
|
|
service: taskscheduler
|
|
|
|
|
conditions:
|
2017-05-26 22:40:06 +02:00
|
|
|
source: 'WinEventLog:Microsoft-Windows-TaskScheduler/Operational'
|
2017-08-22 10:04:56 +02:00
|
|
|
windows-wmi:
|
|
|
|
|
product: windows
|
|
|
|
|
service: wmi
|
|
|
|
|
conditions:
|
|
|
|
|
source: 'WinEventLog:Microsoft-Windows-WMI-Activity/Operational'
|
2017-05-08 13:09:17 +02:00
|
|
|
windows-dns-server:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dns-server
|
2018-05-22 16:58:13 +02:00
|
|
|
category: dns
|
2017-05-08 13:09:17 +02:00
|
|
|
conditions:
|
2017-05-26 22:40:06 +02:00
|
|
|
source: 'DNS Server'
|
2018-05-22 16:58:13 +02:00
|
|
|
windows-dns-server-audit:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dns-server-audit
|
|
|
|
|
conditions:
|
|
|
|
|
source: 'Microsoft-Windows-DNS-Server/Audit'
|
2017-11-09 08:42:58 +01:00
|
|
|
windows-driver-framework:
|
|
|
|
|
product: windows
|
|
|
|
|
service: driver-framework
|
|
|
|
|
conditions:
|
|
|
|
|
source: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
2018-06-08 11:45:31 +02:00
|
|
|
windows-ntlm:
|
|
|
|
|
product: windows
|
|
|
|
|
service: ntlm
|
|
|
|
|
conditions:
|
|
|
|
|
source: 'Microsoft-Windows-NTLM/Operational'
|
2019-02-05 14:35:16 +01:00
|
|
|
windows-dhcp:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dhcp
|
2019-12-07 00:23:30 +01:00
|
|
|
conditions:
|
2019-02-05 14:35:16 +01:00
|
|
|
source: 'Microsoft-Windows-DHCP-Server/Operational'
|
2017-03-18 00:03:21 +01:00
|
|
|
fieldmappings:
|
2019-12-07 00:23:30 +01:00
|
|
|
EventID: EventCode
|
