2019-05-16 23:33:51 +02:00
|
|
|
title: Logsource to LogName mappings for PowerShell backend
|
2019-04-23 00:54:10 +02:00
|
|
|
order: 20
|
2019-05-20 01:00:33 +02:00
|
|
|
backends:
|
|
|
|
|
- powershell
|
2018-09-23 20:34:55 +02:00
|
|
|
logsources:
|
|
|
|
|
windows-application:
|
|
|
|
|
product: windows
|
|
|
|
|
service: application
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Application'
|
|
|
|
|
windows-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: security
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Security'
|
|
|
|
|
windows-system:
|
|
|
|
|
product: windows
|
|
|
|
|
service: system
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'System'
|
|
|
|
|
windows-sysmon:
|
|
|
|
|
product: windows
|
|
|
|
|
service: sysmon
|
|
|
|
|
conditions:
|
2019-12-07 00:23:30 +01:00
|
|
|
LogName: 'Microsoft-Windows-Sysmon/Operational'
|
2018-09-23 20:34:55 +02:00
|
|
|
windows-powershell:
|
|
|
|
|
product: windows
|
|
|
|
|
service: powershell
|
|
|
|
|
conditions:
|
2019-12-07 00:23:30 +01:00
|
|
|
LogName: 'Microsoft-Windows-PowerShell/Operational'
|
2018-09-23 20:34:55 +02:00
|
|
|
windows-classicpowershell:
|
|
|
|
|
product: windows
|
|
|
|
|
service: powershell-classic
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Windows PowerShell'
|
|
|
|
|
windows-taskscheduler:
|
|
|
|
|
product: windows
|
|
|
|
|
service: taskscheduler
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-TaskScheduler/Operational'
|
|
|
|
|
windows-wmi:
|
|
|
|
|
product: windows
|
|
|
|
|
service: wmi
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-WMI-Activity/Operational'
|
|
|
|
|
windows-dns-server:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dns-server
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'DNS Server'
|
|
|
|
|
windows-dns-server-audit:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dns-server-audit
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-DNS-Server/Audit'
|
|
|
|
|
windows-driver-framework:
|
|
|
|
|
product: windows
|
|
|
|
|
service: driver-framework
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
|
|
|
|
windows-ntlm:
|
|
|
|
|
product: windows
|
|
|
|
|
service: ntlm
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-NTLM/Operational'
|
2019-02-05 14:35:16 +01:00
|
|
|
windows-dhcp:
|
|
|
|
|
product: windows
|
|
|
|
|
service: dhcp
|
2019-12-07 00:23:30 +01:00
|
|
|
conditions:
|
2019-02-05 14:35:16 +01:00
|
|
|
LogName: 'Microsoft-Windows-DHCP-Server/Operational'
|
2020-06-28 10:55:32 +02:00
|
|
|
windows-defender:
|
|
|
|
|
product: windows
|
|
|
|
|
service: windefend
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-Windows Defender/Operational'
|
2020-07-13 20:29:13 +00:00
|
|
|
windows-applocker:
|
|
|
|
|
product: windows
|
|
|
|
|
service: applocker
|
|
|
|
|
conditions:
|
|
|
|
|
LogName:
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/MSI and Script'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/EXE and DLL'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Deployment'
|
|
|
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Execution'
|
2021-03-20 08:49:59 +01:00
|
|
|
windows-msexchange-management:
|
|
|
|
|
product: windows
|
|
|
|
|
service: msexchange-management
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'MSExchange Management'
|
2021-06-30 14:22:40 +02:00
|
|
|
windows-printservice-admin:
|
2021-06-30 14:09:44 +02:00
|
|
|
product: windows
|
2021-06-30 14:22:40 +02:00
|
|
|
service: printservice-admin
|
2021-06-30 14:09:44 +02:00
|
|
|
conditions:
|
2021-06-30 14:22:40 +02:00
|
|
|
LogName: 'Microsoft-Windows-PrintService/Admin'
|
2021-07-01 09:55:15 +02:00
|
|
|
windows-printservice-operational:
|
|
|
|
|
product: windows
|
|
|
|
|
service: printservice-operational
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-PrintService/Operational'
|
2022-01-20 09:44:36 +01:00
|
|
|
windows-codeintegrity-operational:
|
|
|
|
|
product: windows
|
|
|
|
|
service: codeintegrity-operational
|
|
|
|
|
conditions:
|
|
|
|
|
LogName: 'Microsoft-Windows-CodeIntegrity/Operational'
|
2021-06-30 14:16:26 +02:00
|
|
|
windows-smbclient-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: smbclient-security
|
|
|
|
|
conditions:
|
2022-02-19 10:18:49 +01:00
|
|
|
LogName: 'Microsoft-Windows-SmbClient/Security'
|
|
|
|
|
windows-firewall-advanced-security:
|
|
|
|
|
product: windows
|
|
|
|
|
service: firewall-as
|
|
|
|
|
conditions:
|
2022-03-03 06:27:00 +01:00
|
|
|
log_name: 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'
|
|
|
|
|
windows-bits-client:
|
|
|
|
|
product: windows
|
|
|
|
|
service: bits-client
|
|
|
|
|
conditions:
|
|
|
|
|
log_name: 'Microsoft-Windows-Bits-Client/Operational'
|
