feat: new log channel windows-codeintegrity-operational

https://twitter.com/SBousseaden/status/1483810148602814466
2022-01-20 09:44:36 +01:00
parent 49502f3796
commit 68f0cdf338
14 changed files with 70 additions and 0 deletions
@@ -57,6 +57,11 @@ logsources:
    service: printservice-operational
    conditions:
      EventLog: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      EventLog: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -57,6 +57,11 @@ logsources:
    service: printservice-operational
    conditions:
      log_name: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      log_name: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -57,6 +57,11 @@ logsources:
    service: printservice-operational
    conditions:
      log_name: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      log_name: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -81,6 +81,11 @@ logsources:
        service: printservice-operational
        conditions:
            channel: 'Microsoft-Windows-PrintService/Operational'
+    windows-codeintegrity-operational:
+        product: windows
+        service: codeintegrity-operational
+        conditions:
+            channel: 'Microsoft-Windows-CodeIntegrity/Operational'
    windows-smbclient-security:
        product: windows
        index: windows
@@ -356,6 +356,11 @@ logsources:
   service: printservice-operational
   conditions:
     product_name: 'PrintService'
+ windows-codeintegrity-operational:
+   product: windows
+   service: codeintegrity-operational
+   conditions:
+     product_name: 'CodeIntegrity'
 windows-smbclient-security:
   product: windows
   service: smbclient-security
@@ -57,6 +57,11 @@ logsources:
    service: printservice-operational
    conditions:
      event_source: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      event_source: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -78,6 +78,11 @@ logsources:
    service: printservice-operational
    conditions:
      Channel: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      Channel: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -98,6 +98,11 @@ logsources:
    service: printservice-operational
    conditions:
      LogName: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      LogName: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -107,6 +107,11 @@ logsources:
    service: printservice-operational
    conditions:
      source: 'WinEventLog:Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      source: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -81,6 +81,11 @@ logsources:
    service: printservice-operational
    conditions:
      EventChannel: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      EventChannel: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -315,6 +315,11 @@ logsources:
    service: printservice-operational
    sources:
      - "WinEventLog:Microsoft-Windows-PrintService/Operational"
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    sources:
+      - "WinEventLog:Microsoft-Windows-CodeIntegrity/Operational"
  windows-applocker:
    product: windows
    service: applocker
@@ -81,6 +81,11 @@ logsources:
    service: printservice-operational
    conditions:
      winlog.channel: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      winlog.channel: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -80,6 +80,11 @@ logsources:
    service: printservice-operational
    conditions:
      winlog.channel: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      winlog.channel: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security
@@ -68,6 +68,11 @@ logsources:
    service: printservice-operational
    conditions:
      Channel: 'Microsoft-Windows-PrintService/Operational'
+  windows-codeintegrity-operational:
+    product: windows
+    service: codeintegrity-operational
+    conditions:
+      Channel: 'Microsoft-Windows-CodeIntegrity/Operational'
  windows-smbclient-security:
    product: windows
    service: smbclient-security