Support macOS file_event.

2023-01-26 15:51:24 -08:00
parent ff7794225b
commit aa341ab38f
1 changed files with 18 additions and 0 deletions
@@ -250,6 +250,24 @@ _allFieldMappings = {
            postOpMapper = _mapProcessCreationOperations,
            isCaseSensitive = ['event/FILE_PATH']
        ),
+        "macos/file_event/": SigmaLCConfig(
+            topLevelParams = {
+                "events": [
+                    "FILE_CREATE",
+                    "NEW_DOCUMENT",
+                ]
+            },
+            preConditions = {
+                "op": "is mac",
+            },
+            fieldMappings = {
+                "TargetFilename": "event/FILE_PATH",
+            },
+            isAllStringValues = False,
+            keywordField = None,
+            postOpMapper = None,
+            isCaseSensitive = ['event/FILE_PATH']
+        ),
    },
    "artifact": {
        "windows//": SigmaLCConfig(