feat: OriginalFileName mapping in MDATP ImageLoad events

2021-07-07 18:22:58 +02:00
parent 25dec8a17b
commit cdc434cfc4
1 changed files with 1 additions and 0 deletions
@@ -160,6 +160,7 @@ class WindowsDefenderATPBackend(SingleTextQueryBackend):
                "DeviceName": (self.id_mapping, self.default_value_mapping),
                "EventType": ("ActionType", self.default_value_mapping),
                "FileName": (self.id_mapping, self.default_value_mapping),
+                "OriginalFileName": ("OriginalFileName", self.default_value_mapping),
                "Image": ("InitiatingProcessFolderPath", self.default_value_mapping),
                "ImageLoaded": ("FolderPath", self.default_value_mapping),
                "ParentCommandLine": ("InitiatingProcessCommandLine", self.default_value_mapping),