Added eventlog source DNS Server to configs

2017-05-08 13:09:17 +02:00
parent c7cc2a00d3
commit f66085b198
3 changed files with 16 additions and 1 deletions
@@ -17,3 +17,8 @@ logsources:
    service: sysmon
    conditions:
      EventLog: Microsoft-Windows-Sysmon
+  windows-dns-server:
+    product: windows
+    service: dns-server
+    conditions:
+      EventLog: 'DNS Server'
@@ -9,6 +9,11 @@ logsources:
    service: system
    conditions:
      event_source: 'Microsoft-Windows-Security-Auditing'
+  windows-dns-server:
+    product: windows
+    service: dns-server
+    conditions:
+      event_source: 'DNS Server'
 fieldmappings:
    EventID: event_id
    FailureCode: result_code
@@ -28,11 +28,16 @@ logsources:
    product: windows
    service: powershell-classic
    conditions:
-      source: 'Windows PowerShell'      
+      source: 'Windows PowerShell'    
  windows-powershell:
    product: windows
    service: taskscheduler
    conditions:
      source: 'WinEventLog:Microsoft-Windows-TaskScheduler/Operational'
+  windows-dns-server:
+    product: windows
+    service: dns-server
+    conditions:
+      source: 'DNS Server'
 fieldmappings:
    EventID: EventCode