security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2774 from frack113/splunk_win

Browse Source 
Add missing WinEventLog prefix
This commit is contained in:
Florian Roth
2022-03-05 12:33:22 +01:00
committed by GitHub
parent a6ed1a3fb8 87a0bed0ec
commit f79dcd9e11
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/config/splunk-windows.yml
+3 -3
View File
@@ -111,7 +111,7 @@ logsources:
product: windows
service: codeintegrity-operational
conditions:
source: 'Microsoft-Windows-CodeIntegrity/Operational'
source: 'WinEventLog:Microsoft-Windows-CodeIntegrity/Operational'
windows-smbclient-security:
product: windows
service: smbclient-security
@@ -126,11 +126,11 @@ logsources:
product: windows
service: firewall-as
conditions:
source: 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'
source: 'WinEventLog:Microsoft-Windows-Windows Firewall With Advanced Security/Firewall'
windows-bits-client:
product: windows
service: bits-client
conditions:
source: 'Microsoft-Windows-Bits-Client/Operational'
source: 'WinEventLog:Microsoft-Windows-Bits-Client/Operational'
fieldmappings:
EventID: EventCode