9c0f9f398f
refactor: sysmon rule cleanup > generlization
2020-07-01 10:58:39 +02:00
07c0a6558e
fix: wording on sysmon mapping file
2020-06-24 17:49:42 +02:00
f3fedef8f5
Changed category names and remove sysmon log source
2020-06-24 17:41:21 +02:00
423baafa2a
Added rules for different sysmon categories and added the category definition
2020-06-10 15:02:15 +02:00
a0beda240c
fix: fixed wrong field mapping in windows-audit source config
2019-11-09 22:42:00 +01:00
36aeb19721
Added title to all configurations
2019-05-16 23:33:51 +02:00
6918784e87
Configuration order checking
2019-04-23 00:54:10 +02:00
3eaf83cf5a
Improved configurations
...
Added Security/4688 field mappings
2019-01-16 23:37:18 +01:00
ba64f485ac
Added generic Windows audit log configuration
2019-01-16 22:41:42 +01:00
d81946df39
Stacked configurations
...
- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration
Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)
2018-09-12 23:40:22 +02:00
320bb9f8c4
Added rewrite config to generic sysmon configuration
2018-08-14 21:34:54 +02:00
430972231f
Added generic sysmon configuration with process_execution config
2018-08-14 21:34:54 +02:00
Florian Roth