 Chris Brake
|
6ed1ea6509
|
Updating the mdatp backend file as it is currently impossible to set an ActionType as there is no mapping to EventType
|
2020-06-30 14:49:29 +01:00 |
|
|
Thomas Patzke
|
c992dc5215
|
Improved test coverage
|
2020-06-05 23:33:51 +02:00 |
|
|
Thomas Patzke
|
5d88d97c73
|
Merge branch 'improvements/improved_mdatp_mappings' of https://github.com/wietze/sigma into wietze-improvements/improved_mdatp_mappings
|
2020-06-05 23:03:52 +02:00 |
|
|
vh
|
fb9c5841f4
|
Added Humio, Crowdstrike, Corelight
|
2020-05-08 13:41:52 +03:00 |
|
|
Wietze
|
2b3828730c
|
Reversed disabling FileDelete
|
2020-05-02 17:31:50 +01:00 |
|
|
Wietze
|
e5574e07f2
|
Disabled FileDelete event (Sysmon 11 - no rules available yet)
|
2020-05-02 16:21:56 +01:00 |
|
|
Wietze
|
5abf4cbea9
|
Reordered fields
|
2020-05-02 14:46:55 +01:00 |
|
|
Wietze
|
661108903b
|
Minor consistency fix
|
2020-05-02 14:37:37 +01:00 |
|
|
Wietze
|
46737cbfd3
|
Improved Microsoft ATP mapping, using Advanced Hunting Schema
See https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference
|
2020-05-02 14:31:02 +01:00 |
|
|
David Szili
|
0947538228
|
MDATP schema changes
WDATP was renamed to MDATP (Microsoft Defendre ATP).
MDATP also had schema changes recently: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/advanced-hunting-data-schema-changes/ba-p/1043914
The updates reflect these changes
|
2020-03-09 17:12:41 +01:00 |
|