8 Commits

Author	SHA1	Message	Date
Thomas Patzke	0592cbb67a	Added UUIDs to rules	2019-11-12 23:12:27 +01:00
Sarkis Nanyan	60bc5253cf	win_disable_event_logging.yml: typo in audit policy name;	2019-05-29 15:43:44 +03:00
Roberto Rodriguez	a35f945c71	Update win_disable_event_logging.yml ... Description value breaking SIGMA Elastalert Backend	2018-12-06 05:09:41 +03:00
Sherif Eldeeb	23eddafb39	Replace "logsource: description" with "definition" to match the specs	2018-11-15 09:00:06 +03:00
David Spautz	e275d44462	Add tags to windows builtin rules	2018-07-24 07:50:32 +02:00
Thomas Patzke	a3e02ea70f	Various rule fixes ... * Field name: LogonProcess -> LogonProcessName * Field name: Message -> AuditPolicyChanges * Field name: ProcessCommandLine -> CommandLine * Removed Type match in Kerberos RC4 encryption rule Problematic because text representation not unified and audit failures are possibly interesting events * Removed field 'Severity' from rules (Redundant) * Rule decomposition of win_susp_failed_logons_single_source) because of different field names * Field name: SubjectAccountName -> SubjectUserName * Field name: TargetProcess -> TargetImage * Field name: TicketEncryption -> TicketEncryptionType * Field name: TargetFileName -> TargetFilename	2018-03-27 14:35:49 +02:00
SherifEldeeb	112a0939d7	Change "reference" to "references" to match new schema	2018-01-28 02:12:19 +03:00
Thomas Patzke	2ec5919b9e	Fixed win_disable_event_logging by multiline description	2017-11-19 22:49:40 +01:00