14 Commits

Author	SHA1	Message	Date
Thomas Patzke	939156fa6d	Introduced dns_query log source category	2020-07-05 23:29:51 +02:00
Brad Kish	8b3b312c4e	Proposed fix for https://github.com/Neo23x0/sigma/issues/889 ... This change removes dns events from the network connection category. The one change is that sysmon_regsvr32_network_activity.yml needs to test the network connection category separately from the DNS event id.	2020-07-03 16:28:19 -04:00
Florian Roth	9c0f9f398f	refactor: sysmon rule cleanup > generlization	2020-07-01 10:58:39 +02:00
Florian Roth	07c0a6558e	fix: wording on sysmon mapping file	2020-06-24 17:49:42 +02:00
Florian Roth	f3fedef8f5	Changed category names and remove sysmon log source	2020-06-24 17:41:21 +02:00
Steven Goossens	423baafa2a	Added rules for different sysmon categories and added the category definition	2020-06-10 15:02:15 +02:00
Florian Roth	a0beda240c	fix: fixed wrong field mapping in windows-audit source config	2019-11-09 22:42:00 +01:00
Thomas Patzke	36aeb19721	Added title to all configurations	2019-05-16 23:33:51 +02:00
Thomas Patzke	6918784e87	Configuration order checking	2019-04-23 00:54:10 +02:00
Thomas Patzke	3eaf83cf5a	Improved configurations ... Added Security/4688 field mappings	2019-01-16 23:37:18 +01:00
Thomas Patzke	ba64f485ac	Added generic Windows audit log configuration	2019-01-16 22:41:42 +01:00
Thomas Patzke	d81946df39	Stacked configurations ... - Added log source rewriting - Removed log source merging condition type setting - Simplified SigmaLogsourceConfiguration constructor - Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration Missing: - Merging of raw config dict for backends that rely on this (es-dsl)	2018-09-12 23:40:22 +02:00
Thomas Patzke	320bb9f8c4	Added rewrite config to generic sysmon configuration	2018-08-14 21:34:54 +02:00
Thomas Patzke	430972231f	Added generic sysmon configuration with process_execution config	2018-08-14 21:34:54 +02:00