Nasreddine Bencherchali
272 lines
7.6 KiB
YAML
272 lines
7.6 KiB
YAML
title: FireEye Helix
|
|
order: 20
|
|
backends:
|
|
- fireeye-helix
|
|
logsources:
|
|
windows:
|
|
product: windows
|
|
index: windows
|
|
windows-application:
|
|
product: windows
|
|
index: windows
|
|
service: application
|
|
conditions:
|
|
channel: Application
|
|
windows-security:
|
|
product: windows
|
|
index: windows
|
|
service: security
|
|
conditions:
|
|
channel: Security
|
|
windows-sysmon:
|
|
product: windows
|
|
index: windows
|
|
service: sysmon
|
|
conditions:
|
|
channel: Microsoft-Windows-Sysmon
|
|
windows-dns-server:
|
|
product: windows
|
|
index: windows
|
|
service: dns-server
|
|
conditions:
|
|
channel: 'DNS Server'
|
|
windows-driver-framework:
|
|
product: windows
|
|
index: windows
|
|
service: driver-framework
|
|
conditions:
|
|
channel: 'Microsoft-Windows-DriverFrameworks-UserMode/Operational'
|
|
windows-dhcp:
|
|
product: windows
|
|
index: windows
|
|
service: dhcp
|
|
conditions:
|
|
channel: 'Microsoft-Windows-DHCP-Server/Operational'
|
|
windows-defender:
|
|
product: windows
|
|
index: windows
|
|
service: windefend
|
|
conditions:
|
|
channel: 'Microsoft-Windows-Windows Defender/Operational'
|
|
windows-ntlm:
|
|
product: windows
|
|
index: windows
|
|
service: ntlm
|
|
conditions:
|
|
channel: 'Microsoft-Windows-NTLM/Operational'
|
|
windows-applocker:
|
|
product: windows
|
|
index: windows
|
|
service: applocker
|
|
conditions:
|
|
channel:
|
|
- 'Microsoft-Windows-AppLocker/MSI and Script'
|
|
- 'Microsoft-Windows-AppLocker/EXE and DLL'
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Deployment'
|
|
- 'Microsoft-Windows-AppLocker/Packaged app-Execution'
|
|
windows-msexchange-management:
|
|
product: windows
|
|
index: windows
|
|
service: msexchange-management
|
|
conditions:
|
|
channel: 'MSExchange Management'
|
|
windows-printservice-admin:
|
|
product: windows
|
|
index: windows
|
|
service: printservice-admin
|
|
conditions:
|
|
channel: 'Microsoft-Windows-PrintService/Admin'
|
|
windows-printservice-operational:
|
|
product: windows
|
|
service: printservice-operational
|
|
conditions:
|
|
channel: 'Microsoft-Windows-PrintService/Operational'
|
|
windows-terminalservices-localsessionmanager-operational:
|
|
product: windows
|
|
service: terminalservices-localsessionmanager
|
|
conditions:
|
|
channel: 'Microsoft-Windows-TerminalServices-LocalSessionManager/Operational'
|
|
windows-codeintegrity-operational:
|
|
product: windows
|
|
service: codeintegrity-operational
|
|
conditions:
|
|
channel: 'Microsoft-Windows-CodeIntegrity/Operational'
|
|
windows-smbclient-security:
|
|
product: windows
|
|
index: windows
|
|
service: smbclient-security
|
|
conditions:
|
|
channel: 'Microsoft-Windows-SmbClient/Security'
|
|
windows-powershell:
|
|
product: windows
|
|
index: windows
|
|
service: powershell
|
|
conditions:
|
|
channel:
|
|
- 'Microsoft-Windows-Powershell'
|
|
- 'PowerShellCore'
|
|
windows-bits-client:
|
|
product: windows
|
|
service: bits-client
|
|
conditions:
|
|
channel: 'Microsoft-Windows-Bits-Client/Operational'
|
|
windows-security-mitigations:
|
|
product: windows
|
|
service: security-mitigations
|
|
conditions:
|
|
channel:
|
|
- 'Microsoft-Windows-Security-Mitigations/Kernel Mode'
|
|
- 'Microsoft-Windows-Security-Mitigations/User Mode'
|
|
windows-diagnosis:
|
|
product: windows
|
|
service: diagnosis-scripted
|
|
conditions:
|
|
channel: 'Microsoft-Windows-Diagnosis-Scripted/Operational'
|
|
windows-shell-core:
|
|
product: windows
|
|
service: shell-core
|
|
conditions:
|
|
channel: 'Microsoft-Windows-Shell-Core/Operational'
|
|
windows-openssh:
|
|
product: windows
|
|
service: openssh
|
|
conditions:
|
|
channel: 'OpenSSH/Operational'
|
|
windows-ldap-debug:
|
|
product: windows
|
|
service: ldap_debug
|
|
conditions:
|
|
channel: 'Microsoft-Windows-LDAP-Client/Debug'
|
|
windows-bitlocker:
|
|
product: windows
|
|
service: bitlocker
|
|
conditions:
|
|
channel: 'Microsoft-Windows-BitLocker/BitLocker Management'
|
|
windows-vhdmp-operational:
|
|
product: windows
|
|
service: vhdmp
|
|
conditions:
|
|
channel: 'Microsoft-Windows-VHDMP/Operational'
|
|
windows-appxdeployment-server:
|
|
product: windows
|
|
service: appxdeployment-server
|
|
conditions:
|
|
channel: 'Microsoft-Windows-AppXDeploymentServer/Operational'
|
|
windows-lsa-server:
|
|
product: windows
|
|
service: lsa-server
|
|
conditions:
|
|
channel: 'Microsoft-Windows-LSA/Operational'
|
|
windows-appxpackaging-om:
|
|
product: windows
|
|
service: appxpackaging-om
|
|
conditions:
|
|
channel: 'Microsoft-Windows-AppxPackaging/Operational'
|
|
windows-dns-client:
|
|
product: windows
|
|
service: dns-client
|
|
conditions:
|
|
channel: 'Microsoft-Windows-DNS Client Events/Operational'
|
|
windows-appmodel-runtime:
|
|
product: windows
|
|
service: appmodel-runtime
|
|
conditions:
|
|
channel: 'Microsoft-Windows-AppModel-Runtime/Admin'
|
|
linux:
|
|
product: linux
|
|
index: posix
|
|
unix:
|
|
product: unix
|
|
index: posix
|
|
dns:
|
|
category: dns
|
|
index: dns
|
|
firewall:
|
|
category: firewall
|
|
index: firewall
|
|
connection:
|
|
service: netflow
|
|
index: connection
|
|
proxy:
|
|
category: proxy
|
|
index: http_proxy
|
|
antivirus:
|
|
category: antivirus
|
|
index: antivirus
|
|
webserver:
|
|
category: webserver
|
|
index: http_server
|
|
fieldmappings:
|
|
AccessMask: accessmask
|
|
AccountName: username
|
|
cs-host: domain
|
|
cs-method: method
|
|
c-uri: url
|
|
c-uri-extension: uri
|
|
c-uri-path: uri
|
|
c-uri-query: uri
|
|
cs-uri-query: uri
|
|
c-uri-stem: url
|
|
c-useragent: useragent
|
|
ClientAddress: ~srcipv4
|
|
ClientIPAddress: ~srcipv4
|
|
ClientIP: ~srcipv4
|
|
CommandLine: args
|
|
ComputerName: username
|
|
CurrentDirectory: cwd
|
|
DestAddress: ~dstipv4
|
|
DestinationHostname: dsthost
|
|
DestinationIp: ~dstipv4
|
|
DestinationPort: dstport
|
|
destination.port: dstport
|
|
dst: ~dstipv4
|
|
dst_ip: ~dstipv4
|
|
dst_port: dstport
|
|
EventID: eventid
|
|
EventType: eventtype
|
|
file_hash: ~hash
|
|
FileName: filename
|
|
FileVersion: version
|
|
HostVersion: version
|
|
Image: process
|
|
Imphash: imphash
|
|
ipAddress: ~dstipv4
|
|
IpAddress: ~srcipv4
|
|
IPString: ~srcipv4
|
|
LogonType: logontype
|
|
NewProcessName: process
|
|
ObjectName: object
|
|
ObjectType: object_type
|
|
ParentImage: pprocess
|
|
ParentProcessName: pprocess
|
|
Path: filepath
|
|
ProcessName: process
|
|
ProcessCommandLine: args
|
|
Product: product
|
|
r-dns: domain
|
|
sc-status: status
|
|
ServiceFileName: filepath
|
|
ShareName: filename
|
|
SourceAddress: ~srcipv4
|
|
SourceHostname: srchost
|
|
SourceImage: process
|
|
SourceIp: ~srcipv4
|
|
SourcePort: srcport
|
|
src: ~srcipv4
|
|
src_ip: ~srcipv4
|
|
src_port: srcport
|
|
Status: status
|
|
SubjectUserName: username
|
|
TargetServer: ~dstipv4
|
|
TaskName: task
|
|
TargetFilename: filepath
|
|
TargetImage: filepath
|
|
TargetObject: object
|
|
USER: username
|
|
User: accountname
|
|
UserAgent: useragent
|
|
UserName: username
|
|
username: username
|
|
Version: version
|
|
Workstation: srchost
|
|
WorkstationName: srchost |