blue-team-tools/tools/config/generic/sysmon.yml at eb690d8902cd89698eccec930b7febaaac9efb01 - blue-team-tools - GreySec Git

security-tools/blue-team-tools

Files

T

Thomas Patzke d81946df39 Stacked configurations

- Added log source rewriting
- Removed log source merging condition type setting
- Simplified SigmaLogsourceConfiguration constructor
- Condition is generated in SigmaParser instead of SigmaLogsourceConfiguration

Missing:
- Merging of raw config dict for backends that rely on this (es-dsl)

2018-09-12 23:40:22 +02:00

10 lines

211 B

YAML

Raw Blame History

 logsources:
     process_creation:
         category: process_creation
         product: windows
         conditions:
             EventID: 1
         rewrite:
             product: windows
             service: sysmon