Terrance DeJesus
ba16e27edb
* tuning 'Azure Service Principal Credentials Added' * updated patch version * added investigation guide * updating patch version * updating patch version
188 lines
7.9 KiB
JSON
188 lines
7.9 KiB
JSON
{
|
|
"endgame-*": {
|
|
"endgame": {
|
|
"metadata": {
|
|
"type": "keyword"
|
|
},
|
|
"event_subtype_full": "keyword"
|
|
}
|
|
},
|
|
"winlogbeat-*": {
|
|
"winlog": {
|
|
"event_data": {
|
|
"AccessList": "keyword",
|
|
"AccessMask": "keyword",
|
|
"AccessMaskDescription": "keyword",
|
|
"AllowedToDelegateTo": "keyword",
|
|
"AttributeLDAPDisplayName": "keyword",
|
|
"AttributeValue": "keyword",
|
|
"CallerProcessName": "keyword",
|
|
"CallTrace": "keyword",
|
|
"ClientProcessId": "keyword",
|
|
"Consumer": "keyword",
|
|
"GrantedAccess": "keyword",
|
|
"NewTargetUserName": "keyword",
|
|
"ObjectClass": "keyword",
|
|
"ObjectDN": "keyword",
|
|
"ObjectName": "keyword",
|
|
"OldTargetUserName": "keyword",
|
|
"OriginalFileName": "keyword",
|
|
"ParentProcessId": "keyword",
|
|
"ProcessName": "keyword",
|
|
"Properties": "keyword",
|
|
"RelativeTargetName": "keyword",
|
|
"ShareName": "keyword",
|
|
"SubjectLogonId": "keyword",
|
|
"SubjectUserName": "keyword",
|
|
"SubjectUserSid": "keyword",
|
|
"TargetUserName": "keyword",
|
|
"TargetImage": "keyword",
|
|
"TargetLogonId": "keyword",
|
|
"TargetProcessGUID": "keyword",
|
|
"TargetSid": "keyword",
|
|
"SchemaFriendlyName": "keyword",
|
|
"Resource": "keyword",
|
|
"RpcCallClientLocality": "keyword",
|
|
"PrivilegeList": "keyword",
|
|
"AuthenticationPackageName" : "keyword",
|
|
"TargetUserSid" : "keyword",
|
|
"LogonProcessName": "keyword",
|
|
"DnsHostName" : "keyword",
|
|
"ServiceFileName": "keyword",
|
|
"ImagePath": "keyword",
|
|
"TaskName": "keyword",
|
|
"Status": "keyword",
|
|
"EnabledPrivilegeList": "keyword",
|
|
"Operation": "keyword",
|
|
"OperationType": "keyword"
|
|
}
|
|
},
|
|
"winlog.logon.type": "keyword",
|
|
"winlog.logon.id": "keyword",
|
|
"powershell.file.script_block_text": "text"
|
|
},
|
|
"filebeat-*": {
|
|
"o365.audit.NewValue": "keyword",
|
|
"labels.is_ioc_transform_source": "keyword"
|
|
},
|
|
"logs-endpoint.events.*": {
|
|
"process.Ext.token.integrity_level_name": "keyword",
|
|
"process.parent.Ext.real.pid": "long",
|
|
"process.Ext.effective_parent.executable": "keyword",
|
|
"process.Ext.effective_parent.entity_id": "keyword",
|
|
"process.Ext.effective_parent.name": "keyword",
|
|
"file.Ext.header_bytes": "keyword",
|
|
"file.Ext.entropy": "long",
|
|
"file.Ext.windows.zone_identifier": "long",
|
|
"file.size": "long",
|
|
"file.Ext.original.name": "keyword",
|
|
"dll.Ext.device.product_id": "keyword",
|
|
"dll.Ext.relative_file_creation_time": "double",
|
|
"dll.Ext.relative_file_name_modify_time": "double",
|
|
"process.Ext.relative_file_name_modify_time": "double",
|
|
"process.Ext.relative_file_creation_time": "double",
|
|
"Target.process.name": "keyword",
|
|
"process.Ext.api.name": "keyword"
|
|
},
|
|
"logs-endpoint.events.api-*": {
|
|
"process.Ext.api.parameters.consumer_type": "keyword",
|
|
"process.Ext.api.name": "keyword"
|
|
},
|
|
"logs-endpoint.events.file-*": {
|
|
"file.Ext.header_bytes": "keyword",
|
|
"file.Ext.windows.zone_identifier": "long"
|
|
},
|
|
"logs-windows.*": {
|
|
"powershell.file.script_block_text": "text"
|
|
},
|
|
"logs-kubernetes.*": {
|
|
"kubernetes.audit.objectRef.resource": "keyword",
|
|
"kubernetes.audit.objectRef.subresource": "keyword",
|
|
"kubernetes.audit.verb": "keyword",
|
|
"kubernetes.audit.user.username": "keyword",
|
|
"kubernetes.audit.impersonatedUser.username": "keyword",
|
|
"kubernetes.audit.annotations.authorization_k8s_io/decision": "keyword",
|
|
"kubernetes.audit.annotations.authorization_k8s_io/reason": "keyword",
|
|
"kubernetes.audit.user.groups": "text",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.privileged": "boolean",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.allowPrivilegeEscalation": "boolean",
|
|
"kubernetes.audit.requestObject.spec.securityContext.runAsUser": "long",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.runAsUser": "long",
|
|
"kubernetes.audit.requestObject.spec.hostPID": "boolean",
|
|
"kubernetes.audit.requestObject.spec.hostNetwork": "boolean",
|
|
"kubernetes.audit.requestObject.spec.hostIPC": "boolean",
|
|
"kubernetes.audit.requestObject.spec.volumes.hostPath.path": "keyword",
|
|
"kubernetes.audit.requestObject.spec.type": "keyword",
|
|
"kubernetes.audit.requestObject.rules.resources": "keyword",
|
|
"kubernetes.audit.requestObject.rules.verb": "keyword",
|
|
"kubernetes.audit.objectRef.namespace": "keyword",
|
|
"kubernetes.audit.objectRef.serviceAccountName": "keyword",
|
|
"kubernetes.audit.requestObject.spec.serviceAccountName": "keyword",
|
|
"kubernetes.audit.responseStatus.reason": "keyword",
|
|
"kubernetes.audit.requestObject.spec.containers.securityContext.capabilities.add": "keyword",
|
|
"kubernetes.audit.requestObject.spec.containers.image": "text"
|
|
},
|
|
".alerts-security.*": {
|
|
"signal.rule.name": "keyword",
|
|
"signal.rule.tags": "keyword",
|
|
"signal.rule.threat.tactic.name": "keyword",
|
|
"kibana.alert.rule.threat.tactic.id": "keyword",
|
|
"kibana.alert.workflow_status": "keyword",
|
|
"kibana.alert.rule.rule_id": "keyword"
|
|
},
|
|
"logs-google_workspace*": {
|
|
"gsuite.admin": "keyword",
|
|
"gsuite.admin.new_value": "keyword",
|
|
"gsuite.admin.setting.name": "keyword",
|
|
"google_workspace.drive.owner_is_team_drive": "keyword",
|
|
"google_workspace.drive.copy_type": "keyword",
|
|
"google_workspace.drive.file.type": "keyword",
|
|
"google_workspace.drive.visibility": "keyword",
|
|
"google_workspace.token.client.id": "keyword",
|
|
"google_workspace.token.scope.data": "keyword",
|
|
"google_workspace.token.scope.data.scope_name": "keyword"
|
|
},
|
|
"logs-ti_*": {
|
|
"labels.is_ioc_transform_source": "keyword"
|
|
},
|
|
"logs-auditd_manager.auditd-*": {
|
|
"auditd.data.a0": "keyword",
|
|
"auditd.data.a1": "keyword",
|
|
"auditd.data.a2": "keyword",
|
|
"auditd.data.a3": "keyword"
|
|
},
|
|
"logs-aws.cloudtrail-*": {
|
|
"aws.cloudtrail.flattened.request_parameters.cidrIp": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.fromPort": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.roleArn": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.roleName": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.policyArn": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.serialNumber": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm": "keyword",
|
|
"aws.cloudtrail.flattened.additional_eventdata.SSEApplied": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.bucketName": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.key": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.includeDeprecated": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.withDecryption": "boolean",
|
|
"aws.cloudtrail.flattened.request_parameters.instanceId": "keyword",
|
|
"aws.cloudtrail.flattened.request_parameters.dryRun": "boolean",
|
|
"aws.cloudtrail.flattened.request_parameters.clientToken": "keyword",
|
|
"aws.cloudtrail.flattened.response_elements.s3BucketName": "keyword",
|
|
"aws.cloudtrail.flattened.response_elements.tableArn": "keyword"
|
|
},
|
|
"logs-azure.signinlogs-*": {
|
|
"azure.signinlogs.properties.conditional_access_audiences.application_id": "keyword",
|
|
"azure.signinlogs.properties.original_transfer_method": "keyword",
|
|
"azure.auditlogs.properties.target_resources.0.display_name": "keyword",
|
|
"azure.signinlogs.properties.authentication_details.authentication_method": "keyword"
|
|
},
|
|
"logs-azure.activitylogs-*": {
|
|
"azure.activitylogs.properties.authentication_protocol": "keyword",
|
|
"azure.activitylogs.properties.appId": "keyword"
|
|
},
|
|
"logs-okta*": {
|
|
"okta.debug_context.debug_data.flattened.requestedScopes": "keyword",
|
|
"okta.debug_context.debug_data.flattened.grantType": "keyword"
|
|
}
|
|
}
|