Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit01e06fe

Browse files
Initial POC of LogRhythm Siem for search api
1 parent780bc15 commit01e06fe

File tree

9 files changed

+1618
-0
lines changed

9 files changed

+1618
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ Uncoder IO can be run on-prem without a need for an internet connection, thus su
7171
- FortiSIEM Rule -`fortisiem-rule`
7272
- LogRhythm Axon Rule -`axon-ads-rule`
7373
- LogRhythm Axon Query -`axon-ads-query`
74+
- LogRhythm SIEM Query -`siem-json-query`
7475

7576

7677
IOC-based queries can be generated in the following formats:
Lines changed: 309 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,309 @@
1+
platform:LogRhythm SIEM
2+
source:default
3+
4+
5+
field_mapping:
6+
EventID:vendor_information.id
7+
Channel:general_information.log_source.type_name
8+
ComputerName:origin.host.name
9+
FileName:object.file.name
10+
ProcessId:object.process.id
11+
Image:object.process.name
12+
AccountEmail:unattributed.account.email_address
13+
ContextInfo:general_information.raw_message
14+
CurrentDirectory:object.process.path
15+
ParentProcessId:object.process.parent_process.id
16+
ParentImage:object.process.parent_process.path
17+
ParentCommandLine:object.process.parent_process.command_line
18+
TargetFilename:object.file.name
19+
SourceIp:origin.host.ip_address.value
20+
SourceHostname:origin.host.name
21+
SourcePort:origin.host.network_port.value
22+
DestinationIp:target.host.ip_address.value
23+
DestinationHostname:
24+
-target.host.name
25+
-target.host.domain
26+
DestinationPort:target.host.network_port.value
27+
DestinationPortName:action.network.protocol.name
28+
ImageLoaded:object.file.path
29+
SignatureStatus:object.process.signature.status
30+
SourceProcessId:object.process.id
31+
SourceImage:object.process.name
32+
Device:object.process.path
33+
Destination:object.process.name
34+
QueryName:action.dns.query
35+
QueryStatus:action.dns.result
36+
CommandName:object.process.command_line
37+
CommandPath:object.process.path
38+
HostApplication:object.script.command_line
39+
HostName:origin.host.name
40+
ScriptName:object.script.name
41+
ScriptBlockText:object.script.command_line
42+
ScriptBlockId:object.script.id
43+
Application:object.process.name
44+
ClientAddress:origin.host.ip_address.value
45+
ClientName:origin.host.domain.name
46+
DestAddress:target.host.ip_address.value
47+
DestPort:target.host.network_port.value
48+
IpAddress:origin.host.ip_address.value
49+
IpPort:origin.host.network_port.value
50+
NewProcessId:object.process.id
51+
NewProcessName:object.process.name
52+
ParentProcessName:object.process.parent_process.name
53+
ProcessName:object.process.name
54+
SourceAddress:origin.host.ip_address.value
55+
WorkstationName:origin.host.name
56+
destination.port:target.host.network_port.value
57+
dst:target.host.ip_address.value
58+
dst_ip:target.host.ip_address.value
59+
dst_port:target.host.network_port.value
60+
network_application:
61+
-action.network.protocol.name
62+
-object.url.protocol
63+
network_protocol:action.network.protocol.name
64+
proto:action.network.protocol.name
65+
src:origin.host.ip_address.value
66+
src_ip:origin.host.ip_address.value
67+
src_port:origin.host.network_port.value
68+
action:action.command
69+
mqtt_action:action.command
70+
smb_action:action.command
71+
tunnel_action:action.command
72+
arg:object.process.command_args
73+
ftp_arg:object.process.command_args
74+
mysql_arg:object.process.command_args
75+
pop3_arg:object.process.command_args
76+
client:origin.host.ip_address.value
77+
command:action.command
78+
ftp_command:action.command
79+
irc_command:action.command
80+
pop3_command:action.command
81+
duration:action.duration
82+
from:origin.account.email_address
83+
kerberos_from:origin.account.email_address
84+
smtp_from:origin.account.email_address
85+
method:action.network.http_method
86+
http_method:action.network.http_method
87+
sip_method:action.network.http_method
88+
name:object.file.name
89+
smb_files_name:object.file.name
90+
software_name:object.file.name
91+
weird_name:object.file.name
92+
path:object.file.path
93+
smb_mapping_path:object.file.path
94+
smb_files_path:object.file.path
95+
smtp_files_path:object.file.path
96+
password:object.file.name
97+
reply_to:target.account.email_address
98+
response_body_len:action.network.byte_information.received
99+
request_body_len:action.network.byte_information.sent
100+
rtt:action.duration
101+
status_code:action.result.code
102+
known_certs_subject:object.certificate.subject
103+
sip_subject:object.email_message.subject
104+
smtp_subject:object.email_message.subject
105+
ssl_subject:object.certificate.subject
106+
username:origin.account.name
107+
uri:object.url.path
108+
user:origin.account.name
109+
user_agent:action.user_agent
110+
http_user_agent:action.user_agent
111+
gquic_user_agent:action.user_agent
112+
sip_user_agent:action.user_agent
113+
smtp_user_agent:action.user_agent
114+
version:object.file.version
115+
gquic_version:object.file.version
116+
http_version:object.file.version
117+
ntp_version:object.file.version
118+
socks_version:object.file.version
119+
snmp_version:object.file.version
120+
ssh_version:object.file.version
121+
tls_version:object.file.version
122+
answer:action.dns.result
123+
question_length:action.network.byte_information.total
124+
record_type:action.dns.record_type
125+
parent_domain:target.host.domain
126+
cs-bytes:action.network.byte_information.received
127+
r-dns:target.host.domain
128+
sc-bytes:action.network.byte_information.received
129+
sc-status:action.result.code
130+
c-uri:object.url.complete
131+
c-uri-extension:object.url.type
132+
c-uri-query:object.url.query
133+
c-uri-stem:object.url.path
134+
c-useragent:action.user_agent
135+
cs-host:
136+
-target.host.name
137+
-target.host.domain
138+
cs-method:action.network.http_method
139+
cs-version:object.file.version
140+
uid:action.session.id
141+
endpoint:origin.host.name
142+
domain:target.host.domain
143+
host_name:target.host.name
144+
client_fqdn:origin.host.name
145+
requested_addr:target.host.ip_address.value
146+
server_addr:target.host.ip_address.value
147+
qtype:action.dns.record_type
148+
qtype_name:action.dns.record_type
149+
query:action.dns.query
150+
rcode_name:action.dns.result
151+
md5:unattributed.hash.md5
152+
sha1:unattributed.hash.sha1
153+
sha256:unattributed.hash.sha256
154+
sha512:unattributed.hash.sha512
155+
filename:object.file.name
156+
host:
157+
-unattributed.host.name
158+
-unattributed.host.ip_address.value
159+
domainname:unattributed.host.name
160+
hostname:unattributed.host.name
161+
server_nb_computer_name:unattributed.host.name
162+
server_tree_name:unattributed.host.name
163+
server_dns_computer_name:unattributed.host.name
164+
machine:unattributed.host.name
165+
os:origin.host.os.platform
166+
mac:unattributed.host.mac_address
167+
result:
168+
-action.result.message
169+
-action.result.code
170+
-action.result.reason
171+
mailfrom:origin.account.email_address
172+
rcptto:target.account.email_address
173+
second_received:target.account.email_address
174+
server_name:unattributed.host.name
175+
c-ip:origin.host.ip_address.value
176+
cs-uri:object.url.path
177+
cs-uri-query:object.url.query
178+
cs-uri-stem:object.url.path
179+
clientip:origin.host.ip_address.value
180+
clientIP:origin.host.ip_address.value
181+
dest_domain:
182+
-target.host.name
183+
-target.host.domain
184+
dest_ip:target.host.ip_address.value
185+
dest_port:target.host.network_port.value
186+
agent.version:object.file.version
187+
destination.hostname:
188+
-target.host.name
189+
-target.host.domain
190+
DestinationAddress:
191+
-target.host.name
192+
-target.host.domain
193+
-target.host.ip_address.value
194+
DestinationIP:target.host.ip_address.value
195+
dst-ip:target.host.ip_address.value
196+
dstip:target.host.ip_address.value
197+
dstport:target.host.ip_address.value
198+
Host:target.host.name
199+
HostVersion:object.file.version
200+
http_host:
201+
-target.host.name
202+
-target.host.domain
203+
-target.host.ip_address.value
204+
http_uri:object.url.path
205+
http_url:object.url.complete
206+
http.request.url-query-params:object.url.query
207+
HttpMethod:action.network.http_method
208+
in_url:object.url.path
209+
post_url_parameter:object.url.path
210+
Request_Url:object.url.complete
211+
request_url:object.url.complete
212+
request_URL:object.url.complete
213+
RequestUrl:object.url.complete
214+
resource.url:object.url.path
215+
resource.URL:object.url.path
216+
sc_status:action.result.code
217+
sender_domain:
218+
-target.host.name
219+
-target.host.domain
220+
service.response_code:action.result.code
221+
source:
222+
-origin.host.name
223+
-origin.host.domain.name
224+
-origin.host.ip_address.value
225+
SourceAddr:origin.host.ip_address.value
226+
SourceIP:origin.host.ip_address.value
227+
SourceNetworkAddress:origin.host.ip_address.value
228+
srcip:origin.host.ip_address.value
229+
Status:action.result.code
230+
status:action.result.code
231+
url:object.url.path
232+
URL:object.url.path
233+
url_query:object.url.query
234+
url.query:object.url.query
235+
uri_path:object.url.path
236+
user_agent.name:action.user_agent
237+
user-agent:action.user_agent
238+
User-Agent:action.user_agent
239+
useragent:action.user_agent
240+
UserAgent:action.user_agent
241+
User_Agent:action.user_agent
242+
web_dest:
243+
-target.host.name
244+
-target.host.domain
245+
-target.host.ip_address.value
246+
-object.url.domain
247+
web.dest:
248+
-target.host.name
249+
-target.host.domain
250+
-target.host.ip_address.value
251+
-object.url.domain
252+
Web.dest:
253+
-target.host.name
254+
-target.host.domain
255+
-target.host.ip_address.value
256+
-object.url.domain
257+
web.host:
258+
-target.host.name
259+
-target.host.domain
260+
-target.host.ip_address.value
261+
-object.url.domain
262+
Web.host:
263+
-target.host.name
264+
-target.host.domain
265+
-target.host.ip_address.value
266+
-object.url.domain
267+
web_method:action.network.http_method
268+
Web_method:action.network.http_method
269+
web.method:action.network.http_method
270+
Web.method:action.network.http_method
271+
web_src:origin.host.ip_address.value
272+
web_status:action.result.code
273+
Web_status:action.result.code
274+
web.status:action.result.code
275+
Web.status:action.result.code
276+
web_uri:object.url.path
277+
web_url:object.url.complete
278+
destination.ip:target.host.ip_address.value
279+
source.ip:origin.host.ip_address.value
280+
source.port:origin.host.ip_address.value
281+
Computer:
282+
-target.host.name
283+
-target.host.domain
284+
-target.host.ip_address.value
285+
OriginalFileName:object.file.name
286+
User:origin.account.name
287+
EventType:action.command
288+
TargetObject:
289+
-object.registry_object.key
290+
-object.registry_object.path
291+
-object.resource.name
292+
CommandLine:object.process.command_line
293+
type:
294+
-action.command
295+
-action.type
296+
-action.session.type
297+
a0:
298+
-object.process.command_line
299+
-object.process.command_args
300+
-object.process.name
301+
cs-user-agent:action.user_agent
302+
blocked:
303+
-action.message
304+
-action.result.reason
305+
cs-ip:origin.host.ip_address.value
306+
SubjectLogonId:action.session.id
307+
SubjectUserName:origin.account.name
308+
SubjectUserSid:origin.account.id
309+
SubjectDomainName:origin.account.domain
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# from app.translator.platforms.logrhythm_siem.renders.logrhythm_siem_query import LogRhythmSiemQueryRender # noqa: F401
2+
fromapp.translator.platforms.logrhythm_siem.renders.logrhythm_siem_ruleimportLogRhythmSiemRuleRender# noqa: F401

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp