NotificationsYou must be signed in to change notification settings
Fork33
Star165

Commit231070c

authored

Merge pull request#209 from UncoderIO/microsoft_sentinel_mapping_upd

microsoft sentinel mapping update

2 parents5517ffe +7c6fce4 commit231070cCopy full SHA for 231070c

File tree

1 file changed

+46

-46

lines changed

uncoder-core/app/translator/mappings/platforms/microsoft_sentinel
- windows_security.yml

1 file changed

+46

-46

lines changed

`‎uncoder-core/app/translator/mappings/platforms/microsoft_sentinel/windows_security.yml‎`

Lines changed: 46 additions & 46 deletions

Original file line number	Diff line number	Diff line change
`@@ -14,16 +14,16 @@ field_mapping:`
`14`	`14`	`AccessMask:AccessMask`
`15`	`15`	`AccountName:AccountName`
`16`	`16`	`AllowedToDelegateTo:AllowedToDelegateTo`
`17`		`-AttributeLDAPDisplayName:`
	`17`	`+AttributeLDAPDisplayName:AttributeLDAPDisplayName`
`18`	`18`	`AuditPolicyChanges:AuditPolicyChanges`
`19`	`19`	`AuthenticationPackageName:AuthenticationPackageName`
`20`	`20`	`CallingProcessName:CallingProcessName`
`21`	`21`	`Channel:Channel`
`22`	`22`	`ComputerName:Computer`
`23`	`23`	`EventType:EventType`
`24`	`24`	`FailureReason:FailureReason`
`25`		`-FileName:FilePath`
`26`		`-GrantedAccess:`
	`25`	`+FileName:FileName`
	`26`	`+GrantedAccess:GrantedAccess`
`27`	`27`	`Hashes:FileHash`
`28`	`28`	`HiveName:HiveName`
`29`	`29`	`IpAddress:IpAddress`
`@@ -48,83 +48,83 @@ field_mapping:`
`48`	`48`	`TaskContent:TaskContent`
`49`	`49`	`ServiceSid:ServiceSid`
`50`	`50`	`CertThumbprint:CertThumbprint`
`51`		`-ClassName:duplicate`
`52`		`-NotificationPackageName:ClassName`
	`51`	`+ClassName:ClassName`
	`52`	`+NotificationPackageName:NotificationPackageName`
`53`	`53`	`NewSd:NewSd`
`54`	`54`	`TestSigning:TestSigning`
`55`	`55`	`TargetInfo:TargetInfo`
`56`		`-ClientProcessId:TargetInfo`
	`56`	`+ClientProcessId:ClientProcessId`
`57`	`57`	`ParentProcessId:ParentProcessId`
`58`	`58`	`AccessList:AccessList`
`59`	`59`	`GroupMembership:GroupMembership`
`60`	`60`	`FilterName:FilterName`
`61`	`61`	`ChangeType:ChangeType`
`62`	`62`	`LayerName:LayerName`
`63`	`63`	`ServiceAccount:ServiceAccount`
`64`		`-AttributeValue:ServiceAccount`
	`64`	`+AttributeValue:AttributeValue`
`65`	`65`	`SessionName:SessionName`
`66`	`66`	`TaskName:TaskName`
`67`		`-ObjectDN:SessionName`
	`67`	`+ObjectDN:ObjectDN`
`68`	`68`	`TemplateContent:TemplateContent`
`69`	`69`	`NewTemplateContent:NewTemplateContent`
`70`		`-SourcePort:TemplateContent`
	`70`	`+SourcePort:SourcePort`
`71`	`71`	`PasswordLastSet:PasswordLastSet`
`72`	`72`	`PrivilegeList:PrivilegeList`
`73`		`-DeviceDescription:PasswordLastSet`
`74`		`-TargetServerName:PrivilegeList`
`75`		`-NewTargetUserName:DeviceDescription`
`76`		`-OperationType:TargetServerName`
	`73`	`+DeviceDescription:DeviceDescription`
	`74`	`+TargetServerName:TargetServerName`
	`75`	`+NewTargetUserName:NewTargetUserName`
	`76`	`+OperationType:OperationType`
`77`	`77`	`DestPort:DestPort`
`78`		`-ServiceStartType:OperationType`
	`78`	`+ServiceStartType:ServiceStartType`
`79`	`79`	`OldTargetUserName:OldTargetUserName`
`80`		`-UserPrincipalName:ServiceStartType`
	`80`	`+UserPrincipalName:UserPrincipalName`
`81`	`81`	`Accesses:Accesses`
`82`		`-DnsHostName:UserPrincipalName`
`83`		`-DisableIntegrityChecks:AccessList`
	`82`	`+DnsHostName:DnsHostName`
	`83`	`+DisableIntegrityChecks:DisableIntegrityChecks`
`84`	`84`	`AuditSourceName:AuditSourceName`
`85`	`85`	`Workstation:Workstation`
`86`	`86`	`DestAddress:DestAddress`
`87`		`-PreAuthType:Workstation`
	`87`	`+PreAuthType:PreAuthType`
`88`	`88`	`SecurityPackageName:SecurityPackageName`
`89`	`89`	`SubjectLogonId:SubjectLogonId`
`90`	`90`	`NewUacValue:NewUacValue`
`91`		`-EnabledPrivilegeList:SubjectLogonId`
`92`		`-RelativeTargetName:NewUacValue`
	`91`	`+EnabledPrivilegeList:EnabledPrivilegeList`
	`92`	`+RelativeTargetName:RelativeTargetName`
`93`	`93`	`CertSerialNumber:CertSerialNumber`
`94`		`-SidHistory:RelativeTargetName`
	`94`	`+SidHistory:SidHistory`
`95`	`95`	`TargetLogonId:TargetLogonId`
`96`		`-KernelDebug:SidHistory`
`97`		`-CallerProcessName:TargetLogonId`
	`96`	`+KernelDebug:KernelDebug`
	`97`	`+CallerProcessName:CallerProcessName`
`98`	`98`	`ProcessName:ProcessName`
`99`		`-Properties:CallerProcessName`
`100`		`-UserAccountControl:ProcessName`
`101`		`-RegistryValue:Properties`
`102`		`-SecurityID:UserAccountControl`
	`99`	`+Properties:Properties`
	`100`	`+UserAccountControl:UserAccountControl`
	`101`	`+RegistryValue:RegistryValue`
	`102`	`+SecurityID:SecurityID`
`103`	`103`	`ServiceFileName:ServiceFileName`
`104`		`-SecurityDescriptor:SecurityID`
`105`		`-ServiceName:ServiceFileName`
`106`		`-ShareName:SecurityDescriptor`
`107`		`-NewValue:ServiceName`
`108`		`-Source:ShareName`
`109`		`-Status:NewValue`
	`104`	`+SecurityDescriptor:SecurityDescriptor`
	`105`	`+ServiceName:ServiceName`
	`106`	`+ShareName:ShareName`
	`107`	`+NewValue:NewValue`
	`108`	`+Source:Source`
	`109`	`+Status:Status`
`110`	`110`	`SubjectDomainName:SubjectDomainName`
`111`		`-SubjectUserName:Status`
`112`		`-SubjectUserSid:SubjectDomainName`
`113`		`-SourceAddr:SubjectUserName`
`114`		`-SourceAddress:SubjectUserSid`
	`111`	`+SubjectUserName:SubjectUserName`
	`112`	`+SubjectUserSid:SubjectUserSid`
	`113`	`+SourceAddr:SourceAddr`
	`114`	`+SourceAddress:SourceAddress`
`115`	`115`	`TargetName:TargetName`
`116`	`116`	`ServicePrincipalNames:ServicePrincipalNames`
`117`		`-TargetDomainName:TargetName`
	`117`	`+TargetDomainName:TargetDomainName`
`118`	`118`	`TargetSid:TargetSid`
`119`		`-TargetUserName:TargetDomainName`
`120`		`-ObjectServer:TargetSid`
`121`		`-TargetUserSid:TargetUserName`
`122`		`-TicketEncryptionType:ObjectServer`
`123`		`-TicketOptions:TargetUserSid`
	`119`	`+TargetUserName:TargetUserName`
	`120`	`+ObjectServer:ObjectServer`
	`121`	`+TargetUserSid:TargetUserSid`
	`122`	`+TicketEncryptionType:TicketEncryptionType`
	`123`	`+TicketOptions:TicketOptions`
`124`	`124`	`WorkstationName:WorkstationName`
`125`	`125`	`TransmittedServices:TransmittedServices`
`126`		`-AuthenticationAlgorithm:WorkstationName`
`127`		`-LayerRTID:TransmittedServices`
	`126`	`+AuthenticationAlgorithm:AuthenticationAlgorithm`
	`127`	`+LayerRTID:LayerRTID`
`128`	`128`	`BSSID:BSSID`
`129`	`129`	`BSSType:BSSType`
`130`	`130`	`CipherAlgorithm:CipherAlgorithm`
`@@ -139,7 +139,7 @@ field_mapping:`
`139`	`139`	`Domain:Domain`
`140`	`140`	`ServiceType:ServiceType`
`141`	`141`	`SourceName:SourceName`
`142`		`-StartType:ServiceType`
	`142`	`+StartType:StartType`
`143`	`143`	`UserID:UserID`
`144`	`144`	`ParentProcessName:ParentProcessName`
`145`	`145`	`Service:Service`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit231070c

File tree

1 file changed

1 file changed

`‎uncoder-core/app/translator/mappings/platforms/microsoft_sentinel/windows_security.yml‎`

0 commit comments