Commit378d217

authored

Merge pull request#144 from UncoderIO/update_qradar_palo_alto_mapping

Updated qradar and palo_alto mappings

2 parents31edd63 +ab7f37f commit378d217Copy full SHA for 378d217

File tree

+20

-11

lines changed

+20

-11

lines changed

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -35,6 +35,7 @@ field_mapping:`
`35`	`35`	`DestinationIp:xdm.target.ipv4`
`36`	`36`	`dst-port:xdm.target.port`
`37`	`37`	`DestinationPort:xdm.target.port`
	`38`	`+destinationPort:xdm.target.port`
`38`	`39`	`src-bytes:xdm.source.sent_bytes`
`39`	`40`	`dst-bytes:xdm.target.sent_bytes`
`40`	`41`	`src-hostname:xdm.source.host.hostname`
`@@ -82,6 +83,7 @@ field_mapping:`
`82`	`83`	`SourceAddress:xdm.source.ipv4`
`83`	`84`	`TargetSid:xdm.target.user.identifier`
`84`	`85`	`TargetUserName:xdm.target.user.username`
	`86`	`+SourceUserName:xdm.source.user.username`
`85`	`87`	`ParentProcessName:xdm.source.process.executable.path`
`86`	`88`	`client.user.full_name:xdm.target.user.username`
`87`	`89`	`source.user.full_name:xdm.source.user.username`
`@@ -122,3 +124,4 @@ field_mapping:`
`122`	`124`	`DestinationMAC:xdm.target.host.mac_addresses`
`123`	`125`	`SourceOS:xdm.source.host.os`
`124`	`126`	`DestinationOS:xdm.target.host.os`
	`127`	`+url_category:xdm.network.http.url_category`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -19,4 +19,5 @@ field_mapping:`
`19`	`19`	`cs-cookie:xdm.network.http.http_header.value`
`20`	`20`	`#cs-version: cs-version`
`21`	`21`	`r-dns:xdm.network.http.domain`
`22`		`-post-body:xdm.network.http.http_header.value`
	`22`	`+post-body:xdm.network.http.http_header.value`
	`23`	`+url_category:xdm.network.http.url_category`

Lines changed: 10 additions & 6 deletions

Original file line number	Diff line number	Diff line change
`@@ -27,21 +27,22 @@ field_mapping:`
`27`	`27`	`-destination_ip`
`28`	`28`	`-destinationIP`
`29`	`29`	`-destinationaddress`
`30`		`-User:`
	`30`	`+User:`
`31`	`31`	`-userName`
`32`	`32`	`-EventUserName`
`33`	`33`	`CommandLine:Command`
`34`	`34`	`Protocol:IPProtocol`
`35`	`35`	`Application:`
`36`	`36`	`-Application`
`37`	`37`	`-application`
`38`		`-SourceHostName:`
	`38`	`+SourceHostName:`
`39`	`39`	`-HostCount-source`
`40`	`40`	`-identityHostName`
`41`	`41`	`-sourceAssetName`
`42`		`-DestinationHostname:`
	`42`	`+DestinationHostname:`
`43`	`43`	`-HostCount-destination`
`44`	`44`	`-Recipient Host`
	`45`	`+ -DestinationHostName`
`45`	`46`	`src-packets:`
`46`	`47`	`-PacketRatio-src`
`47`	`48`	`-src-packets`
`@@ -51,11 +52,14 @@ field_mapping:`
`51`	`52`	`src-bytes:src-bytes`
`52`	`53`	`dst-bytes:dst-bytes`
`53`	`54`	`ExternalSeverity:External Severity`
`54`		`-SourceMAC:`
	`55`	`+SourceMAC:`
`55`	`56`	`-SourceMAC`
`56`	`57`	`-MAC`
`57`	`58`	`DestinationMAC:DestinationMAC`
`58`		`-SourceOS:`
	`59`	`+SourceOS:`
`59`	`60`	`-SourceOS`
`60`	`61`	`-OS`
`61`		`-DestinationOS:DestinationOS`
	`62`	`+DestinationOS:DestinationOS`
	`63`	`+TargetUserName:DestinationUserName`
	`64`	`+SourceUserName:SourceUserName`
	`65`	`+url_category:XForceCategoryByURL`

Lines changed: 5 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -17,19 +17,20 @@ field_mapping:`
`17`	`17`	`cs-bytes:Bytes Sent`
`18`	`18`	`#cs-cookie-vars: cs-cookie-vars`
`19`	`19`	`c-uri-extension:URL`
`20`		`-c-uri-query:`
	`20`	`+c-uri-query:`
`21`	`21`	`-URL`
`22`	`22`	`-URL Path`
`23`	`23`	`#cs-cookie: cs-cookie`
`24`		`-cs-host:`
	`24`	`+cs-host:`
`25`	`25`	`-UrlHost`
`26`	`26`	`-URL Host`
`27`		`-cs-referrer:`
	`27`	`+cs-referrer:`
`28`	`28`	`-URL Referrer`
`29`	`29`	`-Referrer URL`
`30`	`30`	`cs-version:HTTP Version`
`31`	`31`	`r-dns:`
`32`	`32`	`-UrlHost`
`33`	`33`	`-URL Host`
`34`	`34`	`sc-status:HTTP Response Code`
`35`		`-#post-body: post-body`
	`35`	`+#post-body: post-body`
	`36`	`+url_category:XForceCategoryByURL`

Comments

(0)