NotificationsYou must be signed in to change notification settings
Fork33
Star165

Commit8b77550

authored

Merge pull request#160 from UncoderIO/gis-aql-upd-26-06-2024

upd qradar field mapping

2 parents3169751 +8d4f8d4 commit8b77550Copy full SHA for 8b77550

File tree

5 files changed

+17

-5

lines changed

uncoder-core/app/translator/mappings/platforms
- palo_alto_cortex
  - dns.yml
- qradar

5 files changed

+17

-5

lines changed

`‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/dns.yml‎`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -10,4 +10,5 @@ field_mapping:`
`10`	`10`	`#dns-record: dns-record`
`11`	`11`	`dns_query_name:xdm.network.dns.dns_question.name`
`12`	`12`	`QueryName:xdm.network.dns.dns_question.name`
`13`		`-query:xdm.network.dns.dns_question.name`
	`13`	`+query:xdm.network.dns.dns_question.name`
	`14`	`+dns-record-type:xdm.network.dns.dns_question.type`

`‎uncoder-core/app/translator/mappings/platforms/qradar/default.yml‎`

Lines changed: 8 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -35,7 +35,9 @@ field_mapping:`
`35`	`35`	`-userName`
`36`	`36`	`-EventUserName`
`37`	`37`	`CommandLine:Command`
`38`		`-Protocol:IPProtocol`
	`38`	`+Protocol:`
	`39`	`+ -IPProtocol`
	`40`	`+ -protocol`
`39`	`41`	`Application:`
`40`	`42`	`-Application`
`41`	`43`	`-application`
`@@ -61,6 +63,7 @@ field_mapping:`
`61`	`63`	`SourceMAC:`
`62`	`64`	`-SourceMAC`
`63`	`65`	`-MAC`
	`66`	`+ -sourceMAC`
`64`	`67`	`DestinationMAC:DestinationMAC`
`65`	`68`	`SourceOS:`
`66`	`69`	`-SourceOS`
`@@ -69,4 +72,7 @@ field_mapping:`
`69`	`72`	`TargetUserName:DestinationUserName`
`70`	`73`	`SourceUserName:SourceUserName`
`71`	`74`	`url_category:XForceCategoryByURL`
`72`		`-EventSeverity:EventSeverity`
	`75`	`+EventSeverity:EventSeverity`
	`76`	`+Source:`
	`77`	`+ -Source`
	`78`	`+ -source`

`‎uncoder-core/app/translator/mappings/platforms/qradar/dns.yml‎`

Lines changed: 2 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -12,4 +12,5 @@ field_mapping:`
`12`	`12`	`dns-query:URL`
`13`	`13`	`parent-domain:parent-domain`
`14`	`14`	`dns-answer:dns-answer`
`15`		`-dns-record:URL`
	`15`	`+dns-record:URL`
	`16`	`+dns-record-type:DNSRecordType`

`‎uncoder-core/app/translator/mappings/platforms/qradar/proxy.yml‎`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,7 @@ field_mapping:`
`24`	`24`	`cs-host:`
`25`	`25`	`-UrlHost`
`26`	`26`	`-URL Host`
	`27`	`+ -URL Domain`
`27`	`28`	`cs-referrer:`
`28`	`29`	`-URL Referrer`
`29`	`30`	`-Referrer URL`

`‎uncoder-core/app/translator/mappings/platforms/qradar/windows_security.yml‎`

Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,9 @@ field_mapping:`
`41`	`41`	`LinkName:LinkName`
`42`	`42`	`MemberName:MemberName`
`43`	`43`	`MemberSid:MemberSid`
`44`		`-NewProcessName:Process Name`
	`44`	`+NewProcessName:`
	`45`	`+ -Process Name`
	`46`	`+ -New Process Name`
`45`	`47`	`ObjectClass:ObjectClass`
`46`	`48`	`ObjectName:`
`47`	`49`	`-Object Name`
`@@ -122,6 +124,7 @@ field_mapping:`
`122`	`124`	`ServiceFileName:`
`123`	`125`	`-Service Filename`
`124`	`126`	`-ServiceFileName`
	`127`	`+ -Service File Name`
`125`	`128`	`SecurityDescriptor:SecurityDescriptor`
`126`	`129`	`ServiceName:Service Name`
`127`	`130`	`ShareName:`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit8b77550

File tree

5 files changed

5 files changed

`‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/dns.yml‎`

`‎uncoder-core/app/translator/mappings/platforms/qradar/default.yml‎`

`‎uncoder-core/app/translator/mappings/platforms/qradar/dns.yml‎`

`‎uncoder-core/app/translator/mappings/platforms/qradar/proxy.yml‎`

`‎uncoder-core/app/translator/mappings/platforms/qradar/windows_security.yml‎`

0 commit comments