Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit976388f

Browse files
committed
merge
1 parent4536c50 commit976388f

File tree

9 files changed

+70
-22
lines changed

9 files changed

+70
-22
lines changed

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/default.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ field_mapping:
1414
ProcessName:
1515
-xdm.target.process.name
1616
-xdm.source.process.name
17+
ProcessPath:xdm.target.process.executable.path
1718
ImageLoaded:
1819
-xdm.target.process.executable.filename
1920
-xdm.source.process.executable.filename
@@ -65,7 +66,7 @@ field_mapping:
6566
dns-query:xdm.network.dns.dns_question.name
6667
dns-answer:xdm.network.dns.dns_resource_record.value
6768
dns-record:xdm.network.dns.dns_question.name
68-
FileName:xdm.target.file.path
69+
FileName:xdm.target.file.filename
6970
IpAddress:xdm.source.ipv4
7071
IpPort:xdm.source.port
7172
LogonProcessName:xdm.target.process.executable.path
@@ -133,4 +134,8 @@ field_mapping:
133134
Classification:xdm.alert.category
134135
ResultCode:xdm.event.outcome_reason
135136
Technique:xdm.alert.mitre_techniques
136-
Action:xdm.event.outcome
137+
Action:xdm.event.outcome
138+
FileExtension:xdm.target.file.extension
139+
Workstation:xdm.source.host.hostname
140+
RegistryKey:xdm.target.registry.key
141+
RegistryValue:xdm.target.registry.value

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/windows_image_load.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ default_log_source:
99

1010
field_mapping:
1111
ImageLoaded:action_module_path
12+
FileExtension:action_file_extension
1213
md5:action_module_md5
1314
sha256:action_module_sha256
1415
User:actor_effective_username

‎uncoder-core/app/translator/mappings/platforms/qradar/default.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ field_mapping:
3636
-userName
3737
-EventUserName
3838
-Alert Threat Cause Actor Name
39+
-Username
40+
-Security ID
3941
CommandLine:Command
4042
Protocol:
4143
-IPProtocol
@@ -82,11 +84,21 @@ field_mapping:
8284
-Source
8385
-source
8486
duration:duration
85-
ThreatName:
87+
ThreatName:
8688
-Threat Name
8789
-Alert Blocked Threat Category
8890
AnalyzerName:Analyzer Name
8991
Classification:Classification
9092
ResultCode:Alert Reason Code
9193
Technique:Technique
92-
Action:Action
94+
Action:Action
95+
Workstation:Machine Identifier
96+
GroupMembership:Role Name
97+
FileName:
98+
-Filename
99+
-File Name
100+
RegistryKey:
101+
-Registry Key
102+
-Target Object
103+
RegistryValue:RegistryValue
104+
ProcessPath:Process Path

‎uncoder-core/app/translator/mappings/platforms/qradar/linux_process_creation.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ field_mapping:
1414
CommandLine:
1515
-Command
1616
-ASACommand
17+
-Command Arguments
1718
Image:Process Path
1819
ParentCommandLine:Parent Command
1920
ParentImage:Parent Process Path

‎uncoder-core/app/translator/mappings/platforms/qradar/proxy.yml‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,16 @@ field_mapping:
1313
-URL
1414
-XForceCategoryByURL
1515
c-useragent:User Agent
16-
cs-method:HTTP Method
16+
cs-method:
17+
-HTTP Method
18+
-Method
1719
cs-bytes:Bytes Sent
1820
#cs-cookie-vars: cs-cookie-vars
1921
c-uri-extension:URL
2022
c-uri-query:
2123
-URL
2224
-URL Path
25+
-URL Query String
2326
#cs-cookie: cs-cookie
2427
cs-host:
2528
-UrlHost
@@ -32,6 +35,10 @@ field_mapping:
3235
r-dns:
3336
-UrlHost
3437
-URL Host
35-
sc-status:HTTP Response Code
38+
sc-status:
39+
-HTTP Response Code
40+
-Response Code
3641
#post-body: post-body
37-
url_category:XForceCategoryByURL
42+
url_category:
43+
-XForceCategoryByURL
44+
-Web Category

‎uncoder-core/app/translator/mappings/platforms/qradar/webserver.yml‎

Lines changed: 29 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,33 @@ default_log_source:
99
devicetype:10
1010

1111
field_mapping:
12-
c-uri:URL
13-
c-useragent:c-useragent
14-
cs-method:cs-method
12+
c-uri:
13+
-URL
14+
-XForceCategoryByURL
15+
c-useragent:User Agent
16+
cs-method:
17+
-HTTP Method
18+
-Method
1519
cs-bytes:Bytes Sent
16-
cs-cookie-vars:cs-cookie-vars
17-
c-uri-extension:c-uri-extension
18-
c-uri-query:URL
19-
cs-cookie:cs-cookie
20-
cs-host:cs-host
21-
cs-referrer:URL Referrer
22-
cs-version:cs-version
23-
r-dns:r-dns
24-
sc-status:sc-status
25-
post-body:post-body
20+
#cs-cookie-vars: cs-cookie-vars
21+
c-uri-extension:URL
22+
c-uri-query:
23+
-URL
24+
-URL Path
25+
-URL Query String
26+
#cs-cookie: cs-cookie
27+
cs-host:
28+
-UrlHost
29+
-URL Host
30+
-URL Domain
31+
cs-referrer:
32+
-URL Referrer
33+
-Referrer URL
34+
cs-version:HTTP Version
35+
r-dns:
36+
-UrlHost
37+
-URL Host
38+
sc-status:
39+
-HTTP Response Code
40+
-Response Code
41+
#post-body: post-body

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_image_load.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,5 @@ field_mapping:
2121
-Signature Status
2222
-SignatureStatus
2323
OriginalFileName:OriginalFileName
24-
Signed:Signed
24+
Signed:Signed
25+
FileExtension:File Extension

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_process_creation.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,19 @@ field_mapping:
1414
CommandLine:
1515
-Command
1616
-Encoded Argument
17+
-Command Arguments
1718
CurrentDirectory:CurrentDirectory
1819
Hashes:File Hash
1920
Image:
2021
-Process Path
2122
-Process Name
2223
-DGApplication
24+
-ProcessName
2325
IntegrityLevel:IntegrityLevel
2426
ParentCommandLine:Parent Command
25-
ParentImage:Parent Process Path
27+
ParentImage:
28+
-Parent Process Path
29+
-ParentProcessName
2630
ParentUser:ParentUser
2731
Product:Product
2832
User:

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_security.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ field_mapping:
1212
EventID:
1313
-Event ID
1414
-EventID
15+
-qidEventId
1516
ParentImage:Parent Process Path
1617
AccessMask:AccessMask
1718
AccountName:Account Name

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp