Commit41c0d42

authored

Merge pull request#198 from UncoderIO/gis-improve_qradar_palo_alto_mapping

Gis improve qradar palo alto mapping

2 parentsbf008fe +d69da7f commit41c0d42Copy full SHA for 41c0d42

File tree

-3

lines changed

uncoder-core/app/translator/mappings/platforms/qradar
- default.yml
- windows_process_creation.yml

-3

lines changed

Lines changed: 4 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -14,6 +14,8 @@ field_mapping:`
`14`	`14`	`-DstPort`
`15`	`15`	`-DestinationPort`
`16`	`16`	`-remoteport`
	`17`	`+dst-hostname:DstHost`
	`18`	`+src-hostname:SrcHost`
`17`	`19`	`src-port:`
`18`	`20`	`-SourcePort`
`19`	`21`	`-localport`
`@@ -94,11 +96,11 @@ field_mapping:`
`94`	`96`	`Action:Action`
`95`	`97`	`Workstation:Machine Identifier`
`96`	`98`	`GroupMembership:Role Name`
`97`		`-FileName:`
	`99`	`+FileName:`
`98`	`100`	`-Filename`
`99`	`101`	`-File Name`
`100`	`102`	`-Encoded Filename`
`101`		`-RegistryKey:`
	`103`	`+RegistryKey:`
`102`	`104`	`-Registry Key`
`103`	`105`	`-Target Object`
`104`	`106`	`RegistryValue:RegistryValue`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@ field_mapping:`
`24`	`24`	`-ProcessName`
`25`	`25`	`IntegrityLevel:IntegrityLevel`
`26`	`26`	`ParentCommandLine:Parent Command`
`27`		`-ParentImage:`
	`27`	`+ParentImage:`
`28`	`28`	`-Parent Process Path`
`29`	`29`	`-ParentProcessName`
`30`	`30`	`ParentUser:ParentUser`

Comments

(0)