Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd5639ce

Browse files
authored
Merge pull request#205 from UncoderIO/gis-8825
Gis 8825 added sentinel one power query render
2 parents1a50cff +ba9ee98 commitd5639ce

File tree

21 files changed

+306
-5
lines changed

21 files changed

+306
-5
lines changed
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
platform:Sentinel One Power Query
2+
source:default
Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
platform:Sentinel One Power Query
2+
source:dns
3+
4+
field_mapping:
5+
Image:src.process.image.path
6+
CommandLine:src.process.cmdline
7+
ParentImage:src.process.parent.image.path
8+
ParentCommandLine:src.process.parent.cmdline
9+
query:event.dns.request
10+
answer:event.dns.response
11+
QueryName:event.dns.request
12+
record_type:event.dns.response
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
platform:Sentinel One Power Query
2+
source:linux_file_event
3+
4+
field_mapping:
5+
Image:src.process.image.path
6+
CommandLine:src.process.cmdline
7+
ParentImage:src.process.parent.image.path
8+
ParentCommandLine:src.process.parent.cmdline
9+
TargetFilename:tgt.file.path
10+
SourceFilename:tgt.file.oldPath
11+
User:src.process.use
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
platform:Sentinel One Power Query
2+
source:windows_image_load
3+
4+
field_mapping:
5+
Image:Image
6+
ImageLoaded:ImageLoaded
7+
SignatureStatus:SignatureStatus
8+
OriginalFileName:OriginalFileName
9+
Signed:Signed
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
platform:Sentinel One Power Query
2+
source:windows_network_connection
3+
4+
field_mapping:
5+
Image:src.process.image.path
6+
CommandLine:src.process.cmdline
7+
ParentImage:src.process.parent.image.path
8+
ParentCommandLine:src.process.parent.cmdline
9+
DestinationHostname:
10+
-url.address
11+
-event.dns.request
12+
DestinationPort:dst.port.number
13+
DestinationIp:dst.ip.address
14+
User:src.process.user
15+
SourceIp:src.ip.address
16+
SourcePort:src.port.number
17+
Protocol:NetProtocolName
18+
dst_ip:dst.ip.address
19+
src_ip:src.ip.address
20+
dst_port:dst.port.number
21+
src_port:src.port.number
Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
platform:Sentinel One Power Query
2+
source:windows_pipe_created
3+
4+
field_mapping:
5+
PipeName:namedPipe.name
6+
Image:src.process.image.path
7+
CommandLine:src.process.cmdline
8+
ParentImage:src.process.parent.image.path
9+
ParentCommandLine:src.process.parent.cmdline
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
platform:Sentinel One Power Query
2+
source:windows_process_creation
3+
4+
field_mapping:
5+
ProcessId:tgt.process.pid
6+
Image:tgt.process.image.path
7+
Description:tgt.process.displayName
8+
Publisher:tgt.process.publisher
9+
Product:tgt.process.displayName
10+
Company:tgt.process.publisher
11+
CommandLine:tgt.process.cmdline
12+
CurrentDirectory:tgt.process.image.path
13+
User:tgt.process.user
14+
TerminalSessionId:tgt.process.sessionid
15+
IntegrityLevel:tgt.process.integrityLevel
16+
md5:tgt.process.image.md5
17+
sha1:tgt.process.image.sha1
18+
sha256:tgt.process.image.sha256
19+
ParentProcessId:src.process.pid
20+
ParentImage:src.process.image.path
21+
ParentCommandLine:src.process.cmdline
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
platform:Sentinel One Power Query
2+
source:windows_registry_event
3+
4+
field_mapping:
5+
Image:src.process.image.path
6+
CommandLine:src.process.cmdline
7+
ParentImage:src.process.parent.image.path
8+
ParentCommandLine:src.process.parent.cmdline
9+
TargetObject:registry.keyPath
10+
Details:registry.value

‎uncoder-core/app/translator/platforms/carbonblack/const.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
"platform_name":"Query (Cloud)",
99
}
1010

11+
1112
DEFAULT_CARBONBLACK_CTI_MAPPING= {
1213
"SourceIP":"netconn_local_ipv4",
1314
"DestinationIP":"netconn_ipv4",

‎uncoder-core/app/translator/platforms/carbonblack/renders/carbonblack_cti.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
fromapp.translator.platforms.carbonblack.constimportDEFAULT_CARBONBLACK_CTI_MAPPING,carbonblack_query_details
2424

2525

26+
2627
@render_cti_manager.register
2728
classCarbonBlackCTI(RenderCTI):
2829
details:PlatformDetails=carbonblack_query_details

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp