Commitd970669

authored

Merge pull request#129 from rm-socprime/preset_xdr_event_log

preset xdr_event_log

2 parents54ae153 +e022419 commitd970669Copy full SHA for d970669

File tree

-5

lines changed

-5

lines changed

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@ platform: Palo Alto XSIAM`
`2`	`2`	`source:windows_application`
`3`	`3`
`4`	`4`	`default_log_source:`
`5`		`-dataset:microsoft_windows_raw`
	`5`	`+preset:xdr_event_log`
`6`	`6`
`7`	`7`	`field_mapping:`
`8`	`8`	`EventID:action_evtlog_event_id`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@ source: windows_powershell`
`3`	`3`
`4`	`4`
`5`	`5`	`default_log_source:`
`6`		`-dataset:microsoft_windows_raw`
	`6`	`+preset:xdr_event_log`
`7`	`7`
`8`	`8`	`field_mapping:`
`9`	`9`	`EventID:action_evtlog_event_id`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@ platform: Palo Alto XSIAM`
`2`	`2`	`source:windows_security`
`3`	`3`
`4`	`4`	`default_log_source:`
`5`		`-dataset:microsoft_windows_raw`
	`5`	`+preset:xdr_event_log`
`6`	`6`
`7`	`7`	`field_mapping:`
`8`	`8`	`EventID:action_evtlog_event_id`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -3,7 +3,7 @@ source: windows_sysmon`
`3`	`3`
`4`	`4`
`5`	`5`	`default_log_source:`
`6`		`-dataset:microsoft_windows_raw`
	`6`	`+preset:xdr_event_log`
`7`	`7`
`8`	`8`	`field_mapping:`
`9`	`9`	`EventID:action_evtlog_event_id`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@ platform: Palo Alto XSIAM`
`2`	`2`	`source:windows_system`
`3`	`3`
`4`	`4`	`default_log_source:`
`5`		`-dataset:microsoft_windows_raw`
	`5`	`+preset:xdr_event_log`
`6`	`6`
`7`	`7`	`field_mapping:`
`8`	`8`	`EventID:action_evtlog_event_id`

Comments

(0)