Commitf4992b3

authored

Merge pull request#123 from UncoderIO/gis-improve-qradar-mappings

Qradar AQL mapping improvements

2 parents5e68d2f +1c01203 commitf4992b3Copy full SHA for f4992b3

File tree

+29

-8

lines changed

+29

-8

lines changed

Lines changed: 21 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -2,9 +2,26 @@ platform: Qradar`
`2`	`2`	`source:default`
`3`	`3`	`description:Text that describe current mapping`
`4`	`4`
`5`		`-log_source:`
`6`		`-devicetype:`
`7`		`- -12`
`8`	`5`
`9`	`6`	`default_log_source:`
`10`		`-devicetype:12`
	`7`	`+devicetype:12`
	`8`	`+`
	`9`	`+`
	`10`	`+field_mapping:`
	`11`	`+icmp.type:IcmpType`
	`12`	`+dst-port:`
	`13`	`+ -DstPort`
	`14`	`+ -DestinationPort`
	`15`	`+dst-hostname:DstHost`
	`16`	`+src-port:SourcePort`
	`17`	`+src-ip:`
	`18`	`+ -sourceip`
	`19`	`+ -source_ip`
	`20`	`+ -SourceIP`
	`21`	`+dst-ip:`
	`22`	`+ -DestinationIP`
	`23`	`+ -destinationip`
	`24`	`+ -destination_ip`
	`25`	`+User:userName`
	`26`	`+CommandLine:Command`
	`27`	`+Protocol:IPProtocol`

Lines changed: 5 additions & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`platform:Qradar`
`2`	`2`	`source:linux_auditd`
`3`		`-description:Auditd field mappings to QRadar default CEPs.`
	`3`	`+description:Text that describe current mapping`
`4`	`4`
`5`	`5`	`log_source:`
`6`	`6`	`devicetype:[11]`
`@@ -14,8 +14,10 @@ field_mapping:`
`14`	`14`	`a2:Command`
`15`	`15`	`a3:Command`
`16`	`16`	`exe:Process Path`
`17`		`-CommandLine:Command`
	`17`	`+CommandLine:`
	`18`	`+ -Process CommandLine`
	`19`	`+ -Command`
`18`	`20`	`Image:Process Path`
`19`	`21`	`User:username`
`20`	`22`	`LogonId:Logon ID`
`21`		`-ParentImage:Parent Process Path`
	`23`	`+ParentImage:Parent Process Path`

Lines changed: 3 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -14,4 +14,6 @@ field_mapping:`
`14`	`14`	`CommandLine:Command`
`15`	`15`	`Image:Process Path`
`16`	`16`	`ParentCommandLine:Parent Command`
`17`		`-ParentImage:Parent Process Path`
	`17`	`+ParentImage:Parent Process Path`
	`18`	`+User:username`
	`19`	`+LogonId:Logon ID`

Comments

(0)