Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

aql fields upd#177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
saltar-ua merged 1 commit intomainfromgis-aql-upd-2024-07-20
Jul 22, 2024
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ field_mapping:
ProcessName:
- xdm.target.process.name
- xdm.source.process.name
ProcessPath: xdm.target.process.executable.path
ImageLoaded:
- xdm.target.process.executable.filename
- xdm.source.process.executable.filename
Expand DownExpand Up@@ -64,7 +65,7 @@ field_mapping:
dns-query: xdm.network.dns.dns_question.name
dns-answer: xdm.network.dns.dns_resource_record.value
dns-record: xdm.network.dns.dns_question.name
FileName: xdm.target.file.path
FileName: xdm.target.file.filename
IpAddress: xdm.source.ipv4
IpPort: xdm.source.port
LogonProcessName: xdm.target.process.executable.path
Expand DownExpand Up@@ -127,3 +128,7 @@ field_mapping:
url_category: xdm.network.http.url_category
EventSeverity: xdm.alert.severity
duration: xdm.event.duration
FileExtension: xdm.target.file.extension
Workstation: xdm.source.host.hostname
RegistryKey: xdm.target.registry.key
RegistryValue: xdm.target.registry.value
Original file line numberDiff line numberDiff line change
Expand Up@@ -9,6 +9,7 @@ default_log_source:

field_mapping:
ImageLoaded: action_module_path
FileExtension: action_file_extension
md5: action_module_md5
sha256: action_module_sha256
User: actor_effective_username
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -19,6 +19,7 @@ field_mapping:
src-port:
- SourcePort
- localport
- sourcePort
src-ip:
- sourceip
- source_ip
Expand All@@ -34,6 +35,8 @@ field_mapping:
User:
- userName
- EventUserName
- Username
- Security ID
CommandLine: Command
Protocol:
- IPProtocol
Expand DownExpand Up@@ -78,4 +81,14 @@ field_mapping:
Source:
- Source
- source
duration: duration
duration: duration
Workstation: Machine Identifier
GroupMembership: Role Name
FileName:
- Filename
- File Name
RegistryKey:
- Registry Key
- Target Object
RegistryValue: RegistryValue
ProcessPath: Process Path
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -14,6 +14,7 @@ field_mapping:
CommandLine:
- Command
- ASACommand
- Command Arguments
Image: Process Path
ParentCommandLine: Parent Command
ParentImage: Parent Process Path
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -21,4 +21,5 @@ field_mapping:
- Signature Status
- SignatureStatus
OriginalFileName: OriginalFileName
Signed: Signed
Signed: Signed
FileExtension: File Extension
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -14,15 +14,19 @@ field_mapping:
CommandLine:
- Command
- Encoded Argument
- Command Arguments
CurrentDirectory: CurrentDirectory
Hashes: File Hash
Image:
- Process Path
- Process Name
- DGApplication
- ProcessName
IntegrityLevel: IntegrityLevel
ParentCommandLine: Parent Command
ParentImage: Parent Process Path
ParentImage:
- Parent Process Path
- ParentProcessName
ParentUser: ParentUser
Product: Product
User:
Expand Down
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,7 @@ field_mapping:
EventID:
- Event ID
- EventID
- qidEventId
ParentImage: Parent Process Path
AccessMask: AccessMask
AccountName: Account Name
Expand Down
[8]ページ先頭
©2009-2025 Movatter.jp