security_content/data_sources/endpoint/Windows_Event_Log_Printservice.yml at develop · Sims24/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
name: Windows Event Log Printservice
id: ba8f90f0-2028-44b5-853a-18f63ebd25e4
author: Patrick Bareiss, Splunk
source: WinEventLog:Microsoft-Windows-PrintService/Admin
sourcetype: WinEventLog
separator: EventCode
supported_TA:
  name: Splunk Add-on for Microsoft Windows
  version: 8.8.0
  url: https://splunkbase.splunk.com/app/742
event_names:
- event_name: Windows Event Log Printservice 316
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Printservice_316.yml
- event_name: Windows Event Log Printservice 4909
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Printservice_4909.yml
- event_name: Windows Event Log Printservice 808
  data_source: data_sources/endpoint/event_sources/Windows_Event_Log_Printservice_808.yml