security_content/data_sources/endpoint/Sysmon_for_Linux_EventID.yml at develop · samson4649/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
name: Sysmon for Linux EventID
id: da9fc0c9-4b15-4537-aa91-19ca0cb1eba5
author: Patrick Bareiss, Splunk
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon:linux
separator: EventID
supported_TA:
  name: Splunk Add-on for Sysmon for Linux
  version: 1.0.0
  url: https://splunkbase.splunk.com/app/6652
event_names:
- event_name: Sysmon for Linux EventID 1
  data_source: data_sources/endpoint/event_sources/Sysmon_for_Linux_EventID_1.yml
- event_name: Sysmon for Linux EventID 11
  data_source: data_sources/endpoint/event_sources/Sysmon_for_Linux_EventID_11.yml