diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 177d51fa85..789489268b 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -20,6 +20,9 @@ mitre_components: - Cloud Storage Enumeration source: aws_asl sourcetype: aws:asl +logsource: + product: aws + service: cloudtrail separator: api.operation supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 801a3882ea..4618427e93 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -9,6 +9,8 @@ mitre_components: - Application Log Content source: aws_bedrock sourcetype: json_no_timestamp +logsource: + product: aws separator: schemaType separator_value: ModelInvocationLog supported_TA: diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index e725a27c95..e52e16c90a 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -14,6 +14,9 @@ mitre_components: - Cloud Service Metadata source: aws sourcetype: aws:cloudfront:accesslogs +logsource: + product: aws + service: cloudfront supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 9ce661d969..6ae1b47e2b 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -7,8 +7,19 @@ author: Patrick Bareiss, Splunk description: All AWS CloudTrail events source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - - name: Splunk Add-on for AWS - url: https://splunkbase.splunk.com/app/1876 - version: 8.2.2 +- name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 8.2.2 +output_fields: +- dest +- user +- user_agent +- src +- vendor_account +- vendor_region +- vendor_product diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 87c2702b27..a427062e5f 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -13,6 +13,9 @@ mitre_components: - Instance Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: AssumeRoleWithSAML supported_TA: diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index 1c5f94ecab..e00e355975 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -13,6 +13,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ConsoleLogin supported_TA: diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index 042284fe75..e1573c8f75 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -12,6 +12,9 @@ mitre_components: - Instance Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CopyObject supported_TA: diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 90d25a6c4b..f199c8c4b7 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateAccessKey supported_TA: diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 66946e9161..ee0b438783 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -12,6 +12,9 @@ mitre_components: - Volume Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateKey supported_TA: diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index e9c79a8b1a..c13039f28a 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateLoginProfile supported_TA: diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index c1153a3068..c80807c792 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateNetworkAclEntry supported_TA: diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 00c450ca5d..2a14e1181c 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -12,6 +12,9 @@ mitre_components: - Group Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreatePolicyVersion supported_TA: diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index 621812b8ec..462335f1c8 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateSnapshot supported_TA: diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index f84b2cf002..8ef76f1604 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -12,6 +12,9 @@ mitre_components: - Instance Creation source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateTask supported_TA: diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index bcc8f0593c..72674a589d 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateVirtualMFADevice supported_TA: diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index 9c87fc438a..170e2b9b24 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeactivateMFADevice supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index 4364c10000..bea139be61 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteAccountPasswordPolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index 9aa2841257..2467c9ea67 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteAlarms supported_TA: diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 39d29d1a6f..9c85a790eb 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteDetector supported_TA: diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index d190093d91..e563fa4380 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteGroup supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index bcf4fd5f84..5d2a1aaf09 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteGuardrail supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 6cb149284f..c9fc821da1 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -11,6 +11,9 @@ mitre_components: - Firewall Rule Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteIPSet supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 0bacc4bbb4..563d9067e5 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteKnowledgeBase supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index d8aa0af29a..cf18367c2d 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteLoggingConfiguration source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index 32a576295d..1a5a06393a 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteLogGroup supported_TA: diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index fb8e5147f6..1ac5c7778c 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteLogStream supported_TA: diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 6518df5b56..55ce10bf35 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 26b3ce7198..8e68bad21a 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteNetworkAclEntry supported_TA: diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index f5c3a384fe..4367b3523b 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeletePolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 95f67eb714..778abfffea 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteRule supported_TA: diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index 888baf1d85..359dd39c1c 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteRuleGroup source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index e8eb028bb9..f4a3e01795 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteSnapshot supported_TA: diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 2a0af88997..4dd19ddf20 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteTrail supported_TA: diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index bd587aed86..593c0c093e 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Deletion source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteVirtualMFADevice supported_TA: diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 3d389b31f6..9151874866 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteWebACL supported_TA: diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 5aa835619d..a0a13062a6 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DescribeEventAggregates supported_TA: diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index 191afb2bce..ee06d2efeb 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -11,6 +11,9 @@ mitre_components: - Malware Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DescribeImageScanFindings supported_TA: diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index e31315d18c..79b72d6173 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DescribeSnapshotAttribute source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 27e9e0b3f1..6ded4f8d5e 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: GetAccountPasswordPolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index 160dfe1db5..5c150591ee 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Storage Enumeration source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: GetObject supported_TA: diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 4c419b3a63..d6a8e6b74d 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Authentication source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: GetPasswordData supported_TA: diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index d2d1b63ce6..87225be741 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Usage source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: InvokeModel supported_TA: diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index c421ba7cb9..52a11f4967 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: JobCreated supported_TA: diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index f3898a6679..210646a018 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Discovery source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ListFoundationModels supported_TA: diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index 3613f843e8..5a2b16da3e 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -11,6 +11,9 @@ mitre_components: - Instance Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ModifyDBInstance supported_TA: diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index 4d47df2492..356c63b74e 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -10,6 +10,9 @@ mitre_components: - Image Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ModifyImageAttribute supported_TA: diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 1027f7c5f2..08ce737376 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -9,6 +9,9 @@ mitre_components: - Snapshot Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ModifySnapshotAttribute supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 4877ea119c..40d88f348f 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Storage Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketAcl supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index daa93d4c05..cbec58e044 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Storage Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketLifecycle supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index 452914db25..516611d190 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Storage Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketReplication supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index ebcd3e95b4..a92a65401c 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Storage Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketVersioning supported_TA: diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index d95a8e337f..5889375394 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -10,6 +10,9 @@ mitre_components: - Image Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutImage supported_TA: diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 57b95d703a..5334a8ac65 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 40e4c9ae5d..d422593256 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ReplaceNetworkAclEntry supported_TA: diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index 83e554a5ca..0717466165 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: SetDefaultPolicyVersion supported_TA: diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index de9423c9c5..d8328a6529 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Disable source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: StopLogging supported_TA: diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 106b623c2c..7233c9b82d 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateAccountPasswordPolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index f62c9e6417..3a686ca306 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Authentication source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateLoginProfile supported_TA: diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index e8c6c5ae94..b3d461d0a5 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateSAMLProvider supported_TA: diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index c609919c95..1d22c743f8 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateTrail supported_TA: diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index b165f0ace8..5ae4b467ea 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -10,6 +10,10 @@ mitre_components: - Network Connection Creation source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow +logsource: + category: network + product: aws + service: vpcflow supported_TA: - name: Splunk Add-on for AWS version: 8.2.2 diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 64fc6abb3b..58cf923a85 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -12,112 +12,123 @@ mitre_components: - Cloud Service Disable source: aws_securityhub_finding sourcetype: aws:securityhub:finding +logsource: + product: aws supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 version: 8.2.2 fields: - - _time - - AwsAccountId - - CreatedAt - - Description - - FirstObservedAt - - GeneratorId - - Id - - LastObservedAt - - ProductArn - - ProductFields.aws/guardduty/service/action/actionType - - ProductFields.aws/guardduty/service/action/awsApiCallAction/affectedResources/AWS::S3::Bucket - - ProductFields.aws/guardduty/service/action/awsApiCallAction/api - - ProductFields.aws/guardduty/service/action/awsApiCallAction/callerType - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4 - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp - - ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org - - ProductFields.aws/guardduty/service/action/awsApiCallAction/serviceName - - ProductFields.aws/guardduty/service/additionalInfo/sample - - ProductFields.aws/guardduty/service/additionalInfo/unusual/hoursOfDay.0_ - - ProductFields.aws/guardduty/service/additionalInfo/unusual/userNames.0_ - - ProductFields.aws/guardduty/service/archived - - ProductFields.aws/guardduty/service/count - - ProductFields.aws/guardduty/service/detectorId - - ProductFields.aws/guardduty/service/eventFirstSeen - - ProductFields.aws/guardduty/service/eventLastSeen - - ProductFields.aws/guardduty/service/resourceRole - - ProductFields.aws/guardduty/service/serviceName - - ProductFields.aws/securityhub/CompanyName - - ProductFields.aws/securityhub/FindingId - - ProductFields.aws/securityhub/ProductName - - RecordState - - Resources{}.Details.AwsEc2Instance.IamInstanceProfileArn - - Resources{}.Details.AwsEc2Instance.ImageId - - Resources{}.Details.AwsEc2Instance.IpV4Addresses{} - - Resources{}.Details.AwsEc2Instance.LaunchedAt - - Resources{}.Details.AwsEc2Instance.SubnetId - - Resources{}.Details.AwsEc2Instance.Type - - Resources{}.Details.AwsEc2Instance.VpcId - - Resources{}.Details.AwsIamAccessKey.PrincipalId - - Resources{}.Details.AwsIamAccessKey.PrincipalName - - Resources{}.Details.AwsIamAccessKey.PrincipalType - - Resources{}.Details.AwsS3Bucket.CreatedAt - - Resources{}.Details.AwsS3Bucket.OwnerId - - Resources{}.Details.AwsS3Bucket.ServerSideEncryptionConfiguration.Rules{}.ApplyServerSideEncryptionByDefault.KMSMasterKeyID - - Resources{}.Details.AwsS3Bucket.ServerSideEncryptionConfiguration.Rules{}.ApplyServerSideEncryptionByDefault.SSEAlgorithm - - Resources{}.Id - - Resources{}.Partition - - Resources{}.Region - - Resources{}.Tags.GeneratedFindingInstaceTag1 - - Resources{}.Tags.GeneratedFindingInstaceTag2 - - Resources{}.Tags.GeneratedFindingInstaceTag3 - - Resources{}.Tags.GeneratedFindingInstaceTag4 - - Resources{}.Tags.GeneratedFindingInstaceTag5 - - Resources{}.Tags.GeneratedFindingInstaceTag6 - - Resources{}.Tags.GeneratedFindingInstaceTag7 - - Resources{}.Tags.GeneratedFindingInstaceTag8 - - Resources{}.Tags.GeneratedFindingInstaceTag9 - - Resources{}.Tags.foo - - Resources{}.Type - - SchemaVersion - - Severity.Label - - Severity.Normalized - - Severity.Product - - SourceUrl - - Title - - Types{} - - UpdatedAt - - Workflow.Status - - WorkflowState - - accesskey_extract - - app - - body - - description - - dest - - dest_type - - eventtype - - host - - id - - index - - instance_extract - - linecount - - punct - - s3bucket_extract - - severity - - severity_id - - signature - - signature_id - - source - - sourcetype - - splunk_server - - subject - - tag - - tag::eventtype - - timestamp - - type - - vendor_account - - vendor_region -example_log: '{"ProductArn":"arn:aws:securityhub:us-east-1::product/aws/guardduty","Types":["Software and Configuration Checks/Exfiltration:S3.ObjectRead.Unusual"],"SourceUrl":"https://us-east-1.console.aws.amazon.com/guardduty/home?region=us-east-1#/findings?macros=current&fId=6aba6b696aea10606e8b336f68d98819","Description":"Principal GeneratedFindingUserName read objects from S3 bucket GeneratedFindingS3Bucket in an unusual way.","SchemaVersion":"2018-10-08","GeneratorId":"arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317","FirstObservedAt":"2020-09-28T22:26:15.636Z","CreatedAt":"2020-09-28T22:26:15.636Z","RecordState":"ACTIVE","Title":"Unusual reads of objects in S3 bucket GeneratedFindingS3Bucket.","Workflow":{"Status":"NEW"},"LastObservedAt":"2020-09-28T22:26:15.636Z","Severity":{"Normalized":20,"Label":"LOW","Product":2},"UpdatedAt":"2020-09-28T22:26:15.636Z","WorkflowState":"NEW","ProductFields":{"aws/guardduty/service/archived":"false","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg":"GeneratedFindingASNOrg","aws/guardduty/service/additionalInfo/unusual/userNames.0_":"GeneratedFindingUserName","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org":"GeneratedFindingORG","aws/guardduty/service/resourceRole":"TARGET","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp":"GeneratedFindingISP","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat":"0","aws/guardduty/service/count":"1","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4":"198.51.100.0","aws/guardduty/service/additionalInfo/sample":"true","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName":"GeneratedFindingCountryName","aws/guardduty/service/action/awsApiCallAction/callerType":"Remote IP","aws/guardduty/service/action/awsApiCallAction/serviceName":"GeneratedFindingAPIServiceName","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName":"GeneratedFindingCityName","aws/guardduty/service/action/awsApiCallAction/api":"GeneratedFindingAPIName","aws/guardduty/service/serviceName":"guardduty","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon":"0","aws/guardduty/service/detectorId":"48ba636359b884eb132865311fdeb317","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn":"-1","aws/guardduty/service/eventFirstSeen":"2020-09-28T22:26:15.636Z","aws/guardduty/service/action/awsApiCallAction/affectedResources/AWS::S3::Bucket":"GeneratedFindingS3Bucket","aws/guardduty/service/eventLastSeen":"2020-09-28T22:26:15.636Z","aws/guardduty/service/additionalInfo/unusual/hoursOfDay.0_":"1513609200000","aws/guardduty/service/action/actionType":"AWS_API_CALL","aws/securityhub/FindingId":"arn:aws:securityhub:us-east-1::product/aws/guardduty/arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317/finding/6aba6b696aea10606e8b336f68d98819","aws/securityhub/ProductName":"GuardDuty","aws/securityhub/CompanyName":"Amazon"},"AwsAccountId":"802684071507","Id":"arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317/finding/6aba6b696aea10606e8b336f68d98819","Resources":[{"Partition":"aws","Type":"AwsEc2Instance","Details":{"AwsEc2Instance":{"Type":"m3.xlarge","VpcId":"GeneratedFindingVPCId","ImageId":"ami-99999999","IpV4Addresses":["10.0.0.1","198.51.100.0"],"SubnetId":"GeneratedFindingSubnetId","LaunchedAt":"2016-08-02T02:05:06Z","IamInstanceProfileArn":"arn:aws:iam::802684071507:example/instance/profile"}},"Region":"us-east-1","Id":"arn:aws:ec2:us-east-1:802684071507:instance/i-99999999","Tags":{"GeneratedFindingInstaceTag7":"GeneratedFindingInstaceTagValue7","GeneratedFindingInstaceTag8":"GeneratedFindingInstaceTagValue8","GeneratedFindingInstaceTag9":"GeneratedFindingInstaceTagValue9","GeneratedFindingInstaceTag1":"GeneratedFindingInstaceValue1","GeneratedFindingInstaceTag2":"GeneratedFindingInstaceTagValue2","GeneratedFindingInstaceTag3":"GeneratedFindingInstaceTagValue3","GeneratedFindingInstaceTag4":"GeneratedFindingInstaceTagValue4","GeneratedFindingInstaceTag5":"GeneratedFindingInstaceTagValue5","GeneratedFindingInstaceTag6":"GeneratedFindingInstaceTagValue6"}},{"Partition":"aws","Type":"AwsIamAccessKey","Details":{"AwsIamAccessKey":{"PrincipalId":"GeneratedFindingPrincipalId","PrincipalName":"GeneratedFindingUserName","PrincipalType":"IAMUser"}},"Region":"us-east-1","Id":"AWS::IAM::AccessKey:GeneratedFindingAccessKeyId"},{"Partition":"aws","Type":"AwsS3Bucket","Details":{"AwsS3Bucket":{"OwnerId":"CanonicalId of Owner","CreatedAt":"2017-12-18T15:58:11.551Z","ServerSideEncryptionConfiguration":{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"SSEAlgorithm","KMSMasterKeyID":"arn:aws:kms:region:123456789012:key/key-id"}}]}}},"Region":"us-east-1","Id":"arn:aws:s3:::bucketName","Tags":{"foo":"bar"}}]}' +- _time +- AwsAccountId +- CreatedAt +- Description +- FirstObservedAt +- GeneratorId +- Id +- LastObservedAt +- ProductArn +- ProductFields.aws/guardduty/service/action/actionType +- ProductFields.aws/guardduty/service/action/awsApiCallAction/affectedResources/AWS::S3::Bucket +- ProductFields.aws/guardduty/service/action/awsApiCallAction/api +- ProductFields.aws/guardduty/service/action/awsApiCallAction/callerType +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4 +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp +- ProductFields.aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org +- ProductFields.aws/guardduty/service/action/awsApiCallAction/serviceName +- ProductFields.aws/guardduty/service/additionalInfo/sample +- ProductFields.aws/guardduty/service/additionalInfo/unusual/hoursOfDay.0_ +- ProductFields.aws/guardduty/service/additionalInfo/unusual/userNames.0_ +- ProductFields.aws/guardduty/service/archived +- ProductFields.aws/guardduty/service/count +- ProductFields.aws/guardduty/service/detectorId +- ProductFields.aws/guardduty/service/eventFirstSeen +- ProductFields.aws/guardduty/service/eventLastSeen +- ProductFields.aws/guardduty/service/resourceRole +- ProductFields.aws/guardduty/service/serviceName +- ProductFields.aws/securityhub/CompanyName +- ProductFields.aws/securityhub/FindingId +- ProductFields.aws/securityhub/ProductName +- RecordState +- Resources{}.Details.AwsEc2Instance.IamInstanceProfileArn +- Resources{}.Details.AwsEc2Instance.ImageId +- Resources{}.Details.AwsEc2Instance.IpV4Addresses{} +- Resources{}.Details.AwsEc2Instance.LaunchedAt +- Resources{}.Details.AwsEc2Instance.SubnetId +- Resources{}.Details.AwsEc2Instance.Type +- Resources{}.Details.AwsEc2Instance.VpcId +- Resources{}.Details.AwsIamAccessKey.PrincipalId +- Resources{}.Details.AwsIamAccessKey.PrincipalName +- Resources{}.Details.AwsIamAccessKey.PrincipalType +- Resources{}.Details.AwsS3Bucket.CreatedAt +- Resources{}.Details.AwsS3Bucket.OwnerId +- Resources{}.Details.AwsS3Bucket.ServerSideEncryptionConfiguration.Rules{}.ApplyServerSideEncryptionByDefault.KMSMasterKeyID +- Resources{}.Details.AwsS3Bucket.ServerSideEncryptionConfiguration.Rules{}.ApplyServerSideEncryptionByDefault.SSEAlgorithm +- Resources{}.Id +- Resources{}.Partition +- Resources{}.Region +- Resources{}.Tags.GeneratedFindingInstaceTag1 +- Resources{}.Tags.GeneratedFindingInstaceTag2 +- Resources{}.Tags.GeneratedFindingInstaceTag3 +- Resources{}.Tags.GeneratedFindingInstaceTag4 +- Resources{}.Tags.GeneratedFindingInstaceTag5 +- Resources{}.Tags.GeneratedFindingInstaceTag6 +- Resources{}.Tags.GeneratedFindingInstaceTag7 +- Resources{}.Tags.GeneratedFindingInstaceTag8 +- Resources{}.Tags.GeneratedFindingInstaceTag9 +- Resources{}.Tags.foo +- Resources{}.Type +- SchemaVersion +- Severity.Label +- Severity.Normalized +- Severity.Product +- SourceUrl +- Title +- Types{} +- UpdatedAt +- Workflow.Status +- WorkflowState +- accesskey_extract +- app +- body +- description +- dest +- dest_type +- eventtype +- host +- id +- index +- instance_extract +- linecount +- punct +- s3bucket_extract +- severity +- severity_id +- signature +- signature_id +- source +- sourcetype +- splunk_server +- subject +- tag +- tag::eventtype +- timestamp +- type +- vendor_account +- vendor_region +example_log: '{"ProductArn":"arn:aws:securityhub:us-east-1::product/aws/guardduty","Types":["Software + and Configuration Checks/Exfiltration:S3.ObjectRead.Unusual"],"SourceUrl":"https://us-east-1.console.aws.amazon.com/guardduty/home?region=us-east-1#/findings?macros=current&fId=6aba6b696aea10606e8b336f68d98819","Description":"Principal + GeneratedFindingUserName read objects from S3 bucket GeneratedFindingS3Bucket in + an unusual way.","SchemaVersion":"2018-10-08","GeneratorId":"arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317","FirstObservedAt":"2020-09-28T22:26:15.636Z","CreatedAt":"2020-09-28T22:26:15.636Z","RecordState":"ACTIVE","Title":"Unusual + reads of objects in S3 bucket GeneratedFindingS3Bucket.","Workflow":{"Status":"NEW"},"LastObservedAt":"2020-09-28T22:26:15.636Z","Severity":{"Normalized":20,"Label":"LOW","Product":2},"UpdatedAt":"2020-09-28T22:26:15.636Z","WorkflowState":"NEW","ProductFields":{"aws/guardduty/service/archived":"false","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg":"GeneratedFindingASNOrg","aws/guardduty/service/additionalInfo/unusual/userNames.0_":"GeneratedFindingUserName","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org":"GeneratedFindingORG","aws/guardduty/service/resourceRole":"TARGET","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp":"GeneratedFindingISP","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat":"0","aws/guardduty/service/count":"1","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4":"198.51.100.0","aws/guardduty/service/additionalInfo/sample":"true","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName":"GeneratedFindingCountryName","aws/guardduty/service/action/awsApiCallAction/callerType":"Remote + IP","aws/guardduty/service/action/awsApiCallAction/serviceName":"GeneratedFindingAPIServiceName","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName":"GeneratedFindingCityName","aws/guardduty/service/action/awsApiCallAction/api":"GeneratedFindingAPIName","aws/guardduty/service/serviceName":"guardduty","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon":"0","aws/guardduty/service/detectorId":"48ba636359b884eb132865311fdeb317","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn":"-1","aws/guardduty/service/eventFirstSeen":"2020-09-28T22:26:15.636Z","aws/guardduty/service/action/awsApiCallAction/affectedResources/AWS::S3::Bucket":"GeneratedFindingS3Bucket","aws/guardduty/service/eventLastSeen":"2020-09-28T22:26:15.636Z","aws/guardduty/service/additionalInfo/unusual/hoursOfDay.0_":"1513609200000","aws/guardduty/service/action/actionType":"AWS_API_CALL","aws/securityhub/FindingId":"arn:aws:securityhub:us-east-1::product/aws/guardduty/arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317/finding/6aba6b696aea10606e8b336f68d98819","aws/securityhub/ProductName":"GuardDuty","aws/securityhub/CompanyName":"Amazon"},"AwsAccountId":"802684071507","Id":"arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317/finding/6aba6b696aea10606e8b336f68d98819","Resources":[{"Partition":"aws","Type":"AwsEc2Instance","Details":{"AwsEc2Instance":{"Type":"m3.xlarge","VpcId":"GeneratedFindingVPCId","ImageId":"ami-99999999","IpV4Addresses":["10.0.0.1","198.51.100.0"],"SubnetId":"GeneratedFindingSubnetId","LaunchedAt":"2016-08-02T02:05:06Z","IamInstanceProfileArn":"arn:aws:iam::802684071507:example/instance/profile"}},"Region":"us-east-1","Id":"arn:aws:ec2:us-east-1:802684071507:instance/i-99999999","Tags":{"GeneratedFindingInstaceTag7":"GeneratedFindingInstaceTagValue7","GeneratedFindingInstaceTag8":"GeneratedFindingInstaceTagValue8","GeneratedFindingInstaceTag9":"GeneratedFindingInstaceTagValue9","GeneratedFindingInstaceTag1":"GeneratedFindingInstaceValue1","GeneratedFindingInstaceTag2":"GeneratedFindingInstaceTagValue2","GeneratedFindingInstaceTag3":"GeneratedFindingInstaceTagValue3","GeneratedFindingInstaceTag4":"GeneratedFindingInstaceTagValue4","GeneratedFindingInstaceTag5":"GeneratedFindingInstaceTagValue5","GeneratedFindingInstaceTag6":"GeneratedFindingInstaceTagValue6"}},{"Partition":"aws","Type":"AwsIamAccessKey","Details":{"AwsIamAccessKey":{"PrincipalId":"GeneratedFindingPrincipalId","PrincipalName":"GeneratedFindingUserName","PrincipalType":"IAMUser"}},"Region":"us-east-1","Id":"AWS::IAM::AccessKey:GeneratedFindingAccessKeyId"},{"Partition":"aws","Type":"AwsS3Bucket","Details":{"AwsS3Bucket":{"OwnerId":"CanonicalId + of Owner","CreatedAt":"2017-12-18T15:58:11.551Z","ServerSideEncryptionConfiguration":{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"SSEAlgorithm","KMSMasterKeyID":"arn:aws:kms:region:123456789012:key/key-id"}}]}}},"Region":"us-east-1","Id":"arn:aws:s3:::bucketName","Tags":{"foo":"bar"}}]}' +output_fields: +- dest +- user diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 2d23314af0..0a5c22e1fb 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -7,6 +7,9 @@ author: Patrick Bareiss, Splunk description: All Azure Active Directory events source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 9b4849dfc4..2ada493234 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add app role assignment to service principal supported_TA: diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index d33f35db27..576aad1476 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add member to role supported_TA: diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 23184c3e12..41e84097fa 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add owner to application supported_TA: diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index bbbac95edf..f7e1c71d91 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -12,6 +12,9 @@ mitre_components: - Active Directory Object Creation source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add service principal supported_TA: diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 5328a53ec2..48317ab685 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -12,6 +12,9 @@ mitre_components: - Configuration Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add unverified domain supported_TA: diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 7d826f5370..3d085c36c1 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -12,6 +12,9 @@ mitre_components: - Configuration Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Consent to application supported_TA: diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 8dec124377..546e673229 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Disable Strong Authentication supported_TA: diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 6dd0b04531..64f23d6b09 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -11,6 +11,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Enable account supported_TA: diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 1c33eb5297..cfe7d41493 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -11,6 +11,9 @@ mitre_components: - User Account Authentication source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Invite external user supported_TA: diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 87b07760be..55903c09e8 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -7,11 +7,37 @@ author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory MicrosoftGraphActivityLogs source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 version: 6.3.2 fields: - - _time -example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' +- _time +example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", + "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": + "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", + "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", + "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": + "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", + "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": + "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", + "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", + "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", + "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", + "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", + "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": + "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All + email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": + "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", + "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", + "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, + "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' +output_fields: +- dest +- user +- src +- vendor_account +- vendor_product diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 82caf1ffca..b8c869e667 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -7,131 +7,176 @@ author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory NonInteractiveUserSignInLogs source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: signinlogs separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 version: 6.3.2 fields: - - action - - additional_details - - app - - authentication_method - - authentication_service - - callerIpAddress - - category - - change_type - - command - - correlationId - - dataset_name - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - description - - dest - - dest_type - - duration - - durationMs - - dvc - - enabled - - eventtype - - host - - id - - index - - level - - linecount - - location - - object - - object_attrs - - object_category - - object_id - - object_path - - operationName - - operationVersion - - path_from_resourceId - - properties.C_Iat - - properties.C_Idtyp - - properties.UserPrincipalObjectID - - properties.__UDI_RequiredFields_EventTime - - properties.__UDI_RequiredFields_RegionScope - - properties.__UDI_RequiredFields_TenantId - - properties.__UDI_RequiredFields_UniqueId - - properties.apiVersion - - properties.appId - - properties.clientAuthMethod - - properties.clientRequestId - - properties.durationMs - - properties.identityProvider - - properties.ipAddress - - properties.location - - properties.operationId - - properties.requestId - - properties.requestMethod - - properties.requestUri - - properties.responseSizeBytes - - properties.responseStatusCode - - properties.resultReason - - properties.roles - - properties.scopes - - properties.signInActivityId - - properties.tenantId - - properties.timeGenerated - - properties.tokenIssuedAt - - properties.userAgent - - properties.userId - - properties.wids - - punct - - reason - - resourceId - - response_time - - result - - resultSignature - - result_id - - severity - - signature - - signature_id - - signinDateTime - - source - - sourcetype - - splunk_server - - splunk_server_group - - src - - src_ip - - src_user - - src_user_name - - src_user_type - - status - - tag - - tag::action - - tag::app - - tag::eventtype - - tag::object_category - - tenantId - - time - - timeendpos - - timestartpos - - user - - user_agent - - user_id - - user_name - - user_role - - user_type - - vendor_account - - vendor_product - - vendor_region - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time -example_log: '{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/95d19bda-09de-4d93-b7ae-acecd1e68186/providers/Microsoft.aadiam", "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "NonInteractiveUserSignInLogs", "tenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "resultType": "0", "resultSignature": "None", "durationMs": 0, "callerIpAddress": "34.1.3.194", "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "identity": "User30", "Level": 4, "location": "US", "properties": {"id": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "createdDateTime": "2023-01-12T19:22:14.5285742+00:00", "userDisplayName": "User30", "userPrincipalName": "user30@splunkresearch.com", "userId": "40b61050-e814-4ae5-8ffe-66b6f0c53998", "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", "ipAddress": "34.1.3.194", "status": {"errorCode": 0, "additionalDetails": "MFA requirement satisfied by claim in the token"}, "clientAppUsed": "Browser", "deviceDetail": {"deviceId": "", "operatingSystem": "Windows", "browser": "Rich Client 4.43.0.0"}, "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": {"latitude": 45.73722839355469, "longitude": -119.81143188476562}}, "mfaDetail": {}, "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "conditionalAccessStatus": "notApplied", "appliedConditionalAccessPolicies": [{"id": "SecurityDefaults", "displayName": "Security Defaults", "enforcedGrantControls": [], "enforcedSessionControls": [], "result": "success", "conditionsSatisfied": 3, "conditionsNotSatisfied": 0}], "authenticationContextClassReferences": [], "originalRequestId": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "isInteractive": false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Oauth Scope Info", "value": "[\"OfficeHome.All\"]"}, {"key": "Is CAE Token", "value": "False"}], "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": 192, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "resourceTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "homeTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "authenticationDetails": [{"authenticationStepDateTime": "2023-01-12T19:22:14.5285742+00:00", "authenticationMethod": "Previously satisfied", "succeeded": true, "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token", "authenticationStepRequirement": "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": "user", "detail": "Per-user MFA"}], "authenticationRequirement": "multiFactorAuthentication", "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-_WUD4M1Rkyb-gOQwZiIAA", "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": 0}}' +- action +- additional_details +- app +- authentication_method +- authentication_service +- callerIpAddress +- category +- change_type +- command +- correlationId +- dataset_name +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- description +- dest +- dest_type +- duration +- durationMs +- dvc +- enabled +- eventtype +- host +- id +- index +- level +- linecount +- location +- object +- object_attrs +- object_category +- object_id +- object_path +- operationName +- operationVersion +- path_from_resourceId +- properties.C_Iat +- properties.C_Idtyp +- properties.UserPrincipalObjectID +- properties.__UDI_RequiredFields_EventTime +- properties.__UDI_RequiredFields_RegionScope +- properties.__UDI_RequiredFields_TenantId +- properties.__UDI_RequiredFields_UniqueId +- properties.apiVersion +- properties.appId +- properties.clientAuthMethod +- properties.clientRequestId +- properties.durationMs +- properties.identityProvider +- properties.ipAddress +- properties.location +- properties.operationId +- properties.requestId +- properties.requestMethod +- properties.requestUri +- properties.responseSizeBytes +- properties.responseStatusCode +- properties.resultReason +- properties.roles +- properties.scopes +- properties.signInActivityId +- properties.tenantId +- properties.timeGenerated +- properties.tokenIssuedAt +- properties.userAgent +- properties.userId +- properties.wids +- punct +- reason +- resourceId +- response_time +- result +- resultSignature +- result_id +- severity +- signature +- signature_id +- signinDateTime +- source +- sourcetype +- splunk_server +- splunk_server_group +- src +- src_ip +- src_user +- src_user_name +- src_user_type +- status +- tag +- tag::action +- tag::app +- tag::eventtype +- tag::object_category +- tenantId +- time +- timeendpos +- timestartpos +- user +- user_agent +- user_id +- user_name +- user_role +- user_type +- vendor_account +- vendor_product +- vendor_region +- _bkt +- _cd +- _eventtype_color +- _indextime +- _raw +- _serial +- _si +- _sourcetype +- _subsecond +- _time +example_log: '{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/95d19bda-09de-4d93-b7ae-acecd1e68186/providers/Microsoft.aadiam", + "operationName": "Sign-in activity", "operationVersion": "1.0", "category": "NonInteractiveUserSignInLogs", + "tenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", "resultType": "0", "resultSignature": + "None", "durationMs": 0, "callerIpAddress": "34.1.3.194", "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", + "identity": "User30", "Level": 4, "location": "US", "properties": {"id": "0f94f5fb-3583-4c46-9bfa-0390c1988800", + "createdDateTime": "2023-01-12T19:22:14.5285742+00:00", "userDisplayName": "User30", + "userPrincipalName": "user30@splunkresearch.com", "userId": "40b61050-e814-4ae5-8ffe-66b6f0c53998", + "appId": "4765445b-32c6-49b0-83e6-1d93765276ca", "appDisplayName": "OfficeHome", + "ipAddress": "34.1.3.194", "status": {"errorCode": 0, "additionalDetails": "MFA + requirement satisfied by claim in the token"}, "clientAppUsed": "Browser", "deviceDetail": + {"deviceId": "", "operatingSystem": "Windows", "browser": "Rich Client 4.43.0.0"}, + "location": {"city": "Boardman", "state": "Oregon", "countryOrRegion": "US", "geoCoordinates": + {"latitude": 45.73722839355469, "longitude": -119.81143188476562}}, "mfaDetail": + {}, "correlationId": "fc78e38c-1e61-4be3-b47d-f3e6a9724a65", "conditionalAccessStatus": + "notApplied", "appliedConditionalAccessPolicies": [{"id": "SecurityDefaults", "displayName": + "Security Defaults", "enforcedGrantControls": [], "enforcedSessionControls": [], + "result": "success", "conditionsSatisfied": 3, "conditionsNotSatisfied": 0}], "authenticationContextClassReferences": + [], "originalRequestId": "0f94f5fb-3583-4c46-9bfa-0390c1988800", "isInteractive": + false, "tokenIssuerName": "", "tokenIssuerType": "AzureAD", "authenticationProcessingDetails": + [{"key": "Legacy TLS (TLS 1.0, 1.1, 3DES)", "value": "False"}, {"key": "Oauth Scope + Info", "value": "[\"OfficeHome.All\"]"}, {"key": "Is CAE Token", "value": "False"}], + "networkLocationDetails": [], "clientCredentialType": "none", "processingTimeInMilliseconds": + 192, "riskDetail": "none", "riskLevelAggregated": "none", "riskLevelDuringSignIn": + "none", "riskState": "none", "riskEventTypes": [], "riskEventTypes_v2": [], "resourceDisplayName": + "OfficeHome", "resourceId": "4765445b-32c6-49b0-83e6-1d93765276ca", "resourceTenantId": + "95d19bda-09de-4d93-b7ae-acecd1e68186", "homeTenantId": "95d19bda-09de-4d93-b7ae-acecd1e68186", + "authenticationDetails": [{"authenticationStepDateTime": "2023-01-12T19:22:14.5285742+00:00", + "authenticationMethod": "Previously satisfied", "succeeded": true, "authenticationStepResultDetail": + "MFA requirement satisfied by claim in the token", "authenticationStepRequirement": + "Primary authentication"}], "authenticationRequirementPolicies": [{"requirementProvider": + "user", "detail": "Per-user MFA"}], "authenticationRequirement": "multiFactorAuthentication", + "servicePrincipalId": "", "userType": "Member", "flaggedForReview": false, "isTenantRestricted": + false, "autonomousSystemNumber": 16509, "crossTenantAccessType": "none", "privateLinkDetails": + {}, "ssoExtensionVersion": "", "uniqueTokenIdentifier": "-_WUD4M1Rkyb-gOQwZiIAA", + "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": + "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": + 0}}' +output_fields: +- dest +- user +- src +- vendor_account +- vendor_product diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 27824f1429..c38c823480 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -11,6 +11,9 @@ mitre_components: - Active Directory Object Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Reset password (by admin) supported_TA: diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index e3286081b2..9bc0f52646 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Set domain authentication supported_TA: diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index ad9f821776..cab34383cc 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -11,6 +11,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: signinlogs separator: operationName separator_value: Sign-in activity supported_TA: diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 8824c6cce7..618927ee99 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Update application supported_TA: diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 020e6ab111..37a8991679 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -11,6 +11,9 @@ mitre_components: - Active Directory Object Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Update authorization policy supported_TA: diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index c182874945..c5fc12ac3a 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Update user supported_TA: diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 4227fb1143..bb77e7d43c 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: User registered security info supported_TA: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 9cc05a766c..917dec77d8 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Metadata source: mscs:azure:audit sourcetype: mscs:azure:audit +logsource: + product: azure + service: activitylogs separator: operationName.localizedValue separator_value: Create or Update an Azure Automation account supported_TA: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 6c79156166..3f3a77f4ad 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -10,6 +10,9 @@ mitre_components: - Scheduled Job Creation source: mscs:azure:audit sourcetype: mscs:azure:audit +logsource: + product: azure + service: activitylogs separator: operationName.localizedValue separator_value: Create or Update an Azure Automation Runbook supported_TA: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index caa8c9ca1a..579290db69 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -11,6 +11,9 @@ mitre_components: - Scheduled Job Metadata source: mscs:azure:audit sourcetype: mscs:azure:audit +logsource: + product: azure + service: activitylogs separator: operationName.localizedValue separator_value: Create or Update an Azure Automation webhook supported_TA: diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 8aa47b20cf..1fc6229e05 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD sourcetype: azure:monitor:activity +logsource: + product: azure + service: activitylogs separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services diff --git a/data_sources/bro_conn.yml b/data_sources/bro_conn.yml index dbdfbb2d70..20c11b85e7 100644 --- a/data_sources/bro_conn.yml +++ b/data_sources/bro_conn.yml @@ -12,6 +12,10 @@ mitre_components: - Application Log Content source: bro:conn:json sourcetype: bro:conn:json +logsource: + category: network + product: zeek + service: connection supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_dns.yml b/data_sources/bro_dns.yml index 34d965b93b..3a2ca61002 100644 --- a/data_sources/bro_dns.yml +++ b/data_sources/bro_dns.yml @@ -13,6 +13,9 @@ mitre_components: - Response Metadata source: bro:dns:json sourcetype: bro:dns:json +logsource: + product: zeek + service: dns supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_files.yml b/data_sources/bro_files.yml index 66584c3a8e..86cd284afc 100644 --- a/data_sources/bro_files.yml +++ b/data_sources/bro_files.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: bro:files:json sourcetype: bro:files:json +logsource: + product: zeek + service: files supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_http.yml b/data_sources/bro_http.yml index caf5be37e9..8e8aeb9854 100644 --- a/data_sources/bro_http.yml +++ b/data_sources/bro_http.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: bro:http:json sourcetype: bro:http:json +logsource: + product: zeek + service: http supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_loaded_scripts.yml b/data_sources/bro_loaded_scripts.yml index bf2f3911a6..b0ac79b735 100644 --- a/data_sources/bro_loaded_scripts.yml +++ b/data_sources/bro_loaded_scripts.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: bro:loaded_scripts:json sourcetype: bro:loaded_scripts:json +logsource: + product: zeek + service: loaded_scripts supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_ntp.yml b/data_sources/bro_ntp.yml index f61526f6a4..d4230036f8 100644 --- a/data_sources/bro_ntp.yml +++ b/data_sources/bro_ntp.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: bro:ntp:json sourcetype: bro:ntp:json +logsource: + product: zeek + service: ntp supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_ocsp.yml b/data_sources/bro_ocsp.yml index f8df58b22e..bdf87652cd 100644 --- a/data_sources/bro_ocsp.yml +++ b/data_sources/bro_ocsp.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: bro:ocsp:json sourcetype: bro:ocsp:json +logsource: + product: zeek + service: ocsp supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_ssl.yml b/data_sources/bro_ssl.yml index b0d72a37a6..4dac9bc400 100644 --- a/data_sources/bro_ssl.yml +++ b/data_sources/bro_ssl.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: bro:ssl:json sourcetype: bro:ssl:json +logsource: + product: zeek + service: ssl supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_weird.yml b/data_sources/bro_weird.yml index f4b256f515..2466ef5851 100644 --- a/data_sources/bro_weird.yml +++ b/data_sources/bro_weird.yml @@ -13,6 +13,9 @@ mitre_components: - Host Status source: bro:weird:json sourcetype: bro:weird:json +logsource: + product: zeek + service: weird supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_x509.yml b/data_sources/bro_x509.yml index 334905a1fb..34322fda0c 100644 --- a/data_sources/bro_x509.yml +++ b/data_sources/bro_x509.yml @@ -13,6 +13,9 @@ mitre_components: - Host Status source: bro:x509:json sourcetype: bro:x509:json +logsource: + product: zeek + service: x509 supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/circleci.yml b/data_sources/circleci.yml index 6974f4fcb7..b8ad6da9e3 100644 --- a/data_sources/circleci.yml +++ b/data_sources/circleci.yml @@ -13,6 +13,8 @@ mitre_components: - Host Status source: circleci sourcetype: circleci +logsource: + product: circleci supported_TA: - name: App for CircleCI url: https://splunkbase.splunk.com/app/5162 diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 1c672354b4..03a39f4b25 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -7,7 +7,10 @@ author: Bhavin Patel description: Data source object for Cisco AI Defense Alerts source: cisco_ai_defense sourcetype: cisco:ai:defense -separator: +logsource: + product: cisco + service: ai_defense +separator: null supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 61d0ec4d56..9d0bf4d1fd 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -7,7 +7,10 @@ author: Bhavin Patel, Splunk description: "Data source object for Cisco ASA system logs. Cisco ASA logs provide firewall operational and security telemetry (connection events, ACL denies, VPN events, NAT translations, and device health). Deploy the Splunk Add-on for Cisco ASA (TA-cisco_asa) on indexers/heavy forwarders and the Cisco ASA App on search heads for best parsing, CIM mapping, and dashboards. This data is ingested via SYSLOG. You must be ingesting Cisco ASA syslog data into your Splunk environment. To ensure all detections work, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk. A few analytics are designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId--1451069880. \n" source: not_applicable sourcetype: cisco:asa -separator: +logsource: + product: cisco + service: asa +separator: null supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 57f78a420b..37846d8bab 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -7,7 +7,10 @@ author: Patrick Bareiss, Splunk description: Data source object for Cisco Duo Activity source: cisco_duo sourcetype: cisco:duo:activity -separator: +logsource: + product: cisco + service: duo +separator: null supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index ba87861cc1..66942654ae 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -7,7 +7,10 @@ author: Patrick Bareiss, Splunk description: Data source object for Cisco Duo Administrator source: cisco_duo sourcetype: cisco:duo:administrator -separator: +logsource: + product: cisco + service: duo +separator: null supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index bf6b6c5e82..c8f60adcdb 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -7,7 +7,10 @@ author: Michael Haag, Splunk description: Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG. source: cisco:ios sourcetype: cisco:ios -separator: +logsource: + product: cisco + service: ios +separator: null supported_TA: - name: Cisco Networks Add-on url: https://splunkbase.splunk.com/app/1467 diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 2ed3fe0059..3645e3e9a1 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: "Captures detailed process connection events—including source and destination process metadata, execution lineage (ancestry), and Kubernetes workload context—generated by Cisco Isovalent instrumentation. Enables technical analysis of inter-process communications, container-level activity, and workload-specific network flows in cloud-native environments." source: not_applicable sourcetype: cisco:isovalent:processConnect +logsource: + category: network_connection + product: linux supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 53b8c8dcd6..3809276e83 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Logs process execution events within Cisco Isovalent environments, providing visibility into process exec ancestry and Kubernetes workload identity. source: not_applicable sourcetype: cisco:isovalent:processExec +logsource: + category: process_creation + product: linux supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 82e8b8c3d4..b5448fa363 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -7,6 +7,8 @@ author: Bhavin Patel, Splunk description: Captures kernel probe (kprobe) telemetry from Cisco Isovalent Runtime Security, including function name, arguments, and process context, enabling visibility into low-level kernel interactions that may indicate container escape attempts or system tampering. source: not_applicable sourcetype: cisco:isovalent +logsource: + product: linux supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index 402fddfdd5..a3f6ba8859 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -6,7 +6,11 @@ modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk description: Data source object for Netflow events from Cisco Network Visibility Module source: not_applicable -sourcetype: cisco:nvm:flowdata:v2 +sourcetype: cisco:nvm:flowdata +logsource: + category: network + product: cisco + service: netflow supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 569f2e8972..a02b3c434f 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -6,7 +6,9 @@ modification_date: '2026-07-14' author: Nasreddine Bencherchali, Splunk description: Data source object for OSquery events from Cisco Network Visibility Module source: not_applicable -sourcetype: cisco:nvm:osquery:v2 +sourcetype: cisco:nvm:osquery +logsource: + product: osquery supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_sd_wan_auth_log.yml b/data_sources/cisco_sd_wan_auth_log.yml index eeed82261e..d3374ce584 100644 --- a/data_sources/cisco_sd_wan_auth_log.yml +++ b/data_sources/cisco_sd_wan_auth_log.yml @@ -7,6 +7,9 @@ author: Teoderick Contreras, Splunk description: Data source object for Cisco SD-WAN Auth logs source: /var/log/auth.log sourcetype: cisco:sdwan:syslog +logsource: + product: cisco + service: syslog supported_TA: [] fields: - _time diff --git a/data_sources/cisco_sd_wan_ntce_1000001.yml b/data_sources/cisco_sd_wan_ntce_1000001.yml index 960886370c..314c8b9e50 100644 --- a/data_sources/cisco_sd_wan_ntce_1000001.yml +++ b/data_sources/cisco_sd_wan_ntce_1000001.yml @@ -7,6 +7,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for Cisco SD-WAN Notification Event 1000001 source: /var/log/vsyslog sourcetype: cisco:sdwan:syslog +logsource: + product: cisco + service: syslog supported_TA: [] fields: - _time diff --git a/data_sources/cisco_sd_wan_service_proxy_access_logs.yml b/data_sources/cisco_sd_wan_service_proxy_access_logs.yml index 81b1707d51..3e9b0ef983 100644 --- a/data_sources/cisco_sd_wan_service_proxy_access_logs.yml +++ b/data_sources/cisco_sd_wan_service_proxy_access_logs.yml @@ -7,6 +7,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for Cisco SD-WAN Service Proxy Access Logs source: /var/log/nms/containers/service-proxy/serviceproxy-access.log sourcetype: cisco:sdwan:access +logsource: + category: webserver + product: cisco supported_TA: [] fields: - _time diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index e1ce31ca6d..f6e9eccb13 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -9,6 +9,9 @@ description: | This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. source: not_applicable sourcetype: cisco:cloud_security:dns +logsource: + category: dns + product: cisco supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index 4faa2e264e..90bb6dbdf7 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Captures firewall connection events from Cisco Secure Access including user identity, source and destination metadata, protocol details, and session statistics. Enables analysis of network traffic patterns, access policy enforcement, brute force attempts, and anomalous connection behavior across cloud-managed network access infrastructure. source: cisco_secure_access:firewall sourcetype: cisco:cloud_security:firewall +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index 1c96a73ef5..aed12c7d3c 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -9,6 +9,9 @@ description: | This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:proxy +logsource: + category: proxy + product: cisco supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 3a199b6f48..662acbccc1 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -7,6 +7,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for raw connection events from Cisco Secure Firewall Threat Defense source: not_applicable sourcetype: cisco:sfw:estreamer +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index 84d09c5837..8e8dae63de 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -7,6 +7,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for raw file events from Cisco Secure Firewall Threat Defense source: not_applicable sourcetype: cisco:sfw:estreamer +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index db18b5a342..35b99d1c35 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -7,6 +7,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for raw intrusion events from Cisco Secure Firewall Threat Defense source: not_applicable sourcetype: cisco:sfw:estreamer +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 2ff079b443..7159340d29 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -13,6 +13,8 @@ mitre_components: - OS API Execution source: CrowdStrike:Event:Streams sourcetype: CrowdStrike:Event:Streams:JSON +logsource: + product: crowdstrike separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index a44d6511ad..16f8ba333f 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: crowdstrike sourcetype: crowdstrike:events:sensor +logsource: + category: process_creation + product: windows separator: event_simpleName separator_value: ProcessRollup2 supported_TA: diff --git a/data_sources/crushftp.yml b/data_sources/crushftp.yml index 126097a4b8..69ef9c9d67 100644 --- a/data_sources/crushftp.yml +++ b/data_sources/crushftp.yml @@ -13,6 +13,8 @@ mitre_components: - Network Traffic Content source: crushftp sourcetype: crushftp:sessionlogs +logsource: + product: crushftp supported_TA: [] fields: - _time diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index fb7e5f1b31..9ff21ac690 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -13,40 +13,59 @@ mitre_components: - Cloud Storage Metadata source: http:gsuite sourcetype: gsuite:drive:json +logsource: + product: gcp supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 version: 5.0.1 fields: - - _time - - email - - host - - index - - ip_address - - linecount - - name - - parameters.actor_is_collaborator_account - - parameters.billable - - parameters.doc_id - - parameters.doc_title - - parameters.doc_type - - parameters.is_encrypted - - parameters.new_value{} - - parameters.old_value{} - - parameters.old_visibility - - parameters.originating_app_id - - parameters.owner - - parameters.owner_is_shared_drive - - parameters.owner_is_team_drive - - parameters.primary_event - - parameters.target_user - - parameters.visibility - - parameters.visibility_change - - punct - - source - - sourcetype - - splunk_server - - timestamp - - type - - unique_id -example_log: '{"type": "acl_change", "name": "change_user_access", "parameters": {"primary_event": true, "billable": true, "visibility_change": "none", "target_user": "alberto@internal_test_email.com", "old_value": ["none"], "new_value": ["can_edit"], "old_visibility": "private", "doc_id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "doc_type": "spreadsheet", "is_encrypted": false, "doc_title": "Invoice-11111 FedEx - Delivery - Dummy Detection POC", "visibility": "shared_internally", "originating_app_id": "000000000001", "actor_is_collaborator_account": false, "owner": "peter@external_test_email.com", "owner_is_shared_drive": false, "owner_is_team_drive": false}, "email": "peter@external_test_email.com", "unique_id": "123456789", "ip_address": "null", "timestamp": "2021-08-23T09:19:08.200Z"}' +- _time +- email +- host +- index +- ip_address +- linecount +- name +- parameters.actor_is_collaborator_account +- parameters.billable +- parameters.doc_id +- parameters.doc_title +- parameters.doc_type +- parameters.is_encrypted +- parameters.new_value{} +- parameters.old_value{} +- parameters.old_visibility +- parameters.originating_app_id +- parameters.owner +- parameters.owner_is_shared_drive +- parameters.owner_is_team_drive +- parameters.primary_event +- parameters.target_user +- parameters.visibility +- parameters.visibility_change +- punct +- source +- sourcetype +- splunk_server +- timestamp +- type +- unique_id +example_log: '{"type": "acl_change", "name": "change_user_access", "parameters": {"primary_event": + true, "billable": true, "visibility_change": "none", "target_user": "alberto@internal_test_email.com", + "old_value": ["none"], "new_value": ["can_edit"], "old_visibility": "private", "doc_id": + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "doc_type": "spreadsheet", "is_encrypted": + false, "doc_title": "Invoice-11111 FedEx - Delivery - Dummy Detection POC", "visibility": + "shared_internally", "originating_app_id": "000000000001", "actor_is_collaborator_account": + false, "owner": "peter@external_test_email.com", "owner_is_shared_drive": false, + "owner_is_team_drive": false}, "email": "peter@external_test_email.com", "unique_id": + "123456789", "ip_address": "null", "timestamp": "2021-08-23T09:19:08.200Z"}' +output_fields: +- parameters.owner +- ip_address +- phase +- severity +- email +- parameters.target_user +- parameters.doc_title +- parameters.doc_type diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 2c599a4533..669a967998 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -12,79 +12,114 @@ mitre_components: - Cloud Service Metadata source: http:gsuite sourcetype: gsuite:gmail:bigquery +logsource: + product: gcp supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 version: 5.0.1 fields: - - _time - - action_type - - attachment{}.file_extension_type - - attachment{}.malware_family - - attachment{}.sha256 - - connection_info.authenticated_domain{}.name - - connection_info.authenticated_domain{}.type - - connection_info.client_host_zone - - connection_info.client_ip - - connection_info.dkim_pass - - connection_info.dmarc_pass - - connection_info.dmarc_published_domain - - connection_info.ip_geo_city - - connection_info.ip_geo_country - - connection_info.is_internal - - connection_info.is_intra_domain - - connection_info.smtp_in_connect_ip - - connection_info.smtp_out_connect_ip - - connection_info.smtp_out_remote_host - - connection_info.smtp_reply_code - - connection_info.smtp_response_reason - - connection_info.smtp_tls_cipher - - connection_info.smtp_tls_state - - connection_info.smtp_tls_version - - connection_info.smtp_user_agent_ip - - connection_info.spf_pass - - connection_info.tls_required_but_unavailable - - description - - destination{}.address - - destination{}.rcpt_response - - destination{}.selector - - destination{}.service - - destination{}.smime_decryption_success - - destination{}.smime_extraction_success - - destination{}.smime_parsing_success - - destination{}.smime_signature_verification_success - - eventtype - - flattened_destinations - - flattened_triggered_rule_info - - host - - index - - is_policy_check_for_sender - - is_spam - - linecount - - message_set{}.type - - num_message_attachments - - payload_size - - punct - - rfc2822_message_id - - smime_content_type - - smime_encrypt_message - - smime_extraction_success - - smime_packaging_success - - smime_sign_message - - smtp_relay_error - - source - - source.address - - source.from_header_address - - source.from_header_displayname - - source.selector - - source.service - - sourcetype - - spam_info - - splunk_server - - structured_policy_log_info - - subject - - tag - - tag::eventtype - - timestamp - - upload_error_category -example_log: '{"action_type": 10, "rfc2822_message_id": "", "subject": "New Order DHL0000001 - Dummy email for Detection Development", "payload_size": 6733, "source": {"address": "john@external_test_email.com", "service": "gmail-for-work", "selector": "policy", "from_header_address": "john@external_test_email.com", "from_header_displayname": "john smith"}, "destination": [{"address": "peter@internal_test_email.com", "service": "smtp-outbound", "selector": "gmail-for-work", "smime_signature_verification_success": null, "smime_decryption_success": null, "smime_parsing_success": null, "smime_extraction_success": null, "rcpt_response": null}], "flattened_destinations": "smtp-outbound:gmail-for-work:peter@internal_test_email.com", "description": "", "connection_info": {"client_ip": "null", "smtp_in_connect_ip": null, "smtp_out_connect_ip": "null", "failed_smtp_out_connect_ip": [], "smtp_tls_state": 1, "smtp_reply_code": 250, "tls_required_but_unavailable": false, "smtp_out_remote_host": "internal_test_app.com", "smtp_user_agent_ip": "null", "is_intra_domain": false, "dmarc_pass": null, "dmarc_published_domain": null, "client_host_zone": null, "smtp_response_reason": null, "ip_geo_city": null, "ip_geo_country": null, "authenticated_domain": [{"name": "internal_test_email.com", "type": 2}, {"name": "internal_test_email.com", "type": 6}, {"name": "internal_test_email.com", "type": 1}], "is_internal": false, "dkim_pass": true, "spf_pass": true, "smtp_tls_version": "TLSv9.9", "smtp_tls_cipher": "TLS_AES"}, "is_spam": null, "is_policy_check_for_sender": false, "num_message_attachments": 1, "message_set": [{"type": 57}, {"type": 9}, {"type": 22}, {"type": 15}, {"type": 48}, {"type": 27}, {"type": 10}, {"type": 50}, {"type": 51}, {"type": 46}, {"type": 61}, {"type": 44}], "smtp_relay_error": null, "upload_error_category": null, "structured_policy_log_info": null, "triggered_rule_info": [], "flattened_triggered_rule_info": null, "smime_sign_message": null, "smime_encrypt_message": null, "smime_packaging_success": null, "smime_extraction_success": null, "smime_content_type": null, "link_domain": [], "attachment": [{"sha256": "1111111111111111111111111111111111111111111111111111111111111111", "file_extension_type": "zip", "malware_family": null}], "spam_info": null, "timestamp": 1629378633.802384}' +- _time +- action_type +- attachment{}.file_extension_type +- attachment{}.malware_family +- attachment{}.sha256 +- connection_info.authenticated_domain{}.name +- connection_info.authenticated_domain{}.type +- connection_info.client_host_zone +- connection_info.client_ip +- connection_info.dkim_pass +- connection_info.dmarc_pass +- connection_info.dmarc_published_domain +- connection_info.ip_geo_city +- connection_info.ip_geo_country +- connection_info.is_internal +- connection_info.is_intra_domain +- connection_info.smtp_in_connect_ip +- connection_info.smtp_out_connect_ip +- connection_info.smtp_out_remote_host +- connection_info.smtp_reply_code +- connection_info.smtp_response_reason +- connection_info.smtp_tls_cipher +- connection_info.smtp_tls_state +- connection_info.smtp_tls_version +- connection_info.smtp_user_agent_ip +- connection_info.spf_pass +- connection_info.tls_required_but_unavailable +- description +- destination{}.address +- destination{}.rcpt_response +- destination{}.selector +- destination{}.service +- destination{}.smime_decryption_success +- destination{}.smime_extraction_success +- destination{}.smime_parsing_success +- destination{}.smime_signature_verification_success +- eventtype +- flattened_destinations +- flattened_triggered_rule_info +- host +- index +- is_policy_check_for_sender +- is_spam +- linecount +- message_set{}.type +- num_message_attachments +- payload_size +- punct +- rfc2822_message_id +- smime_content_type +- smime_encrypt_message +- smime_extraction_success +- smime_packaging_success +- smime_sign_message +- smtp_relay_error +- source +- source.address +- source.from_header_address +- source.from_header_displayname +- source.selector +- source.service +- sourcetype +- spam_info +- splunk_server +- structured_policy_log_info +- subject +- tag +- tag::eventtype +- timestamp +- upload_error_category +example_log: '{"action_type": 10, "rfc2822_message_id": "", + "subject": "New Order DHL0000001 - Dummy email for Detection Development", "payload_size": + 6733, "source": {"address": "john@external_test_email.com", "service": "gmail-for-work", + "selector": "policy", "from_header_address": "john@external_test_email.com", "from_header_displayname": + "john smith"}, "destination": [{"address": "peter@internal_test_email.com", "service": + "smtp-outbound", "selector": "gmail-for-work", "smime_signature_verification_success": + null, "smime_decryption_success": null, "smime_parsing_success": null, "smime_extraction_success": + null, "rcpt_response": null}], "flattened_destinations": "smtp-outbound:gmail-for-work:peter@internal_test_email.com", + "description": "", "connection_info": {"client_ip": "null", "smtp_in_connect_ip": + null, "smtp_out_connect_ip": "null", "failed_smtp_out_connect_ip": [], "smtp_tls_state": + 1, "smtp_reply_code": 250, "tls_required_but_unavailable": false, "smtp_out_remote_host": + "internal_test_app.com", "smtp_user_agent_ip": "null", "is_intra_domain": false, + "dmarc_pass": null, "dmarc_published_domain": null, "client_host_zone": null, "smtp_response_reason": + null, "ip_geo_city": null, "ip_geo_country": null, "authenticated_domain": [{"name": + "internal_test_email.com", "type": 2}, {"name": "internal_test_email.com", "type": + 6}, {"name": "internal_test_email.com", "type": 1}], "is_internal": false, "dkim_pass": + true, "spf_pass": true, "smtp_tls_version": "TLSv9.9", "smtp_tls_cipher": "TLS_AES"}, + "is_spam": null, "is_policy_check_for_sender": false, "num_message_attachments": + 1, "message_set": [{"type": 57}, {"type": 9}, {"type": 22}, {"type": 15}, {"type": + 48}, {"type": 27}, {"type": 10}, {"type": 50}, {"type": 51}, {"type": 46}, {"type": + 61}, {"type": 44}], "smtp_relay_error": null, "upload_error_category": null, "structured_policy_log_info": + null, "triggered_rule_info": [], "flattened_triggered_rule_info": null, "smime_sign_message": + null, "smime_encrypt_message": null, "smime_packaging_success": null, "smime_extraction_success": + null, "smime_content_type": null, "link_domain": [], "attachment": [{"sha256": "1111111111111111111111111111111111111111111111111111111111111111", + "file_extension_type": "zip", "malware_family": null}], "spam_info": null, "timestamp": + 1629378633.802384}' +output_fields: +- phase +- severity +- destination{}.service +- num_message_attachments +- subject +- destination{}.address +- source.address diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index 266202314d..cbc010789a 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -7,27 +7,49 @@ author: Patrick Bareiss, Splunk description: Data source object for GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector. source: http:github sourcetype: httpevent +logsource: + product: github + service: audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 version: 4.0.0 fields: - - _document_id - - action - - actor - - actor_id - - actor_is_bot - - business - - business_id - - created_at - - operation_type - - org - - org_id - - public_repo - - repo - - repo_id - - request_access_security_header - - user - - user_agent - - user_id -example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 }' +- _document_id +- action +- actor +- actor_id +- actor_is_bot +- business +- business_id +- created_at +- operation_type +- org +- org_id +- public_repo +- repo +- repo_id +- request_access_security_header +- user +- user_agent +- user_id +example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: + repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: + 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: + 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 + public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: + null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) + AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 + }' +output_fields: +- actor +- actor_id +- actor_ip +- actor_is_bot +- actor_location.country_code +- business +- business_id +- org +- org_id +- user_agent +- action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index 1a187a6d09..2c56bac4e1 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -7,27 +7,51 @@ author: Patrick Bareiss, Splunk description: Data source object for GitHub Organizations logs using the Splunk Add-on for Github using a Personal Access Token. source: github sourcetype: github:cloud:audit +logsource: + product: github + service: audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 version: 4.0.0 fields: - - _document_id - - action - - actor - - actor_id - - actor_is_bot - - business - - business_id - - created_at - - operation_type - - org - - org_id - - public_repo - - repo - - repo_id - - request_access_security_header - - user - - user_agent - - user_id -example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 }' +- _document_id +- action +- actor +- actor_id +- actor_is_bot +- business +- business_id +- created_at +- operation_type +- org +- org_id +- public_repo +- repo +- repo_id +- request_access_security_header +- user +- user_agent +- user_id +example_log: '{ @timestamp: 1736850926658 _document_id: fHPRFHOMZNXLxTZrk1w2IQ action: + repository_vulnerability_alerts.disable actor: P4T12ICK actor_id: 8362376 actor_ip: + 84.128.62.13 actor_is_bot: false actor_location: { [+] } business: pb business_id: + 273781 created_at: 1736850926658 operation_type: modify org: pbtest2 org_id: 194489467 + public_repo: false repo: pbtest2/pbtest5 repo_id: 916529548 request_access_security_header: + null user: P4T12ICK user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) + AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 user_id: 8362376 + }' +output_fields: +- actor +- actor_id +- actor_ip +- actor_is_bot +- actor_location.country_code +- business +- business_id +- org +- org_id +- repo +- repo_id +- user_agent +- vendor_action diff --git a/data_sources/github_webhooks.yml b/data_sources/github_webhooks.yml index bdf206507c..220ce3ee6d 100644 --- a/data_sources/github_webhooks.yml +++ b/data_sources/github_webhooks.yml @@ -13,6 +13,8 @@ mitre_components: - Scheduled Job Metadata source: github sourcetype: aws:firehose:json +logsource: + product: github supported_TA: [] fields: - _time diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index 8459c1a0de..12c1efd352 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -7,95 +7,110 @@ author: Bhavin Patel, Splunk description: Data source object for Google Workspace source: google_workspace sourcetype: gws:reports:login +logsource: + product: gcp + service: google_workspace.admin supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 version: 5.0.1 fields: - - action - - actor.callerType - - actor.email - - actor.profileId - - app - - change_type - - command - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - dest - - dest_name - - dest_url - - dvc - - email - - etag - - event.name - - event.parameters{}.name - - event.parameters{}.value - - event.type - - eventtype - - filter_action - - host - - id.applicationName - - id.customerId - - id.time - - id.uniqueQualifier - - index - - internal_message_id - - ipAddress - - kind - - linecount - - message_id - - object - - object_attrs - - object_category - - object_id - - object_path - - owner - - owner_email - - protocol - - punct - - result - - result_id - - signature_extra - - source - - sourcetype - - splunk_server - - splunk_server_group - - src - - src_user - - src_user_id - - src_user_name - - src_user_type - - status - - tag - - tag::action - - tag::app - - tag::eventtype - - tag::object_category - - tenant_id - - timeendpos - - timestartpos - - user - - user_email - - user_email_extracted - - user_id - - user_name - - user_type - - vendor_account - - vendor_product - - _bkt - - _cd - - _eventtype_color - - _indextime - - _raw - - _serial - - _si - - _sourcetype - - _subsecond - - _time -example_log: '"kind": "admin#reports#activity", "id": {"time": "2022-10-12T18:00:23.093Z", "uniqueQualifier": "-7844406841853338111", "applicationName": "admin", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/afZBU3WDeiuPqFyleWyTnwyU3fE\"", "actor": {"callerType": "USER", "email": "evil_admin@splunkresearch.com", "profileId": "100059258581444193973"}, "ipAddress": "22.33.111.55", "event": {"type": "USER_SETTINGS", "name": "UNENROLL_USER_FROM_STRONG_AUTH", "parameters": [{"name": "USER_EMAIL", "value": "victim_user@splunkresearch.com"}]}}' +- action +- actor.callerType +- actor.email +- actor.profileId +- app +- change_type +- command +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- dest +- dest_name +- dest_url +- dvc +- email +- etag +- event.name +- event.parameters{}.name +- event.parameters{}.value +- event.type +- eventtype +- filter_action +- host +- id.applicationName +- id.customerId +- id.time +- id.uniqueQualifier +- index +- internal_message_id +- ipAddress +- kind +- linecount +- message_id +- object +- object_attrs +- object_category +- object_id +- object_path +- owner +- owner_email +- protocol +- punct +- result +- result_id +- signature_extra +- source +- sourcetype +- splunk_server +- splunk_server_group +- src +- src_user +- src_user_id +- src_user_name +- src_user_type +- status +- tag +- tag::action +- tag::app +- tag::eventtype +- tag::object_category +- tenant_id +- timeendpos +- timestartpos +- user +- user_email +- user_email_extracted +- user_id +- user_name +- user_type +- vendor_account +- vendor_product +- _bkt +- _cd +- _eventtype_color +- _indextime +- _raw +- _serial +- _si +- _sourcetype +- _subsecond +- _time +example_log: '"kind": "admin#reports#activity", "id": {"time": "2022-10-12T18:00:23.093Z", + "uniqueQualifier": "-7844406841853338111", "applicationName": "admin", "customerId": + "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/afZBU3WDeiuPqFyleWyTnwyU3fE\"", + "actor": {"callerType": "USER", "email": "evil_admin@splunkresearch.com", "profileId": + "100059258581444193973"}, "ipAddress": "22.33.111.55", "event": {"type": "USER_SETTINGS", + "name": "UNENROLL_USER_FROM_STRONG_AUTH", "parameters": [{"name": "USER_EMAIL", + "value": "victim_user@splunkresearch.com"}]}}' +output_fields: +- user +- src_ip +- vendor_account +- event.name +- action diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index 4e26bd7ec6..850caffd47 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: gws:reports:admin sourcetype: gws:reports:admin +logsource: + product: gcp + service: google_workspace.login separator: event.name separator_value: login_failure supported_TA: @@ -19,39 +22,49 @@ supported_TA: url: https://splunkbase.splunk.com/app/5556 version: 5.0.1 fields: - - _time - - actor.email - - actor.profileId - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - etag - - event.name - - event.parameters{}.multiValue{} - - event.parameters{}.name - - event.parameters{}.value - - event.type - - eventtype - - host - - id.applicationName - - id.customerId - - id.time - - id.uniqueQualifier - - index - - ipAddress - - kind - - linecount - - punct - - source - - sourcetype - - splunk_server - - tag - - tag::eventtype - - timeendpos - - timestartpos -example_log: '{"kind": "admin#reports#activity", "id": {"time": "2022-10-12T01:05:35.119Z", "uniqueQualifier": "720229394436", "applicationName": "login", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/_lixtTooT11WXorGf6w6ElN0m0g\"", "actor": {"email": "user29@daftpunk.com", "profileId": "114679690119024644513"}, "ipAddress": "141.254.89.27", "event": {"type": "login", "name": "login_failure", "parameters": [{"name": "login_type", "value": "unknown"}, {"name": "login_challenge_method", "multiValue": ["password"]}]}}' +- _time +- actor.email +- actor.profileId +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- etag +- event.name +- event.parameters{}.multiValue{} +- event.parameters{}.name +- event.parameters{}.value +- event.type +- eventtype +- host +- id.applicationName +- id.customerId +- id.time +- id.uniqueQualifier +- index +- ipAddress +- kind +- linecount +- punct +- source +- sourcetype +- splunk_server +- tag +- tag::eventtype +- timeendpos +- timestartpos +example_log: '{"kind": "admin#reports#activity", "id": {"time": "2022-10-12T01:05:35.119Z", + "uniqueQualifier": "720229394436", "applicationName": "login", "customerId": "C046r85ir"}, + "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/_lixtTooT11WXorGf6w6ElN0m0g\"", + "actor": {"email": "user29@daftpunk.com", "profileId": "114679690119024644513"}, + "ipAddress": "141.254.89.27", "event": {"type": "login", "name": "login_failure", + "parameters": [{"name": "login_type", "value": "unknown"}, {"name": "login_challenge_method", + "multiValue": ["password"]}]}}' +output_fields: +- user +- src_ip +- login_challenge_method diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 5701798e57..43d970c658 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -12,6 +12,9 @@ mitre_components: - Logon Session Metadata source: gws:reports:admin sourcetype: gws:reports:admin +logsource: + product: gcp + service: google_workspace.login separator: event.name separator_value: login_success supported_TA: diff --git a/data_sources/ivanti_vtm_audit.yml b/data_sources/ivanti_vtm_audit.yml index 63b0b6d52f..0f41ec4c45 100644 --- a/data_sources/ivanti_vtm_audit.yml +++ b/data_sources/ivanti_vtm_audit.yml @@ -13,6 +13,8 @@ mitre_components: - Service Modification source: ivanti_vtm sourcetype: ivanti_vtm_audit +logsource: + product: ivanti supported_TA: [] fields: - _time diff --git a/data_sources/kubernetes_audit.yml b/data_sources/kubernetes_audit.yml index 9b82b3e5cd..b2567e6dea 100644 --- a/data_sources/kubernetes_audit.yml +++ b/data_sources/kubernetes_audit.yml @@ -14,52 +14,73 @@ mitre_components: - Application Log Content source: kubernetes sourcetype: _json +logsource: + category: application + product: kubernetes + service: audit supported_TA: [] fields: - - _time - - annotations.authorization.k8s.io/decision - - annotations.authorization.k8s.io/reason - - apiVersion - - auditID - - eventtype - - host - - index - - kind - - level - - linecount - - objectRef.apiGroup - - objectRef.apiVersion - - objectRef.namespace - - objectRef.resource - - punct - - requestReceivedTimestamp - - requestURI - - responseObject.apiVersion - - responseObject.code - - responseObject.details.group - - responseObject.details.kind - - responseObject.kind - - responseObject.message - - responseObject.reason - - responseObject.status - - responseStatus.code - - responseStatus.details.group - - responseStatus.details.kind - - responseStatus.message - - responseStatus.reason - - responseStatus.status - - source - - sourceIPs{} - - sourcetype - - splunk_server - - stage - - stageTimestamp - - tag - - tag::eventtype - - timestamp - - user.groups{} - - user.uid - - user.username - - userAgent - - verb -example_log: '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"582c31ab-4906-49bb-9ff9-872f980ccb84","stage":"ResponseComplete","requestURI":"/apis/batch/v1/namespaces/test2/jobs?fieldManager=kubectl-create\u0026fieldValidation=Strict","verb":"create","user":{"username":"k8s-test-user","uid":"aws-iam-authenticator:111111111111:AROAYTXXXXXXHNXXXXX","groups":["system:authenticated"]},"sourceIPs":["176.95.188.101"],"userAgent":"kubectl/v1.27.2 (darwin/arm64) kubernetes/7f6f68f","objectRef":{"resource":"jobs","namespace":"test2","apiGroup":"batch","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"jobs.batch is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"responseObject":{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"jobs.batch is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"requestReceivedTimestamp":"2023-12-07T14:44:53.358394Z","stageTimestamp":"2023-12-07T14:44:53.375985Z","annotations":{"authorization.k8s.io/decision":"forbid","authorization.k8s.io/reason":""}}' +- _time +- annotations.authorization.k8s.io/decision +- annotations.authorization.k8s.io/reason +- apiVersion +- auditID +- eventtype +- host +- index +- kind +- level +- linecount +- objectRef.apiGroup +- objectRef.apiVersion +- objectRef.namespace +- objectRef.resource +- punct +- requestReceivedTimestamp +- requestURI +- responseObject.apiVersion +- responseObject.code +- responseObject.details.group +- responseObject.details.kind +- responseObject.kind +- responseObject.message +- responseObject.reason +- responseObject.status +- responseStatus.code +- responseStatus.details.group +- responseStatus.details.kind +- responseStatus.message +- responseStatus.reason +- responseStatus.status +- source +- sourceIPs{} +- sourcetype +- splunk_server +- stage +- stageTimestamp +- tag +- tag::eventtype +- timestamp +- user.groups{} +- user.uid +- user.username +- userAgent +- verb +example_log: '{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"582c31ab-4906-49bb-9ff9-872f980ccb84","stage":"ResponseComplete","requestURI":"/apis/batch/v1/namespaces/test2/jobs?fieldManager=kubectl-create\u0026fieldValidation=Strict","verb":"create","user":{"username":"k8s-test-user","uid":"aws-iam-authenticator:111111111111:AROAYTXXXXXXHNXXXXX","groups":["system:authenticated"]},"sourceIPs":["176.95.188.101"],"userAgent":"kubectl/v1.27.2 + (darwin/arm64) kubernetes/7f6f68f","objectRef":{"resource":"jobs","namespace":"test2","apiGroup":"batch","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"jobs.batch + is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group + \"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"responseObject":{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"jobs.batch + is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group + \"batch\" in the namespace \"test2\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403},"requestReceivedTimestamp":"2023-12-07T14:44:53.358394Z","stageTimestamp":"2023-12-07T14:44:53.375985Z","annotations":{"authorization.k8s.io/decision":"forbid","authorization.k8s.io/reason":""}}' +output_fields: +- objectRef.name +- objectRef.namespace +- objectRef.resource +- responseStatus.code +- sourceIPs{} +- stage +- user.groups{} +- user.uid +- user.username +- userAgent +- verb diff --git a/data_sources/kubernetes_falco.yml b/data_sources/kubernetes_falco.yml index 96a234476a..f45f63ee2c 100644 --- a/data_sources/kubernetes_falco.yml +++ b/data_sources/kubernetes_falco.yml @@ -14,40 +14,54 @@ mitre_components: - Host Status source: kubernetes sourcetype: kube:container:falco +logsource: + product: falco supported_TA: [] fields: - - _time - - command - - container_id - - container_image - - container_image_tag - - container_name - - date_hour - - date_mday - - date_minute - - date_month - - date_second - - date_wday - - date_year - - date_zone - - evt_type - - exe_flags - - host - - index - - k8s_ns - - k8s_pod_name - - linecount - - parent - - proc_exepath - - process - - punct - - source - - sourcetype - - splunk_server - - terminal - - timeendpos - - timestartpos - - user - - user_loginuid - - user_uid -example_log: '12:18:18.691725165: Notice A shell was spawned in a container with an attached terminal (evt_type=execve user=root user_uid=0 user_loginuid=-1 process=bash proc_exepath=/usr/lib/splunk-otel-collector/agent-bundle/bin/bash parent=runc command=bash -il terminal=34816 exe_flags=EXE_WRITABLE container_id=7a2566e8e462 container_image=quay.io/signalfx/splunk-otel-collector container_image_tag=0.88.0 container_name=otel-collector k8s_ns=default k8s_pod_name=my-splunk-otel-collector-agent-9sdhr)' +- _time +- command +- container_id +- container_image +- container_image_tag +- container_name +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- evt_type +- exe_flags +- host +- index +- k8s_ns +- k8s_pod_name +- linecount +- parent +- proc_exepath +- process +- punct +- source +- sourcetype +- splunk_server +- terminal +- timeendpos +- timestartpos +- user +- user_loginuid +- user_uid +example_log: '12:18:18.691725165: Notice A shell was spawned in a container with an + attached terminal (evt_type=execve user=root user_uid=0 user_loginuid=-1 process=bash + proc_exepath=/usr/lib/splunk-otel-collector/agent-bundle/bin/bash parent=runc command=bash + -il terminal=34816 exe_flags=EXE_WRITABLE container_id=7a2566e8e462 container_image=quay.io/signalfx/splunk-otel-collector + container_image_tag=0.88.0 container_name=otel-collector k8s_ns=default k8s_pod_name=my-splunk-otel-collector-agent-9sdhr)' +output_fields: +- container_image +- container_image_tag +- container_name +- parent +- proc_exepath +- process +- user diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index e65107d021..c842800074 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd separator: type separator_value: ADD_USER configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index 3ef7f828d7..b250deab91 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -7,6 +7,9 @@ author: Nasreddine Bencherchali, Splunk description: This type is used to record the working directory from which the process that invoked the system call specified in the first record was executed. The purpose of this record is to record the current process's location in case a relative path winds up being captured in the associated PATH record. This way the absolute path can be reconstructed. source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd separator: type separator_value: CWD configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 5446dd0ae7..28a14d7fff 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -13,6 +13,15 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content separator: type separator_value: DAEMON_ABORT configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index 6d4a8b2374..a3e47ee3c7 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -13,6 +13,15 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content separator: type separator_value: DAEMON_END configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index c22e10f484..f7c3f87d23 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -13,6 +13,15 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content separator: type separator_value: DAEMON_START configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index ca072eadbb..9496c2894f 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -13,6 +13,15 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd +mitre_components: +- Command Execution +- Process Creation +- Process Metadata +- OS API Execution +- Application Log Content separator: type separator_value: EXECVE configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 2fb58ab7ac..0ad71ed9b9 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd separator: type separator_value: PATH configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index a344eab275..c803863112 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -12,8 +12,9 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd -separator: type -separator_value: PROCTITLE +logsource: + product: linux + service: auditd configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 124257f391..dbde8996a5 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -12,8 +12,9 @@ mitre_components: - Application Log Content source: auditd sourcetype: auditd -separator: type -separator_value: SERVICE_STOP +logsource: + product: linux + service: auditd configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index 9993eff085..30f500a6e1 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: auditd sourcetype: auditd +logsource: + product: linux + service: auditd separator: type separator_value: syscall configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 93e9235f30..5cb8246160 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: /var/log/kern sourcetype: linux_messages_syslog +logsource: + product: linux + service: syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index 5c10d18458..5f0388d406 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: /var/log/secure sourcetype: linux_secure +logsource: + product: linux + service: auth supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/m365_copilot_graph_api.yml b/data_sources/m365_copilot_graph_api.yml index eef7d37443..3f128b5960 100644 --- a/data_sources/m365_copilot_graph_api.yml +++ b/data_sources/m365_copilot_graph_api.yml @@ -7,6 +7,8 @@ author: Rod Soto, Splunk description: Access Logs from M365 Copilot access via Graph API source: AuditLogs.SignIns sourcetype: o365:graph:api +logsource: + product: m365 supported_TA: - name: Splunk Add-on for Microsoft Office 365 url: https://splunkbase.splunk.com/app/4055 diff --git a/data_sources/m365_exported_ediscovery_prompts.yml b/data_sources/m365_exported_ediscovery_prompts.yml index cf3ea8fea9..9228026bc2 100644 --- a/data_sources/m365_exported_ediscovery_prompts.yml +++ b/data_sources/m365_exported_ediscovery_prompts.yml @@ -7,6 +7,8 @@ author: Rod Soto, Splunk description: M365 exported eDiscovery prompt logs from Microsoft Purview contain user interactions with M365 Copilot, including the actual prompt text (Subject_Title), sender information, timestamps, and metadata about the AI conversations. These logs are exported through Purview's eDiscovery functionality and provide visibility into how users are querying and attempting to interact with Copilot, making them valuable for detecting jailbreak attempts, data exfiltration requests, policy violations, and other security-relevant AI usage patterns. The logs capture the full conversational context necessary for identifying malicious prompt injection, social engineering attempts against the AI, and unauthorized information disclosure requests. source: csv sourcetype: csv +logsource: + product: m365 fields: - Added by - Author diff --git a/data_sources/mcp_server.yml b/data_sources/mcp_server.yml index 835308b857..8234b554c4 100644 --- a/data_sources/mcp_server.yml +++ b/data_sources/mcp_server.yml @@ -4,7 +4,15 @@ version: 2 creation_date: '2026-02-17' modification_date: '2026-05-13' author: Rod Soto, Splunk -description: MCP server activity (JSON-RPC protocol messages capturing AI assistant tool invocations including file operations, API calls, GitHub activity, File System, PostGress and many more resource access patterns) via Splunk MCP TA by configuring file monitoring inputs to your MCP server log directories (sourcetype mcp:jsonrpc). Provides CIM-compliant field extractions for security monitoring of Model Context Protocol communications, enabling detection of unauthorized tool usage, anomalous AI behavior, and shadow AI governance. TA available in Splunkbase' +description: MCP server activity (JSON-RPC protocol messages capturing AI assistant tool invocations + including file operations, API calls, GitHub activity, File System, PostGress and many more resource access patterns) + via Splunk MCP TA by configuring file monitoring inputs to your MCP server log directories + (sourcetype mcp:jsonrpc). Provides CIM-compliant field extractions for security monitoring + of Model Context Protocol communications, enabling detection of unauthorized tool usage, + anomalous AI behavior, and shadow AI governance. TA available in Splunkbase' +sourcetype: mcp:jsonrpc +logsource: + product: mcp source: mcp.log sourcetype: mcp:jsonrpc supported_TA: diff --git a/data_sources/ms365_defender_incident_alerts.yml b/data_sources/ms365_defender_incident_alerts.yml index 5f623dfeac..eb610ac7d7 100644 --- a/data_sources/ms365_defender_incident_alerts.yml +++ b/data_sources/ms365_defender_incident_alerts.yml @@ -13,6 +13,8 @@ mitre_components: - Active Directory Object Access source: ms365_defender_incident_alerts sourcetype: ms365:defender:incident:alerts +logsource: + category: antivirus supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 diff --git a/data_sources/ms_defender_atp_alerts.yml b/data_sources/ms_defender_atp_alerts.yml index 2baf4d980d..cbdd9811cc 100644 --- a/data_sources/ms_defender_atp_alerts.yml +++ b/data_sources/ms_defender_atp_alerts.yml @@ -13,6 +13,8 @@ mitre_components: - Application Log Content source: ms_defender_atp_alerts sourcetype: ms:defender:atp:alerts +logsource: + category: antivirus supported_TA: - name: Splunk Add-on for Microsoft Security url: https://splunkbase.splunk.com/app/6207 diff --git a/data_sources/nginx_access.yml b/data_sources/nginx_access.yml index 3b205f3932..df540231a5 100644 --- a/data_sources/nginx_access.yml +++ b/data_sources/nginx_access.yml @@ -13,6 +13,8 @@ mitre_components: - User Account Metadata source: /var/log/nginx/access.log sourcetype: nginx:plus:kv +logsource: + category: webserver supported_TA: - name: Splunk Add-on for NGINX url: https://splunkbase.splunk.com/app/3258 diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 749a2d3ae1..6ee6fcddfe 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for NTLM Operational 8004 source: XmlWinEventLog:Microsoft-Windows-NTLM/Operational sourcetype: XmlWinEventLog:Microsoft-Windows-NTLM/Operational +logsource: + product: windows + service: ntlm separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index 045f5a43f3..6984107f08 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for NTLM Operational 8005 source: XmlWinEventLog:Microsoft-Windows-NTLM/Operational sourcetype: XmlWinEventLog:Microsoft-Windows-NTLM/Operational +logsource: + product: windows + service: ntlm separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index d7df32bf79..99b74226f5 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for NTLM Operational 8006 source: XmlWinEventLog:Microsoft-Windows-NTLM/Operational sourcetype: XmlWinEventLog:Microsoft-Windows-NTLM/Operational +logsource: + product: windows + service: ntlm separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/o365.yml b/data_sources/o365.yml index 4184acc03e..2d8ddc2574 100644 --- a/data_sources/o365.yml +++ b/data_sources/o365.yml @@ -13,8 +13,17 @@ mitre_components: - Active Directory Object Modification source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation supported_TA: - - name: Splunk Add-on for Microsoft Office 365 - url: https://splunkbase.splunk.com/app/4055 - version: 6.1.0 +- name: Splunk Add-on for Microsoft Office 365 + url: https://splunkbase.splunk.com/app/4055 + version: 5.1.0 +output_fields: +- dest +- user +- src +- vendor_account +- vendor_product diff --git a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml index 1687c98ff8..790be9a0bb 100644 --- a/data_sources/o365_add_app_role_assignment_grant_to_user_.yml +++ b/data_sources/o365_add_app_role_assignment_grant_to_user_.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Add app role assignment grant to user. supported_TA: diff --git a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml index 925288235d..cd8203d899 100644 --- a/data_sources/o365_add_app_role_assignment_to_service_principal_.yml +++ b/data_sources/o365_add_app_role_assignment_to_service_principal_.yml @@ -12,6 +12,9 @@ mitre_components: - Group Modification source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Add app role assignment to service principal. supported_TA: diff --git a/data_sources/o365_add_mailboxpermission.yml b/data_sources/o365_add_mailboxpermission.yml index 79d4333bbb..4b519ed6a0 100644 --- a/data_sources/o365_add_mailboxpermission.yml +++ b/data_sources/o365_add_mailboxpermission.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Add-MailboxPermission supported_TA: diff --git a/data_sources/o365_add_member_to_role_.yml b/data_sources/o365_add_member_to_role_.yml index a69da205d9..ef22981ad1 100644 --- a/data_sources/o365_add_member_to_role_.yml +++ b/data_sources/o365_add_member_to_role_.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Modification source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Add member to role. supported_TA: diff --git a/data_sources/o365_add_owner_to_application_.yml b/data_sources/o365_add_owner_to_application_.yml index aa2db39030..05e1c2d739 100644 --- a/data_sources/o365_add_owner_to_application_.yml +++ b/data_sources/o365_add_owner_to_application_.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Add owner to application. supported_TA: diff --git a/data_sources/o365_add_service_principal_.yml b/data_sources/o365_add_service_principal_.yml index 3b4615afa7..9f6c711f22 100644 --- a/data_sources/o365_add_service_principal_.yml +++ b/data_sources/o365_add_service_principal_.yml @@ -12,6 +12,9 @@ mitre_components: - Active Directory Object Creation source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Add service principal. supported_TA: diff --git a/data_sources/o365_change_user_license_.yml b/data_sources/o365_change_user_license_.yml index d6451bc035..a8915a78ad 100644 --- a/data_sources/o365_change_user_license_.yml +++ b/data_sources/o365_change_user_license_.yml @@ -12,6 +12,9 @@ mitre_components: - Configuration Modification source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Change user license. supported_TA: diff --git a/data_sources/o365_consent_to_application_.yml b/data_sources/o365_consent_to_application_.yml index f12ada70fd..5875da7f40 100644 --- a/data_sources/o365_consent_to_application_.yml +++ b/data_sources/o365_consent_to_application_.yml @@ -12,6 +12,9 @@ mitre_components: - Configuration Modification source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Consent to application. supported_TA: diff --git a/data_sources/o365_disable_strong_authentication_.yml b/data_sources/o365_disable_strong_authentication_.yml index 3e75abb378..1c052169b7 100644 --- a/data_sources/o365_disable_strong_authentication_.yml +++ b/data_sources/o365_disable_strong_authentication_.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Disable Strong Authentication. supported_TA: diff --git a/data_sources/o365_mailitemsaccessed.yml b/data_sources/o365_mailitemsaccessed.yml index 3860a0da92..122b766262 100644 --- a/data_sources/o365_mailitemsaccessed.yml +++ b/data_sources/o365_mailitemsaccessed.yml @@ -12,6 +12,9 @@ mitre_components: - Active Directory Object Access source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: MailItemsAccessed supported_TA: diff --git a/data_sources/o365_modifyfolderpermissions.yml b/data_sources/o365_modifyfolderpermissions.yml index bf30472105..8cda4543f1 100644 --- a/data_sources/o365_modifyfolderpermissions.yml +++ b/data_sources/o365_modifyfolderpermissions.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: ModifyFolderPermissions supported_TA: diff --git a/data_sources/o365_set_company_information_.yml b/data_sources/o365_set_company_information_.yml index e40e2d4917..7110087080 100644 --- a/data_sources/o365_set_company_information_.yml +++ b/data_sources/o365_set_company_information_.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Set Company Information. supported_TA: diff --git a/data_sources/o365_set_mailbox.yml b/data_sources/o365_set_mailbox.yml index 07dff02233..f7ab7eb4cc 100644 --- a/data_sources/o365_set_mailbox.yml +++ b/data_sources/o365_set_mailbox.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Set-Mailbox supported_TA: diff --git a/data_sources/o365_update_application_.yml b/data_sources/o365_update_application_.yml index 48912324ff..8840e7f4f6 100644 --- a/data_sources/o365_update_application_.yml +++ b/data_sources/o365_update_application_.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Update application. supported_TA: diff --git a/data_sources/o365_update_authorization_policy_.yml b/data_sources/o365_update_authorization_policy_.yml index 0feeb95bdf..bbcbb7af87 100644 --- a/data_sources/o365_update_authorization_policy_.yml +++ b/data_sources/o365_update_authorization_policy_.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Update authorization policy. supported_TA: diff --git a/data_sources/o365_update_user_.yml b/data_sources/o365_update_user_.yml index 0b264ec1b2..12af8a3f7e 100644 --- a/data_sources/o365_update_user_.yml +++ b/data_sources/o365_update_user_.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: Update user. supported_TA: diff --git a/data_sources/o365_userloggedin.yml b/data_sources/o365_userloggedin.yml index 0402ece5bf..4f2f584c11 100644 --- a/data_sources/o365_userloggedin.yml +++ b/data_sources/o365_userloggedin.yml @@ -12,6 +12,9 @@ mitre_components: - Logon Session Metadata source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: UserLoggedIn supported_TA: diff --git a/data_sources/o365_userloginfailed.yml b/data_sources/o365_userloginfailed.yml index 61907c7546..7251b2cf5c 100644 --- a/data_sources/o365_userloginfailed.yml +++ b/data_sources/o365_userloginfailed.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation separator_value: UserLoginFailed supported_TA: diff --git a/data_sources/office_365_reporting_message_trace.yml b/data_sources/office_365_reporting_message_trace.yml index 1c2f9ffefc..a32ddf1def 100644 --- a/data_sources/office_365_reporting_message_trace.yml +++ b/data_sources/office_365_reporting_message_trace.yml @@ -7,6 +7,9 @@ author: Steven Dick description: Data source object for Office 365 Reporting Message Trace source: o365 sourcetype: o365:reporting:messagetrace +logsource: + product: m365 + service: exchange separator: Organization supported_TA: - name: Splunk Microsoft Office 365 Add-on diff --git a/data_sources/office_365_universal_audit_log.yml b/data_sources/office_365_universal_audit_log.yml index c9273ae119..d8214610bc 100644 --- a/data_sources/office_365_universal_audit_log.yml +++ b/data_sources/office_365_universal_audit_log.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Office 365 Universal Audit Log source: o365 sourcetype: o365:management:activity +logsource: + product: m365 + service: audit separator: Operation supported_TA: - name: Splunk Microsoft Office 365 Add-on @@ -15,3 +18,9 @@ supported_TA: fields: - _time example_log: '' +output_fields: +- dest +- user +- src +- vendor_account +- vendor_product diff --git a/data_sources/okta.yml b/data_sources/okta.yml index aead16fbc8..c26bdd532e 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: Okta sourcetype: OktaIM2:log +logsource: + product: okta + service: okta supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 diff --git a/data_sources/ollama_server.yml b/data_sources/ollama_server.yml index a515e83697..707dafe27e 100644 --- a/data_sources/ollama_server.yml +++ b/data_sources/ollama_server.yml @@ -4,7 +4,14 @@ version: 3 creation_date: '2025-10-13' modification_date: '2026-05-13' author: Rod Soto, Splunk -description: 'Ollama server logs (HTTP access logs via GIN framework and system logs including GPU/CPU utilization, model loading, memory allocation, errors, and warnings) via Splunk TA-ollama add-on by configuring file monitoring inputs to your log directories (sourcetype: ollama:server), or enable HEC for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). TA available in Splunkbase' +description: 'Ollama server logs (HTTP access logs via GIN framework and system logs + including GPU/CPU utilization, model loading, memory allocation, errors, and warnings) + via Splunk TA-ollama add-on by configuring file monitoring inputs to your log directories + (sourcetype: ollama:server), or enable HEC for real-time API telemetry and prompt + analytics (sourcetypes: ollama:api, ollama:prompts). TA available in Splunkbase' +sourcetype: ollama:server +logsource: + product: ollama source: server.log sourcetype: ollama:server supported_TA: diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml index 5445233c45..63e725656d 100644 --- a/data_sources/osquery_results.yml +++ b/data_sources/osquery_results.yml @@ -13,6 +13,8 @@ mitre_components: - Application Log Content source: osquery sourcetype: osquery:results +logsource: + product: osquery supported_TA: - name: TA-osquery url: https://splunkbase.splunk.com/app/8574 diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index b133bf04e7..4b85f60ba3 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -13,6 +13,9 @@ mitre_components: - Host Status source: not_applicable sourcetype: pan:threat +logsource: + category: firewall + product: paloalto supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 07d645dc59..076eb2ac3f 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: not_applicable sourcetype: pan:traffic +logsource: + category: firewall + product: paloalto supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 diff --git a/data_sources/pingid.yml b/data_sources/pingid.yml index f9b25e0de0..9500d88349 100644 --- a/data_sources/pingid.yml +++ b/data_sources/pingid.yml @@ -13,6 +13,8 @@ mitre_components: - Host Status source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: pingid supported_TA: [] fields: - _time diff --git a/data_sources/powershell_installed_iis_modules.yml b/data_sources/powershell_installed_iis_modules.yml index f5c1fae006..40d40dedf4 100644 --- a/data_sources/powershell_installed_iis_modules.yml +++ b/data_sources/powershell_installed_iis_modules.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: powershell://AppCmdModules sourcetype: Pwsh:InstalledIISModules +logsource: + product: windows + service: powershell supported_TA: [] fields: - _time diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6089a236b5..dc22cc1cde 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -13,6 +13,10 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog +logsource: + category: ps_script + product: windows + service: powershell separator: EventID separator_value: '4104' supported_TA: diff --git a/data_sources/powershell_sip_inventory.yml b/data_sources/powershell_sip_inventory.yml index f2b8bfad84..68c788dbc6 100644 --- a/data_sources/powershell_sip_inventory.yml +++ b/data_sources/powershell_sip_inventory.yml @@ -12,4 +12,7 @@ mitre_components: - OS API Execution source: powershell://SubjectInterfacePackage sourcetype: PwSh:SubjectInterfacePackage +logsource: + product: windows + service: powershell supported_TA: [] diff --git a/data_sources/splunk.yml b/data_sources/splunk.yml index 9ca53e3d60..ee3df59802 100644 --- a/data_sources/splunk.yml +++ b/data_sources/splunk.yml @@ -13,6 +13,8 @@ mitre_components: - Logon Session Metadata source: splunkd_ui_access.log sourcetype: splunkd_ui_access +logsource: + product: splunk supported_TA: [] fields: - _time diff --git a/data_sources/splunk_appdynamics_secure_application_alert.yml b/data_sources/splunk_appdynamics_secure_application_alert.yml index e9ffbdfe78..582e0f8cc7 100644 --- a/data_sources/splunk_appdynamics_secure_application_alert.yml +++ b/data_sources/splunk_appdynamics_secure_application_alert.yml @@ -7,6 +7,8 @@ author: Bhavin Patel, Splunk description: Data source object for alerts from Cisco Secure Application source: AppDynamics Security sourcetype: appdynamics_security +logsource: + product: splunk supported_TA: - name: Splunk Add-on for AppDynamics url: https://splunkbase.splunk.com/app/3471 diff --git a/data_sources/splunk_common_information_model_(cim).yml b/data_sources/splunk_common_information_model_(cim).yml index 29dd90ca3f..03f85c6eb1 100644 --- a/data_sources/splunk_common_information_model_(cim).yml +++ b/data_sources/splunk_common_information_model_(cim).yml @@ -7,6 +7,8 @@ author: Bhavin Patel, Splunk description: Data source object for Splunk CIM source: not_applicable sourcetype: not_applicable +logsource: + product: splunk supported_TA: - name: Splunk Common Information Model (CIM) url: https://splunkbase.splunk.com/app/1621 diff --git a/data_sources/splunk_stream_http.yml b/data_sources/splunk_stream_http.yml index 29522a4daa..ed99cd2c87 100644 --- a/data_sources/splunk_stream_http.yml +++ b/data_sources/splunk_stream_http.yml @@ -13,6 +13,8 @@ mitre_components: - Application Log Content source: stream:http sourcetype: stream:http +logsource: + category: proxy supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 diff --git a/data_sources/splunk_stream_ip.yml b/data_sources/splunk_stream_ip.yml index a5ffb18d05..8ba0b4726e 100644 --- a/data_sources/splunk_stream_ip.yml +++ b/data_sources/splunk_stream_ip.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: stream:ip sourcetype: stream:ip +logsource: + category: network + service: connection supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 diff --git a/data_sources/splunk_stream_tcp.yml b/data_sources/splunk_stream_tcp.yml index a15f404188..b22942d9ed 100644 --- a/data_sources/splunk_stream_tcp.yml +++ b/data_sources/splunk_stream_tcp.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: stream:tcp sourcetype: stream:tcp +logsource: + category: network + service: connection supported_TA: - name: Splunk Add-on for Stream Wire Data url: https://splunkbase.splunk.com/app/5234 diff --git a/data_sources/suricata.yml b/data_sources/suricata.yml index 2783cc8521..4ea9a01dae 100644 --- a/data_sources/suricata.yml +++ b/data_sources/suricata.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: not_applicable sourcetype: suricata +logsource: + category: network + product: suricata supported_TA: - name: CCX Add-on for Suricata url: https://splunkbase.splunk.com/app/6994 diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index 0c6c58dfb1..0791334cab 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: process_creation + product: windows separator: EventID separator_value: '1' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index d1ba331c5b..74f916d39f 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: process_access + product: windows separator: EventID separator_value: '10' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 847bf94914..9a2bce3f9e 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: file_event + product: windows separator: EventID separator_value: '11' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index b52aefa9f7..a04abd4f69 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: registry_event + product: windows separator: EventID separator_value: '12' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index 9dd9afc34d..319b24d684 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: registry_event + product: windows separator: EventID separator_value: '13' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 877834a5fd..95adb0aaae 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Sysmon EventID 14 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: registry_event + product: windows separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index 45aa929ea7..15c45d66ae 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: create_stream_hash + product: windows separator: EventID separator_value: '15' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index 53031fbf53..172bc6f968 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -9,6 +9,9 @@ mitre_components: - Named Pipe Metadata source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: pipe_created + product: windows separator: EventID separator_value: '17' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 01dec72da3..69d0e06191 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: pipe_created + product: windows separator: EventID separator_value: '18' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml index 2e0e8db5f8..4a8a02ccbb 100644 --- a/data_sources/sysmon_eventid_20.yml +++ b/data_sources/sysmon_eventid_20.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: wmi_event + product: windows separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml index a17d1dea05..582dd7f691 100644 --- a/data_sources/sysmon_eventid_21.yml +++ b/data_sources/sysmon_eventid_21.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: wmi_event + product: windows separator: EventID separator_value: '21' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index fdaa49c146..08bd70a102 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: dns_query + product: windows separator: EventID separator_value: '22' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index 6d934d8138..80779e8d65 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: file_delete + product: windows separator: EventID separator_value: '23' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_24.yml b/data_sources/sysmon_eventid_24.yml index 66a49773a6..44398938e8 100644 --- a/data_sources/sysmon_eventid_24.yml +++ b/data_sources/sysmon_eventid_24.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: clipboard_capture + product: windows separator: EventID separator_value: '24' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index 07fabf9724..3df5bca10d 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Sysmon EventID 26 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: file_delete + product: windows separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index 4ab79dacf8..e3d5671250 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -7,6 +7,9 @@ author: Teoderick Contreras, Splunk description: Data source object for Sysmon EventID 29 source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: file_executable_detected + product: windows separator: EventID configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 2b0e1cfab0..9888de110f 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: network_connection + product: windows separator: EventID separator_value: '3' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml index e4c67f2509..b713f89825 100644 --- a/data_sources/sysmon_eventid_5.yml +++ b/data_sources/sysmon_eventid_5.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: process_termination + product: windows separator: EventID separator_value: '5' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index bb5efed138..3a31a0c9bd 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: driver_load + product: windows separator: EventID separator_value: '6' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index b4ec9a8fd3..839fa6eca4 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: image_load + product: windows separator: EventID separator_value: '7' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index 53a5c3c09b..9c134b1214 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: create_remote_thread + product: windows separator: EventID separator_value: '8' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml index 134244241d..e13973c815 100644 --- a/data_sources/sysmon_eventid_9.yml +++ b/data_sources/sysmon_eventid_9.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: raw_access_thread + product: windows separator: EventID separator_value: '9' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_for_linux_eventid_1.yml b/data_sources/sysmon_for_linux_eventid_1.yml index b1c1149953..69e85b0a3b 100644 --- a/data_sources/sysmon_for_linux_eventid_1.yml +++ b/data_sources/sysmon_for_linux_eventid_1.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux +logsource: + category: process_creation + product: linux separator: EventID separator_value: '1' supported_TA: diff --git a/data_sources/sysmon_for_linux_eventid_11.yml b/data_sources/sysmon_for_linux_eventid_11.yml index 8dc15493f6..36c723f123 100644 --- a/data_sources/sysmon_for_linux_eventid_11.yml +++ b/data_sources/sysmon_for_linux_eventid_11.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux +logsource: + category: file_event + product: linux separator: EventID supported_TA: - name: Splunk Add-on for Sysmon for Linux diff --git a/data_sources/sysmon_for_linux_eventid_3.yml b/data_sources/sysmon_for_linux_eventid_3.yml index ffaa13a39f..ad8c634635 100644 --- a/data_sources/sysmon_for_linux_eventid_3.yml +++ b/data_sources/sysmon_for_linux_eventid_3.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux +logsource: + category: network_connection + product: linux separator: EventID separator_value: '3' supported_TA: diff --git a/data_sources/vmware_esxi_syslog.yml b/data_sources/vmware_esxi_syslog.yml index 6e72faa80b..a79f629756 100644 --- a/data_sources/vmware_esxi_syslog.yml +++ b/data_sources/vmware_esxi_syslog.yml @@ -7,6 +7,9 @@ author: Raven Tait, Splunk description: Data source object for syslog data from VMWare ESXi source: vmware:esxlog sourcetype: vmw-syslog +logsource: + product: vmware + service: esxi supported_TA: - name: Add-on for VMware ESXi Logs url: https://splunkbase.splunk.com/app/5603 diff --git a/data_sources/windchill_log4j.yml b/data_sources/windchill_log4j.yml index de3a5e644e..c649d4e56b 100644 --- a/data_sources/windchill_log4j.yml +++ b/data_sources/windchill_log4j.yml @@ -11,6 +11,8 @@ mitre_components: - Response Metadata source: not_applicable sourcetype: log4j +logsource: + product: windchill supported_TA: [] fields: - _time diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index b43f02de4b..7907a61d08 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: ActiveDirectory sourcetype: ActiveDirectory +logsource: + product: windows + service: security supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 diff --git a/data_sources/windows_defender_alerts.yml b/data_sources/windows_defender_alerts.yml index eaf105832f..7d0b103388 100644 --- a/data_sources/windows_defender_alerts.yml +++ b/data_sources/windows_defender_alerts.yml @@ -13,6 +13,8 @@ mitre_components: - Host Status source: eventhub://windowsdefenderlogs sourcetype: mscs:azure:eventhub:defender:advancedhunting +logsource: + category: antivirus separator: AlertId supported_TA: - name: Splunk add on for Microsoft Defender Advanced Hunting diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 953e724a1e..6bd4889af0 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -7,6 +7,9 @@ author: Michael Haag, Splunk description: Data source object for Windows Event Log Application 15457 source: XmlWinEventLog:Application sourcetype: XmlWinEventLog +logsource: + product: windows + service: application separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index dfbc3ae1ed..226f01454c 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -7,6 +7,9 @@ author: Michael Haag, Splunk description: Data source object for Windows Event Log Application 17135 source: XmlWinEventLog:Application sourcetype: XmlWinEventLog +logsource: + product: windows + service: application separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index df3d27c6c7..49cd486c4e 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -12,6 +12,9 @@ mitre_components: - Service Metadata source: XmlWinEventLog:Application sourcetype: XmlWinEventLog +logsource: + product: windows + service: application separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index 7f333a78f9..dbcd215306 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Application sourcetype: XmlWinEventLog +logsource: + product: windows + service: application separator: EventCode separator_value: '3000' supported_TA: diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index e3841b7d77..30bacc79ba 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -7,6 +7,9 @@ author: Michael Haag, Splunk description: Data source object for Windows Event Log Application 8128 source: XmlWinEventLog:Application sourcetype: XmlWinEventLog +logsource: + product: windows + service: application separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 6c924b1ebb..d3bc5cfc94 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -15,6 +15,9 @@ description: 'This data source captures Windows Event Logs from the Microsoft-Wi ' source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: appxdeployment-server separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index f72140ae8d..0eb62a2106 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -15,6 +15,9 @@ description: 'This data source captures Windows Event Logs from the Microsoft-Wi ' source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: appxdeployment-server separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 870de7ee17..a32a510284 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -15,6 +15,9 @@ description: 'This data source captures Windows Event Logs from the Microsoft-Wi ' source: XmlWinEventLog:Microsoft-Windows-AppXDeploymentServer/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: appxdeployment-server separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index cf70c22f8c..5fbcbd43ae 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -15,6 +15,9 @@ description: 'This data source captures Windows Event Logs from the Microsoft-Wi ' source: XmlWinEventLog:Microsoft-Windows-AppxPackaging/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: appxpackaging-om separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 592e0b6ef3..e8450a5181 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -13,6 +13,9 @@ mitre_components: - Host Status source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: capi2 separator: EventCode separator_value: '70' supported_TA: diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index 66ada13148..ca59980145 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -13,6 +13,9 @@ mitre_components: - Process Metadata source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: capi2 separator: EventCode separator_value: '81' supported_TA: diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 4c7a4f8b93..9edc61ca1e 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -13,6 +13,9 @@ mitre_components: - User Account Metadata source: XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: certificateservicesclient-lifecycle-system separator: EventCode separator_value: '1007' supported_TA: diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 9b02654eb1..ecf3e51918 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -11,6 +11,9 @@ mitre_components: - Process Creation source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode separator_value: '1116' supported_TA: diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index 4eee9d4d80..99f37b1869 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -11,6 +11,9 @@ mitre_components: - Process Creation source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode separator_value: '1117' supported_TA: diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index e79d991237..fe785bbf20 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -11,6 +11,9 @@ mitre_components: - Process Creation source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode separator_value: '1121' supported_TA: diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index ad28a09086..b7c73410f7 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -11,6 +11,9 @@ mitre_components: - Module Load source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode separator_value: '1122' supported_TA: diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index db460b697e..ce6f549165 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1125 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index 2bbe2b2b19..f1c7d8c45f 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1126 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index ad851b6a94..ea0df82f03 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -11,6 +11,9 @@ mitre_components: - Application Log Content source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode separator_value: '1129' supported_TA: diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index c014f6885a..5de9ff417e 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1131 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 88a8748b5b..2a2a22a981 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1132 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 70dc254190..4d64824f26 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1133 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index f5889d38fd..57bfef84dd 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Defender 1134 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 10c8ddbede..cdb525dbb9 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -10,6 +10,9 @@ mitre_components: - Service Metadata source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml b/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml index 59eefab1e0..b7b3ff665c 100644 --- a/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml +++ b/data_sources/windows_event_log_microsoft_windows_terminalservices_rdpclient_1024.yml @@ -10,6 +10,9 @@ mitre_components: - Logon Session Creation source: WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational sourcetype: WinEventLog +logsource: + product: windows + service: terminalservices-rdpclient separator: EventCode supported_TA: [] fields: diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 2aa8588d75..06f53fd0f6 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -10,6 +10,9 @@ mitre_components: - Driver Metadata source: WinEventLog:Microsoft-Windows-PrintService/Admin sourcetype: WinEventLog +logsource: + product: windows + service: printservice-admin separator: EventCode separator_value: '316' supported_TA: diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 28d99290fb..335e53e682 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Printservice 4909 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index 38622b24f5..5bcb0f23ae 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -11,6 +11,9 @@ mitre_components: - Service Metadata source: WinEventLog:Microsoft-Windows-PrintService/Admin sourcetype: WinEventLog +logsource: + product: windows + service: printservice-admin separator: EventCode separator_value: '808' supported_TA: diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 060336e042..c975fa99de 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -11,6 +11,9 @@ mitre_components: - Logon Session Metadata source: WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational sourcetype: wineventlog +logsource: + product: windows + service: terminalservices-remoteconnectionmanager separator: EventCode separator_value: '1149' supported_TA: diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 75f9683746..b8684efd87 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -10,6 +10,9 @@ mitre_components: - System Configuration Changes source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '1100' supported_TA: diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index f59cb881fd..d38b2d500d 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -11,6 +11,9 @@ mitre_components: - File Deletion source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '1102' supported_TA: diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index c48507cfc3..704c2f4188 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -11,6 +11,9 @@ mitre_components: - Logon Session Metadata source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4624' supported_TA: diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index dad4989547..eca8cb245d 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -10,6 +10,9 @@ mitre_components: - Logon Session Metadata source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4625' supported_TA: diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index 89fba03f2c..509d6d01fe 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -11,6 +11,9 @@ mitre_components: - User Account Authentication source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4627' supported_TA: diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index b4667be60c..03f862d0a0 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -10,6 +10,9 @@ mitre_components: - Logon Session Creation source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4648' supported_TA: diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index fa95daaa50..eaf02b7b2f 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -10,6 +10,9 @@ mitre_components: - Active Directory Object Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4662' supported_TA: diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index 104eb80b58..1653e8bb0c 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -10,6 +10,9 @@ mitre_components: - File Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4663' supported_TA: diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 289d62a902..9f01621d66 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Authentication source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4672' supported_TA: diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 989857e278..4ceff5fa5e 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -10,6 +10,9 @@ mitre_components: - Command Execution source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + category: process_creation + product: windows separator: EventCode separator_value: '4688' configuration: Enabling Windows event log process command line logging via group policy object https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_Windows_event_log_process_command_line_logging_via_group_policy_object diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index a440f483f9..9a3cace5c4 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -10,6 +10,9 @@ mitre_components: - Scheduled Job Metadata source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4698' supported_TA: diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index 54054afabb..4a84d344d1 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -10,6 +10,9 @@ mitre_components: - Scheduled Job Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4699' supported_TA: diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 3d13a756ee..15bd5483e3 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -7,6 +7,9 @@ author: Steven Dick description: Data source object for Windows Event Log Security 4700 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 4c180ca38a..76235870bb 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -7,6 +7,9 @@ author: Steven Dick description: Data source object for Windows Event Log Security 4702 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index ed09ed27bd..820c0eab19 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -10,6 +10,9 @@ mitre_components: - Process Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4703' supported_TA: diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 4a8dfb8ca5..eff2578ff9 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4719' supported_TA: diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 5e2bbda6ab..62f5a37e97 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Creation source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4720' supported_TA: diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index fd486f8f61..3c424125e4 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4723' supported_TA: diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index a9cd94593d..a763536147 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4724' supported_TA: diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index 9524a3f72f..eb55c9a0f8 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4725' supported_TA: diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 8136745ad8..8a05d2d27d 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Deletion source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4726' supported_TA: diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 24032e276b..54e601c778 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4727 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index ab74f07c8d..ad8f28fc0c 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4728 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index d73d16002d..88adb79160 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4730 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index fefeeec125..5aa99ab3ce 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4731 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index 3fdffb89a8..dd01c82889 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -9,6 +9,9 @@ mitre_components: - Group Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4732' supported_TA: diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index 881d7ccf05..406095f340 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4737 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index 9c4df3de2d..7b7f2ebd39 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4738' supported_TA: diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index 7784f95bb3..44af006c7f 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -10,6 +10,9 @@ mitre_components: - Active Directory Object Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4739' supported_TA: diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 1c4c800fe0..dcc776b5a1 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -12,6 +12,9 @@ mitre_components: - Configuration Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4741' supported_TA: diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index 027458aca6..e41bb8403b 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -12,6 +12,9 @@ mitre_components: - Configuration Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index f02e15fa1a..afbef7cd94 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4744 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index dac0a891f9..f78e57e5a3 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4749 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 27c818f289..21b63e9a34 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4754 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index f73f48479e..90929e694e 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -7,6 +7,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for Windows Event Log Security 4756 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 8978d1ea3f..54eba282e4 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4759 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 44102ebf15..3a7e255aec 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -12,6 +12,9 @@ mitre_components: - User Account Metadata source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4768' supported_TA: diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index f29190cc07..f89b93aefb 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -12,6 +12,9 @@ mitre_components: - User Account Metadata source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4769' supported_TA: diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index bff553454a..8e8a6a2272 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4771' supported_TA: diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index b01e5a06bb..0b67302e3e 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4776' supported_TA: diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index f8856f02cd..2ed743186e 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4781' supported_TA: diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index c21f93675c..a6ed6f1c7d 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4783 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index da4093a413..bec1958248 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log Security 4790 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 75ffcb4b33..f9373502e5 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: supported_TA: diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 50d72b8dc7..2b4758e09b 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index 8c021ffff6..55d09c6809 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4876' supported_TA: diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index fc950fe649..8d8b2c5f84 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4886' supported_TA: diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 88e0dff853..9b2147fe72 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4887' supported_TA: diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 361668dc89..c3f473f59f 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -7,6 +7,9 @@ author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4946 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4946' supported_TA: diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index 892346a598..63692492fb 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -7,6 +7,9 @@ author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4947 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4947' supported_TA: diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 3ed3918118..b1f8e8a62d 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -7,6 +7,9 @@ author: Teoderick Contreras, Splunk description: Data source object for Windows Event Log Security 4948 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4948' supported_TA: diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index fe9b0aa1ac..cdd2dba636 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5136' supported_TA: diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 4ff1c91b19..58c925ad01 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5137' supported_TA: diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index 31c604a503..d972fb05ea 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5140' supported_TA: diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 03d0bbe1f6..7c7523ac4a 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5141' supported_TA: diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index bd20531413..8e82bb947e 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5145' supported_TA: diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml index e8a62868bd..b2d3541e16 100644 --- a/data_sources/windows_event_log_security_5441.yml +++ b/data_sources/windows_event_log_security_5441.yml @@ -11,6 +11,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5441' configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index 94e8f2a90c..2de9fa462e 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -11,6 +11,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5447' configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index b7298c6713..ef079fd71d 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log System 104 source: XmlWinEventLog:System sourcetype: XmlWinEventLog +logsource: + product: windows + service: system separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 5b95d4b808..a3ebc1675c 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:System sourcetype: XmlWinEventLog +logsource: + product: windows + service: system separator: EventCode separator_value: '4720' supported_TA: diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index b5590d7546..4128718755 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:System sourcetype: XmlWinEventLog +logsource: + product: windows + service: system separator: EventCode separator_value: '4726' supported_TA: diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index 2ca373f47e..e6169e5307 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -12,6 +12,9 @@ mitre_components: - Active Directory Object Modification source: XmlWinEventLog:System sourcetype: XmlWinEventLog +logsource: + product: windows + service: system separator: EventCode separator_value: '4728' supported_TA: diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 6cd9b92a19..71946685fb 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: XmlWinEventLog:System sourcetype: XmlWinEventLog +logsource: + product: windows + service: system separator: EventCode separator_value: '7036' supported_TA: diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index d43588fae6..456f2eaa90 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:System sourcetype: XmlWinEventLog +logsource: + product: windows + service: system separator: EventCode separator_value: '7040' supported_TA: diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index 1aa7fef426..7c0f998a5b 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -12,6 +12,9 @@ mitre_components: - Process Metadata source: XmlWinEventLog:System sourcetype: XmlWinEventLog +logsource: + product: windows + service: system separator: EventCode separator_value: '7045' supported_TA: diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index 31739b254e..5c5c202e32 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: WinEventLog:Microsoft-Windows-TaskScheduler/Operational sourcetype: wineventlog +logsource: + product: windows + service: taskscheduler separator: EventCode separator_value: '200' supported_TA: diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 6809dbf363..a64e5b1fad 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Data source object for Windows Event Log TaskScheduler 201 source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: taskscheduler separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index 521b00579b..d8c370c476 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: IIS:Configuration:Operational sourcetype: IIS:Configuration:Operational +logsource: + product: windows + service: iis-configuration separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 27abf33af6..d987dc0d2e 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: IIS:Configuration:Operational sourcetype: IIS:Configuration:Operational +logsource: + product: windows + service: iis-configuration separator: EventID separator_value: '29' supported_TA: diff --git a/data_sources/zeek_conn.yml b/data_sources/zeek_conn.yml index 814f426321..5d620fbf35 100644 --- a/data_sources/zeek_conn.yml +++ b/data_sources/zeek_conn.yml @@ -7,6 +7,10 @@ author: Patrick Bareiss, Splunk description: Data source object for Zeek connection logs source: bro:conn:json sourcetype: bro:conn:json +logsource: + category: network + product: zeek + service: connection supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/schemas/DataSource.schema.json b/schemas/DataSource.schema.json index 3abd9b541f..0d19d6e0be 100644 --- a/schemas/DataSource.schema.json +++ b/schemas/DataSource.schema.json @@ -328,6 +328,35 @@ "title": "Sourcetype", "type": "string" }, + "logsource": { + "additionalProperties": false, + "description": "Sigma logsource identifying the abstract telemetry this data source provides. At least one of category, product, or service MUST be set.", + "minProperties": 1, + "properties": { + "category": { + "description": "Sigma logsource category, such as process_creation, firewall, or dns.", + "title": "Category", + "type": "string" + }, + "product": { + "description": "Sigma logsource product, such as windows, linux, aws, or cisco.", + "title": "Product", + "type": "string" + }, + "service": { + "description": "Sigma logsource service, such as security, cloudtrail, or auditd.", + "title": "Service", + "type": "string" + }, + "definition": { + "description": "Optional Sigma logsource definition with extra onboarding or scoping notes.", + "title": "Definition", + "type": "string" + } + }, + "title": "Logsource", + "type": "object" + }, "separator": { "anyOf": [ { @@ -444,7 +473,8 @@ "author", "description", "source", - "sourcetype" + "sourcetype", + "logsource" ], "title": "DataSource", "type": "object"