From 8e0ac0b44cee71d1bd5e79baae9cfaa905ed48e6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 8 Sep 2026 15:36:50 +0200 Subject: [PATCH 1/2] changes --- data_sources/asl_aws_cloudtrail.yml | 3 +++ data_sources/aws_cloudfront.yml | 3 +++ data_sources/aws_cloudtrail.yml | 11 +++++++++++ .../aws_cloudtrail_assumerolewithsaml.yml | 3 +++ data_sources/aws_cloudtrail_consolelogin.yml | 3 +++ data_sources/aws_cloudtrail_copyobject.yml | 3 +++ data_sources/aws_cloudtrail_createaccesskey.yml | 3 +++ data_sources/aws_cloudtrail_createkey.yml | 3 +++ .../aws_cloudtrail_createloginprofile.yml | 3 +++ .../aws_cloudtrail_createnetworkaclentry.yml | 3 +++ .../aws_cloudtrail_createpolicyversion.yml | 3 +++ data_sources/aws_cloudtrail_createsnapshot.yml | 3 +++ data_sources/aws_cloudtrail_createtask.yml | 3 +++ .../aws_cloudtrail_createvirtualmfadevice.yml | 3 +++ .../aws_cloudtrail_deactivatemfadevice.yml | 3 +++ ...s_cloudtrail_deleteaccountpasswordpolicy.yml | 3 +++ data_sources/aws_cloudtrail_deletealarms.yml | 3 +++ data_sources/aws_cloudtrail_deletedetector.yml | 3 +++ data_sources/aws_cloudtrail_deletegroup.yml | 3 +++ data_sources/aws_cloudtrail_deleteguardrail.yml | 3 +++ data_sources/aws_cloudtrail_deleteipset.yml | 3 +++ .../aws_cloudtrail_deleteknowledgebase.yml | 3 +++ ...ws_cloudtrail_deleteloggingconfiguration.yml | 3 +++ data_sources/aws_cloudtrail_deleteloggroup.yml | 3 +++ data_sources/aws_cloudtrail_deletelogstream.yml | 3 +++ ...eletemodelinvocationloggingconfiguration.yml | 3 +++ .../aws_cloudtrail_deletenetworkaclentry.yml | 3 +++ data_sources/aws_cloudtrail_deletepolicy.yml | 3 +++ data_sources/aws_cloudtrail_deleterule.yml | 3 +++ data_sources/aws_cloudtrail_deleterulegroup.yml | 3 +++ data_sources/aws_cloudtrail_deletesnapshot.yml | 3 +++ data_sources/aws_cloudtrail_deletetrail.yml | 3 +++ .../aws_cloudtrail_deletevirtualmfadevice.yml | 3 +++ data_sources/aws_cloudtrail_deletewebacl.yml | 3 +++ .../aws_cloudtrail_describeeventaggregates.yml | 3 +++ ...aws_cloudtrail_describeimagescanfindings.yml | 3 +++ ...aws_cloudtrail_describesnapshotattribute.yml | 3 +++ .../aws_cloudtrail_getaccountpasswordpolicy.yml | 3 +++ data_sources/aws_cloudtrail_getobject.yml | 3 +++ data_sources/aws_cloudtrail_getpassworddata.yml | 3 +++ data_sources/aws_cloudtrail_invokemodel.yml | 3 +++ data_sources/aws_cloudtrail_jobcreated.yml | 3 +++ .../aws_cloudtrail_listfoundationmodels.yml | 3 +++ .../aws_cloudtrail_modifydbinstance.yml | 3 +++ .../aws_cloudtrail_modifyimageattribute.yml | 3 +++ .../aws_cloudtrail_modifysnapshotattribute.yml | 3 +++ data_sources/aws_cloudtrail_putbucketacl.yml | 3 +++ .../aws_cloudtrail_putbucketlifecycle.yml | 3 +++ .../aws_cloudtrail_putbucketreplication.yml | 3 +++ .../aws_cloudtrail_putbucketversioning.yml | 3 +++ data_sources/aws_cloudtrail_putimage.yml | 3 +++ data_sources/aws_cloudtrail_putkeypolicy.yml | 3 +++ .../aws_cloudtrail_replacenetworkaclentry.yml | 3 +++ .../aws_cloudtrail_setdefaultpolicyversion.yml | 3 +++ data_sources/aws_cloudtrail_stoplogging.yml | 3 +++ ...s_cloudtrail_updateaccountpasswordpolicy.yml | 3 +++ .../aws_cloudtrail_updateloginprofile.yml | 3 +++ .../aws_cloudtrail_updatesamlprovider.yml | 3 +++ data_sources/aws_cloudtrail_updatetrail.yml | 3 +++ data_sources/aws_cloudwatchlogs_vpcflow.yml | 4 ++++ data_sources/aws_security_hub.yml | 5 +++++ data_sources/azure_active_directory.yml | 3 +++ ...app_role_assignment_to_service_principal.yml | 3 +++ ...zure_active_directory_add_member_to_role.yml | 3 +++ ...ctive_directory_add_owner_to_application.yml | 3 +++ ...e_active_directory_add_service_principal.yml | 3 +++ ...e_active_directory_add_unverified_domain.yml | 3 +++ ..._active_directory_consent_to_application.yml | 3 +++ ..._directory_disable_strong_authentication.yml | 3 +++ .../azure_active_directory_enable_account.yml | 3 +++ ...re_active_directory_invite_external_user.yml | 3 +++ ...ive_directory_microsoftgraphactivitylogs.yml | 8 ++++++++ ...e_directory_noninteractiveusersigninlogs.yml | 9 +++++++++ ...tive_directory_reset_password_(by_admin).yml | 3 +++ ...tive_directory_set_domain_authentication.yml | 3 +++ .../azure_active_directory_sign_in_activity.yml | 3 +++ ...zure_active_directory_update_application.yml | 3 +++ ...ve_directory_update_authorization_policy.yml | 3 +++ .../azure_active_directory_update_user.yml | 3 +++ ..._directory_user_registered_security_info.yml | 3 +++ ...te_or_update_an_azure_automation_account.yml | 3 +++ ...te_or_update_an_azure_automation_runbook.yml | 3 +++ ...te_or_update_an_azure_automation_webhook.yml | 3 +++ data_sources/azure_monitor_activity.yml | 3 +++ data_sources/bro_conn.yml | 4 ++++ data_sources/bro_dns.yml | 3 +++ data_sources/bro_files.yml | 3 +++ data_sources/bro_http.yml | 3 +++ data_sources/bro_loaded_scripts.yml | 3 +++ data_sources/bro_ntp.yml | 3 +++ data_sources/bro_ocsp.yml | 3 +++ data_sources/bro_ssl.yml | 3 +++ data_sources/bro_weird.yml | 3 +++ data_sources/bro_x509.yml | 3 +++ data_sources/circleci.yml | 2 ++ data_sources/cisco_ai_defense_alerts.yml | 3 +++ data_sources/cisco_asa_logs.yml | 3 +++ data_sources/cisco_duo_activity.yml | 3 +++ data_sources/cisco_duo_administrator.yml | 3 +++ data_sources/cisco_ios_logs.yml | 3 +++ .../cisco_isovalent_process_connect.yml | 3 +++ data_sources/cisco_isovalent_process_exec.yml | 3 +++ data_sources/cisco_isovalent_process_kprobe.yml | 2 ++ ...isco_network_visibility_module_flow_data.yml | 4 ++++ .../cisco_network_visibility_module_osquery.yml | 2 ++ data_sources/cisco_sd_wan_ntce_1000001.yml | 3 +++ .../cisco_sd_wan_service_proxy_access_logs.yml | 3 +++ ...firewall_threat_defense_connection_event.yml | 3 +++ ...ecure_firewall_threat_defense_file_event.yml | 3 +++ ..._firewall_threat_defense_intrusion_event.yml | 3 +++ .../crowdstrike_falcon_stream_alert.yml | 2 ++ data_sources/crowdstrike_processrollup2.yml | 3 +++ data_sources/crushftp.yml | 2 ++ data_sources/g_suite_drive.yml | 11 +++++++++++ data_sources/g_suite_gmail.yml | 10 ++++++++++ data_sources/github_enterprise_audit_logs.yml | 15 +++++++++++++++ .../github_organizations_audit_logs.yml | 17 +++++++++++++++++ data_sources/github_webhooks.yml | 2 ++ data_sources/google_workspace.yml | 9 +++++++++ data_sources/google_workspace_login_failure.yml | 7 +++++++ data_sources/google_workspace_login_success.yml | 3 +++ data_sources/ivanti_vtm_audit.yml | 2 ++ data_sources/kubernetes_audit.yml | 16 ++++++++++++++++ data_sources/kubernetes_falco.yml | 10 ++++++++++ data_sources/linux_auditd_add_user.yml | 3 +++ data_sources/linux_auditd_cwd.yml | 3 +++ data_sources/linux_auditd_daemon_abort.yml | 3 +++ data_sources/linux_auditd_daemon_end.yml | 3 +++ data_sources/linux_auditd_daemon_start.yml | 3 +++ data_sources/linux_auditd_execve.yml | 3 +++ data_sources/linux_auditd_path.yml | 3 +++ data_sources/linux_auditd_proctitle.yml | 3 +++ data_sources/linux_auditd_service_stop.yml | 3 +++ data_sources/linux_auditd_syscall.yml | 3 +++ data_sources/linux_secure.yml | 3 +++ data_sources/m365_copilot_graph_api.yml | 2 ++ .../m365_exported_ediscovery_prompts.yml | 2 ++ data_sources/mcp_server.yml | 2 ++ data_sources/ms365_defender_incident_alerts.yml | 2 ++ data_sources/ms_defender_atp_alerts.yml | 2 ++ data_sources/nginx_access.yml | 2 ++ data_sources/ntlm_operational_8004.yml | 3 +++ data_sources/ntlm_operational_8005.yml | 3 +++ data_sources/ntlm_operational_8006.yml | 3 +++ data_sources/o365.yml | 9 +++++++++ ...5_add_app_role_assignment_grant_to_user_.yml | 3 +++ ...pp_role_assignment_to_service_principal_.yml | 3 +++ data_sources/o365_add_mailboxpermission.yml | 3 +++ data_sources/o365_add_member_to_role_.yml | 3 +++ data_sources/o365_add_owner_to_application_.yml | 3 +++ data_sources/o365_add_service_principal_.yml | 3 +++ data_sources/o365_change_user_license_.yml | 3 +++ data_sources/o365_consent_to_application_.yml | 3 +++ .../o365_disable_strong_authentication_.yml | 3 +++ data_sources/o365_mailitemsaccessed.yml | 3 +++ data_sources/o365_modifyfolderpermissions.yml | 3 +++ data_sources/o365_set_company_information_.yml | 3 +++ data_sources/o365_set_mailbox.yml | 3 +++ data_sources/o365_update_application_.yml | 3 +++ .../o365_update_authorization_policy_.yml | 3 +++ data_sources/o365_update_user_.yml | 3 +++ data_sources/o365_userloggedin.yml | 3 +++ data_sources/o365_userloginfailed.yml | 3 +++ .../office_365_reporting_message_trace.yml | 3 +++ data_sources/office_365_universal_audit_log.yml | 9 +++++++++ data_sources/okta.yml | 3 +++ data_sources/ollama_server.yml | 2 ++ data_sources/osquery.yml | 2 ++ data_sources/palo_alto_network_threat.yml | 3 +++ data_sources/palo_alto_network_traffic.yml | 3 +++ data_sources/pingid.yml | 2 ++ .../powershell_installed_iis_modules.yml | 3 +++ .../powershell_script_block_logging_4104.yml | 4 ++++ data_sources/powershell_sip_inventory.yml | 3 +++ data_sources/splunk.yml | 2 ++ ...unk_appdynamics_secure_application_alert.yml | 2 ++ .../splunk_common_information_model_(cim).yml | 2 ++ data_sources/splunk_stream_http.yml | 2 ++ data_sources/splunk_stream_ip.yml | 3 +++ data_sources/splunk_stream_tcp.yml | 3 +++ data_sources/suricata.yml | 3 +++ data_sources/sysmon_eventid_1.yml | 3 +++ data_sources/sysmon_eventid_10.yml | 3 +++ data_sources/sysmon_eventid_11.yml | 3 +++ data_sources/sysmon_eventid_12.yml | 3 +++ data_sources/sysmon_eventid_13.yml | 3 +++ data_sources/sysmon_eventid_14.yml | 3 +++ data_sources/sysmon_eventid_15.yml | 3 +++ data_sources/sysmon_eventid_17.yml | 3 +++ data_sources/sysmon_eventid_18.yml | 3 +++ data_sources/sysmon_eventid_20.yml | 3 +++ data_sources/sysmon_eventid_21.yml | 3 +++ data_sources/sysmon_eventid_22.yml | 3 +++ data_sources/sysmon_eventid_23.yml | 3 +++ data_sources/sysmon_eventid_26.yml | 3 +++ data_sources/sysmon_eventid_29.yml | 3 +++ data_sources/sysmon_eventid_3.yml | 3 +++ data_sources/sysmon_eventid_5.yml | 3 +++ data_sources/sysmon_eventid_6.yml | 3 +++ data_sources/sysmon_eventid_7.yml | 3 +++ data_sources/sysmon_eventid_8.yml | 3 +++ data_sources/sysmon_eventid_9.yml | 3 +++ data_sources/sysmon_for_linux_eventid_1.yml | 3 +++ data_sources/sysmon_for_linux_eventid_11.yml | 3 +++ data_sources/vmware_esxi_syslog.yml | 3 +++ data_sources/windows_active_directory_admon.yml | 3 +++ data_sources/windows_defender_alerts.yml | 2 ++ .../windows_event_log_application_15457.yml | 3 +++ .../windows_event_log_application_17135.yml | 3 +++ .../windows_event_log_application_2282.yml | 3 +++ .../windows_event_log_application_3000.yml | 3 +++ .../windows_event_log_application_8128.yml | 3 +++ ...dows_event_log_appxdeployment_server_400.yml | 3 +++ ...dows_event_log_appxdeployment_server_854.yml | 3 +++ ...dows_event_log_appxdeployment_server_855.yml | 3 +++ .../windows_event_log_appxpackaging_171.yml | 3 +++ data_sources/windows_event_log_capi2_70.yml | 3 +++ data_sources/windows_event_log_capi2_81.yml | 3 +++ ...event_log_certificateservicesclient_1007.yml | 3 +++ .../windows_event_log_defender_1121.yml | 3 +++ .../windows_event_log_defender_1122.yml | 3 +++ .../windows_event_log_defender_1125.yml | 3 +++ .../windows_event_log_defender_1126.yml | 3 +++ .../windows_event_log_defender_1129.yml | 3 +++ .../windows_event_log_defender_1131.yml | 3 +++ .../windows_event_log_defender_1132.yml | 3 +++ .../windows_event_log_defender_1133.yml | 3 +++ .../windows_event_log_defender_1134.yml | 3 +++ .../windows_event_log_defender_5007.yml | 3 +++ ..._windows_terminalservices_rdpclient_1024.yml | 3 +++ .../windows_event_log_printservice_316.yml | 3 +++ .../windows_event_log_printservice_4909.yml | 3 +++ .../windows_event_log_printservice_808.yml | 3 +++ ...s_event_log_remoteconnectionmanager_1149.yml | 3 +++ .../windows_event_log_security_1100.yml | 3 +++ .../windows_event_log_security_1102.yml | 3 +++ .../windows_event_log_security_4624.yml | 3 +++ .../windows_event_log_security_4625.yml | 3 +++ .../windows_event_log_security_4627.yml | 3 +++ .../windows_event_log_security_4648.yml | 3 +++ .../windows_event_log_security_4662.yml | 3 +++ .../windows_event_log_security_4663.yml | 3 +++ .../windows_event_log_security_4672.yml | 3 +++ .../windows_event_log_security_4688.yml | 3 +++ .../windows_event_log_security_4698.yml | 3 +++ .../windows_event_log_security_4699.yml | 3 +++ .../windows_event_log_security_4700.yml | 3 +++ .../windows_event_log_security_4702.yml | 3 +++ .../windows_event_log_security_4703.yml | 3 +++ .../windows_event_log_security_4719.yml | 3 +++ .../windows_event_log_security_4720.yml | 3 +++ .../windows_event_log_security_4724.yml | 3 +++ .../windows_event_log_security_4725.yml | 3 +++ .../windows_event_log_security_4726.yml | 3 +++ .../windows_event_log_security_4727.yml | 3 +++ .../windows_event_log_security_4728.yml | 3 +++ .../windows_event_log_security_4730.yml | 3 +++ .../windows_event_log_security_4731.yml | 3 +++ .../windows_event_log_security_4732.yml | 3 +++ .../windows_event_log_security_4737.yml | 3 +++ .../windows_event_log_security_4738.yml | 3 +++ .../windows_event_log_security_4739.yml | 3 +++ .../windows_event_log_security_4741.yml | 3 +++ .../windows_event_log_security_4742.yml | 3 +++ .../windows_event_log_security_4744.yml | 3 +++ .../windows_event_log_security_4749.yml | 3 +++ .../windows_event_log_security_4754.yml | 3 +++ .../windows_event_log_security_4756.yml | 3 +++ .../windows_event_log_security_4759.yml | 3 +++ .../windows_event_log_security_4768.yml | 3 +++ .../windows_event_log_security_4769.yml | 3 +++ .../windows_event_log_security_4771.yml | 3 +++ .../windows_event_log_security_4776.yml | 3 +++ .../windows_event_log_security_4781.yml | 3 +++ .../windows_event_log_security_4783.yml | 3 +++ .../windows_event_log_security_4790.yml | 3 +++ .../windows_event_log_security_4794.yml | 3 +++ .../windows_event_log_security_4798.yml | 3 +++ .../windows_event_log_security_4876.yml | 3 +++ .../windows_event_log_security_4886.yml | 3 +++ .../windows_event_log_security_4887.yml | 3 +++ .../windows_event_log_security_4946.yml | 3 +++ .../windows_event_log_security_4947.yml | 3 +++ .../windows_event_log_security_4948.yml | 3 +++ .../windows_event_log_security_5136.yml | 3 +++ .../windows_event_log_security_5137.yml | 3 +++ .../windows_event_log_security_5140.yml | 3 +++ .../windows_event_log_security_5141.yml | 3 +++ .../windows_event_log_security_5145.yml | 3 +++ data_sources/windows_event_log_system_104.yml | 3 +++ data_sources/windows_event_log_system_4720.yml | 3 +++ data_sources/windows_event_log_system_4726.yml | 3 +++ data_sources/windows_event_log_system_4728.yml | 3 +++ data_sources/windows_event_log_system_7036.yml | 3 +++ data_sources/windows_event_log_system_7040.yml | 3 +++ data_sources/windows_event_log_system_7045.yml | 3 +++ .../windows_event_log_taskscheduler_200.yml | 3 +++ .../windows_event_log_taskscheduler_201.yml | 3 +++ data_sources/windows_iis.yml | 3 +++ data_sources/windows_iis_29.yml | 3 +++ data_sources/zeek_conn.yml | 4 ++++ 301 files changed, 991 insertions(+) diff --git a/data_sources/asl_aws_cloudtrail.yml b/data_sources/asl_aws_cloudtrail.yml index 61fa81f99df..78f428643f4 100644 --- a/data_sources/asl_aws_cloudtrail.yml +++ b/data_sources/asl_aws_cloudtrail.yml @@ -19,6 +19,9 @@ mitre_components: - Cloud Storage Enumeration source: aws_asl sourcetype: aws:asl +logsource: + product: aws + service: cloudtrail separator: api.operation supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudfront.yml b/data_sources/aws_cloudfront.yml index 6ae7b8e79db..e4ada161127 100644 --- a/data_sources/aws_cloudfront.yml +++ b/data_sources/aws_cloudfront.yml @@ -14,6 +14,9 @@ mitre_components: - Cloud Service Metadata source: aws sourcetype: aws:cloudfront:accesslogs +logsource: + product: aws + service: cloudfront supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 diff --git a/data_sources/aws_cloudtrail.yml b/data_sources/aws_cloudtrail.yml index 607ca95466f..8d801000c1c 100644 --- a/data_sources/aws_cloudtrail.yml +++ b/data_sources/aws_cloudtrail.yml @@ -6,8 +6,19 @@ author: Patrick Bareiss, Splunk description: All AWS CloudTrail events source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 version: 8.1.0 +output_fields: +- dest +- user +- user_agent +- src +- vendor_account +- vendor_region +- vendor_product diff --git a/data_sources/aws_cloudtrail_assumerolewithsaml.yml b/data_sources/aws_cloudtrail_assumerolewithsaml.yml index 0bfad65eb27..e6e9146a875 100644 --- a/data_sources/aws_cloudtrail_assumerolewithsaml.yml +++ b/data_sources/aws_cloudtrail_assumerolewithsaml.yml @@ -13,6 +13,9 @@ mitre_components: - Instance Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: AssumeRoleWithSAML supported_TA: diff --git a/data_sources/aws_cloudtrail_consolelogin.yml b/data_sources/aws_cloudtrail_consolelogin.yml index f7a2f3f60be..02527b79eca 100644 --- a/data_sources/aws_cloudtrail_consolelogin.yml +++ b/data_sources/aws_cloudtrail_consolelogin.yml @@ -13,6 +13,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ConsoleLogin supported_TA: diff --git a/data_sources/aws_cloudtrail_copyobject.yml b/data_sources/aws_cloudtrail_copyobject.yml index a1df3e1a947..d8889accfd1 100644 --- a/data_sources/aws_cloudtrail_copyobject.yml +++ b/data_sources/aws_cloudtrail_copyobject.yml @@ -12,6 +12,9 @@ mitre_components: - Instance Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CopyObject supported_TA: diff --git a/data_sources/aws_cloudtrail_createaccesskey.yml b/data_sources/aws_cloudtrail_createaccesskey.yml index 20865fd1340..d95191d8dcd 100644 --- a/data_sources/aws_cloudtrail_createaccesskey.yml +++ b/data_sources/aws_cloudtrail_createaccesskey.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateAccessKey supported_TA: diff --git a/data_sources/aws_cloudtrail_createkey.yml b/data_sources/aws_cloudtrail_createkey.yml index 25e255327f7..bc825c41ee6 100644 --- a/data_sources/aws_cloudtrail_createkey.yml +++ b/data_sources/aws_cloudtrail_createkey.yml @@ -12,6 +12,9 @@ mitre_components: - Volume Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateKey supported_TA: diff --git a/data_sources/aws_cloudtrail_createloginprofile.yml b/data_sources/aws_cloudtrail_createloginprofile.yml index 3c0b2303a2c..a38a1a3cd84 100644 --- a/data_sources/aws_cloudtrail_createloginprofile.yml +++ b/data_sources/aws_cloudtrail_createloginprofile.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateLoginProfile supported_TA: diff --git a/data_sources/aws_cloudtrail_createnetworkaclentry.yml b/data_sources/aws_cloudtrail_createnetworkaclentry.yml index 3d9046cb3fc..2ea16f55453 100644 --- a/data_sources/aws_cloudtrail_createnetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_createnetworkaclentry.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateNetworkAclEntry supported_TA: diff --git a/data_sources/aws_cloudtrail_createpolicyversion.yml b/data_sources/aws_cloudtrail_createpolicyversion.yml index 1e520629652..062969783be 100644 --- a/data_sources/aws_cloudtrail_createpolicyversion.yml +++ b/data_sources/aws_cloudtrail_createpolicyversion.yml @@ -12,6 +12,9 @@ mitre_components: - Group Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreatePolicyVersion supported_TA: diff --git a/data_sources/aws_cloudtrail_createsnapshot.yml b/data_sources/aws_cloudtrail_createsnapshot.yml index ccc7dacf884..66a752243e0 100644 --- a/data_sources/aws_cloudtrail_createsnapshot.yml +++ b/data_sources/aws_cloudtrail_createsnapshot.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateSnapshot supported_TA: diff --git a/data_sources/aws_cloudtrail_createtask.yml b/data_sources/aws_cloudtrail_createtask.yml index 1eb53e2efa4..6b9f2f0e4c9 100644 --- a/data_sources/aws_cloudtrail_createtask.yml +++ b/data_sources/aws_cloudtrail_createtask.yml @@ -12,6 +12,9 @@ mitre_components: - Instance Creation source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateTask supported_TA: diff --git a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml index d7d962b20de..028cb2c3880 100644 --- a/data_sources/aws_cloudtrail_createvirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_createvirtualmfadevice.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: CreateVirtualMFADevice supported_TA: diff --git a/data_sources/aws_cloudtrail_deactivatemfadevice.yml b/data_sources/aws_cloudtrail_deactivatemfadevice.yml index c0a34bb4bb8..522b2183f8b 100644 --- a/data_sources/aws_cloudtrail_deactivatemfadevice.yml +++ b/data_sources/aws_cloudtrail_deactivatemfadevice.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeactivateMFADevice supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml index ca8398149ba..99fbb7f1563 100644 --- a/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_deleteaccountpasswordpolicy.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteAccountPasswordPolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_deletealarms.yml b/data_sources/aws_cloudtrail_deletealarms.yml index d7eca9e7737..3fb70f7fd27 100644 --- a/data_sources/aws_cloudtrail_deletealarms.yml +++ b/data_sources/aws_cloudtrail_deletealarms.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteAlarms supported_TA: diff --git a/data_sources/aws_cloudtrail_deletedetector.yml b/data_sources/aws_cloudtrail_deletedetector.yml index 459498c1c11..c3379bd5bfc 100644 --- a/data_sources/aws_cloudtrail_deletedetector.yml +++ b/data_sources/aws_cloudtrail_deletedetector.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteDetector supported_TA: diff --git a/data_sources/aws_cloudtrail_deletegroup.yml b/data_sources/aws_cloudtrail_deletegroup.yml index 014656f8a77..97a96b46329 100644 --- a/data_sources/aws_cloudtrail_deletegroup.yml +++ b/data_sources/aws_cloudtrail_deletegroup.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteGroup supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml index d59dd5ddd6c..1024e7d2097 100644 --- a/data_sources/aws_cloudtrail_deleteguardrail.yml +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -8,6 +8,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteGuardrail supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteipset.yml b/data_sources/aws_cloudtrail_deleteipset.yml index 5cad8166d31..f852eacb90c 100644 --- a/data_sources/aws_cloudtrail_deleteipset.yml +++ b/data_sources/aws_cloudtrail_deleteipset.yml @@ -11,6 +11,9 @@ mitre_components: - Firewall Rule Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteIPSet supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml index 439984e4368..55f55a2d309 100644 --- a/data_sources/aws_cloudtrail_deleteknowledgebase.yml +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -8,6 +8,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteKnowledgeBase supported_TA: diff --git a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml index 518b1f3a933..b10983ae115 100644 --- a/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deleteloggingconfiguration.yml @@ -6,6 +6,9 @@ author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteLoggingConfiguration source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_deleteloggroup.yml b/data_sources/aws_cloudtrail_deleteloggroup.yml index a80bd0daf28..44f45891034 100644 --- a/data_sources/aws_cloudtrail_deleteloggroup.yml +++ b/data_sources/aws_cloudtrail_deleteloggroup.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteLogGroup supported_TA: diff --git a/data_sources/aws_cloudtrail_deletelogstream.yml b/data_sources/aws_cloudtrail_deletelogstream.yml index cce0f17b070..87e3dd831e9 100644 --- a/data_sources/aws_cloudtrail_deletelogstream.yml +++ b/data_sources/aws_cloudtrail_deletelogstream.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteLogStream supported_TA: diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml index 1d1e2c53108..b3d79012e19 100644 --- a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteModelInvocationLoggingConfiguration supported_TA: diff --git a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml index 562d7deb6ad..3726eaa22d2 100644 --- a/data_sources/aws_cloudtrail_deletenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_deletenetworkaclentry.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteNetworkAclEntry supported_TA: diff --git a/data_sources/aws_cloudtrail_deletepolicy.yml b/data_sources/aws_cloudtrail_deletepolicy.yml index 4dec45ec87d..120eed6a782 100644 --- a/data_sources/aws_cloudtrail_deletepolicy.yml +++ b/data_sources/aws_cloudtrail_deletepolicy.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeletePolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_deleterule.yml b/data_sources/aws_cloudtrail_deleterule.yml index 398fd7dd0a8..2c983d8f50f 100644 --- a/data_sources/aws_cloudtrail_deleterule.yml +++ b/data_sources/aws_cloudtrail_deleterule.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteRule supported_TA: diff --git a/data_sources/aws_cloudtrail_deleterulegroup.yml b/data_sources/aws_cloudtrail_deleterulegroup.yml index e36a6b2801e..3c040b76499 100644 --- a/data_sources/aws_cloudtrail_deleterulegroup.yml +++ b/data_sources/aws_cloudtrail_deleterulegroup.yml @@ -6,6 +6,9 @@ author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DeleteRuleGroup source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_deletesnapshot.yml b/data_sources/aws_cloudtrail_deletesnapshot.yml index be3616bd4ac..5271509f761 100644 --- a/data_sources/aws_cloudtrail_deletesnapshot.yml +++ b/data_sources/aws_cloudtrail_deletesnapshot.yml @@ -12,6 +12,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteSnapshot supported_TA: diff --git a/data_sources/aws_cloudtrail_deletetrail.yml b/data_sources/aws_cloudtrail_deletetrail.yml index 806c1c61035..39666749f8b 100644 --- a/data_sources/aws_cloudtrail_deletetrail.yml +++ b/data_sources/aws_cloudtrail_deletetrail.yml @@ -12,6 +12,9 @@ mitre_components: - Host Status source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteTrail supported_TA: diff --git a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml index 740ca776eae..a293e05cfc4 100644 --- a/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml +++ b/data_sources/aws_cloudtrail_deletevirtualmfadevice.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Deletion source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteVirtualMFADevice supported_TA: diff --git a/data_sources/aws_cloudtrail_deletewebacl.yml b/data_sources/aws_cloudtrail_deletewebacl.yml index 7d864f0b2da..01573e2cabe 100644 --- a/data_sources/aws_cloudtrail_deletewebacl.yml +++ b/data_sources/aws_cloudtrail_deletewebacl.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DeleteWebACL supported_TA: diff --git a/data_sources/aws_cloudtrail_describeeventaggregates.yml b/data_sources/aws_cloudtrail_describeeventaggregates.yml index 47ea2cbadc8..831f045401a 100644 --- a/data_sources/aws_cloudtrail_describeeventaggregates.yml +++ b/data_sources/aws_cloudtrail_describeeventaggregates.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DescribeEventAggregates supported_TA: diff --git a/data_sources/aws_cloudtrail_describeimagescanfindings.yml b/data_sources/aws_cloudtrail_describeimagescanfindings.yml index b771deaff2c..5c9c20f10b0 100644 --- a/data_sources/aws_cloudtrail_describeimagescanfindings.yml +++ b/data_sources/aws_cloudtrail_describeimagescanfindings.yml @@ -11,6 +11,9 @@ mitre_components: - Malware Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: DescribeImageScanFindings supported_TA: diff --git a/data_sources/aws_cloudtrail_describesnapshotattribute.yml b/data_sources/aws_cloudtrail_describesnapshotattribute.yml index d5770d94c93..985cdd4f15f 100644 --- a/data_sources/aws_cloudtrail_describesnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_describesnapshotattribute.yml @@ -6,6 +6,9 @@ author: Bhavin Patel, Splunk description: Data source object for AWS CloudTrail DescribeSnapshotAttribute source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml index 5567dc51fa2..ab43a2d00c6 100644 --- a/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_getaccountpasswordpolicy.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: GetAccountPasswordPolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_getobject.yml b/data_sources/aws_cloudtrail_getobject.yml index c53871aaf00..4d406cb05f9 100644 --- a/data_sources/aws_cloudtrail_getobject.yml +++ b/data_sources/aws_cloudtrail_getobject.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Storage Enumeration source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: GetObject supported_TA: diff --git a/data_sources/aws_cloudtrail_getpassworddata.yml b/data_sources/aws_cloudtrail_getpassworddata.yml index 619538f4916..f2c0cac07e3 100644 --- a/data_sources/aws_cloudtrail_getpassworddata.yml +++ b/data_sources/aws_cloudtrail_getpassworddata.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Authentication source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: GetPasswordData supported_TA: diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml index 5eaaf74652b..3d5777bf411 100644 --- a/data_sources/aws_cloudtrail_invokemodel.yml +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -8,6 +8,9 @@ mitre_components: - Cloud Service Usage source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: InvokeModel supported_TA: diff --git a/data_sources/aws_cloudtrail_jobcreated.yml b/data_sources/aws_cloudtrail_jobcreated.yml index 0cfd392924a..d567b2270af 100644 --- a/data_sources/aws_cloudtrail_jobcreated.yml +++ b/data_sources/aws_cloudtrail_jobcreated.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: JobCreated supported_TA: diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml index 56e88f9496a..c04f483f5d8 100644 --- a/data_sources/aws_cloudtrail_listfoundationmodels.yml +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Discovery source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ListFoundationModels supported_TA: diff --git a/data_sources/aws_cloudtrail_modifydbinstance.yml b/data_sources/aws_cloudtrail_modifydbinstance.yml index f94f0869626..2d664a3dcf5 100644 --- a/data_sources/aws_cloudtrail_modifydbinstance.yml +++ b/data_sources/aws_cloudtrail_modifydbinstance.yml @@ -11,6 +11,9 @@ mitre_components: - Instance Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ModifyDBInstance supported_TA: diff --git a/data_sources/aws_cloudtrail_modifyimageattribute.yml b/data_sources/aws_cloudtrail_modifyimageattribute.yml index a34488351ce..6272b48e5a7 100644 --- a/data_sources/aws_cloudtrail_modifyimageattribute.yml +++ b/data_sources/aws_cloudtrail_modifyimageattribute.yml @@ -10,6 +10,9 @@ mitre_components: - Image Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ModifyImageAttribute supported_TA: diff --git a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml index 8a430fd294e..7a3949f08ef 100644 --- a/data_sources/aws_cloudtrail_modifysnapshotattribute.yml +++ b/data_sources/aws_cloudtrail_modifysnapshotattribute.yml @@ -9,6 +9,9 @@ mitre_components: - Snapshot Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ModifySnapshotAttribute supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketacl.yml b/data_sources/aws_cloudtrail_putbucketacl.yml index 2b8fcca09e9..3c2791e9eb1 100644 --- a/data_sources/aws_cloudtrail_putbucketacl.yml +++ b/data_sources/aws_cloudtrail_putbucketacl.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Storage Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketAcl supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketlifecycle.yml b/data_sources/aws_cloudtrail_putbucketlifecycle.yml index 753a04aede7..f70cc20282c 100644 --- a/data_sources/aws_cloudtrail_putbucketlifecycle.yml +++ b/data_sources/aws_cloudtrail_putbucketlifecycle.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Storage Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketLifecycle supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketreplication.yml b/data_sources/aws_cloudtrail_putbucketreplication.yml index b7f0ee2cac5..a86be98b172 100644 --- a/data_sources/aws_cloudtrail_putbucketreplication.yml +++ b/data_sources/aws_cloudtrail_putbucketreplication.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Storage Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketReplication supported_TA: diff --git a/data_sources/aws_cloudtrail_putbucketversioning.yml b/data_sources/aws_cloudtrail_putbucketversioning.yml index 59e40ad28c7..c7e82a4078f 100644 --- a/data_sources/aws_cloudtrail_putbucketversioning.yml +++ b/data_sources/aws_cloudtrail_putbucketversioning.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Storage Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutBucketVersioning supported_TA: diff --git a/data_sources/aws_cloudtrail_putimage.yml b/data_sources/aws_cloudtrail_putimage.yml index f2344aa81ba..fe519b9710f 100644 --- a/data_sources/aws_cloudtrail_putimage.yml +++ b/data_sources/aws_cloudtrail_putimage.yml @@ -10,6 +10,9 @@ mitre_components: - Image Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: PutImage supported_TA: diff --git a/data_sources/aws_cloudtrail_putkeypolicy.yml b/data_sources/aws_cloudtrail_putkeypolicy.yml index 2b537f36f6f..5efdc040360 100644 --- a/data_sources/aws_cloudtrail_putkeypolicy.yml +++ b/data_sources/aws_cloudtrail_putkeypolicy.yml @@ -7,6 +7,9 @@ description: Logs changes made to AWS Key Management Service (KMS) key policies, updates and permission assignments. source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName supported_TA: - name: Splunk Add-on for AWS diff --git a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml index 9bf2f78bccf..9e03e182963 100644 --- a/data_sources/aws_cloudtrail_replacenetworkaclentry.yml +++ b/data_sources/aws_cloudtrail_replacenetworkaclentry.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: ReplaceNetworkAclEntry supported_TA: diff --git a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml index c4f1b916d44..a8bd2e5b020 100644 --- a/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml +++ b/data_sources/aws_cloudtrail_setdefaultpolicyversion.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: SetDefaultPolicyVersion supported_TA: diff --git a/data_sources/aws_cloudtrail_stoplogging.yml b/data_sources/aws_cloudtrail_stoplogging.yml index 414b1133b35..5ce9464aa60 100644 --- a/data_sources/aws_cloudtrail_stoplogging.yml +++ b/data_sources/aws_cloudtrail_stoplogging.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Disable source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: StopLogging supported_TA: diff --git a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml index 8ac82dec7e3..fd5055e794e 100644 --- a/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml +++ b/data_sources/aws_cloudtrail_updateaccountpasswordpolicy.yml @@ -9,6 +9,9 @@ mitre_components: - Cloud Service Modification source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateAccountPasswordPolicy supported_TA: diff --git a/data_sources/aws_cloudtrail_updateloginprofile.yml b/data_sources/aws_cloudtrail_updateloginprofile.yml index 518bb3f96b0..7920ed71cba 100644 --- a/data_sources/aws_cloudtrail_updateloginprofile.yml +++ b/data_sources/aws_cloudtrail_updateloginprofile.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Authentication source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateLoginProfile supported_TA: diff --git a/data_sources/aws_cloudtrail_updatesamlprovider.yml b/data_sources/aws_cloudtrail_updatesamlprovider.yml index 6dc01bfc328..8a1799b1a54 100644 --- a/data_sources/aws_cloudtrail_updatesamlprovider.yml +++ b/data_sources/aws_cloudtrail_updatesamlprovider.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateSAMLProvider supported_TA: diff --git a/data_sources/aws_cloudtrail_updatetrail.yml b/data_sources/aws_cloudtrail_updatetrail.yml index 0d6ffa07711..4a48aac952c 100644 --- a/data_sources/aws_cloudtrail_updatetrail.yml +++ b/data_sources/aws_cloudtrail_updatetrail.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: aws_cloudtrail sourcetype: aws:cloudtrail +logsource: + product: aws + service: cloudtrail separator: eventName separator_value: UpdateTrail supported_TA: diff --git a/data_sources/aws_cloudwatchlogs_vpcflow.yml b/data_sources/aws_cloudwatchlogs_vpcflow.yml index 87aa66d5fa9..b27032d7ed1 100644 --- a/data_sources/aws_cloudwatchlogs_vpcflow.yml +++ b/data_sources/aws_cloudwatchlogs_vpcflow.yml @@ -11,6 +11,10 @@ mitre_components: - Network Connection Creation source: aws_cloudwatchlogs_vpcflow sourcetype: aws:cloudwatchlogs:vpcflow +logsource: + category: network + product: aws + service: vpcflow supported_TA: - name: Splunk Add-on for AWS version: 8.1.0 diff --git a/data_sources/aws_security_hub.yml b/data_sources/aws_security_hub.yml index 86e66fd0ec4..9d6792839e5 100644 --- a/data_sources/aws_security_hub.yml +++ b/data_sources/aws_security_hub.yml @@ -12,6 +12,8 @@ mitre_components: - Cloud Service Disable source: aws_securityhub_finding sourcetype: aws:securityhub:finding +logsource: + product: aws supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 @@ -127,3 +129,6 @@ example_log: '{"ProductArn":"arn:aws:securityhub:us-east-1::product/aws/guarddut reads of objects in S3 bucket GeneratedFindingS3Bucket.","Workflow":{"Status":"NEW"},"LastObservedAt":"2020-09-28T22:26:15.636Z","Severity":{"Normalized":20,"Label":"LOW","Product":2},"UpdatedAt":"2020-09-28T22:26:15.636Z","WorkflowState":"NEW","ProductFields":{"aws/guardduty/service/archived":"false","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asnOrg":"GeneratedFindingASNOrg","aws/guardduty/service/additionalInfo/unusual/userNames.0_":"GeneratedFindingUserName","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/org":"GeneratedFindingORG","aws/guardduty/service/resourceRole":"TARGET","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/isp":"GeneratedFindingISP","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lat":"0","aws/guardduty/service/count":"1","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/ipAddressV4":"198.51.100.0","aws/guardduty/service/additionalInfo/sample":"true","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/country/countryName":"GeneratedFindingCountryName","aws/guardduty/service/action/awsApiCallAction/callerType":"Remote IP","aws/guardduty/service/action/awsApiCallAction/serviceName":"GeneratedFindingAPIServiceName","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/city/cityName":"GeneratedFindingCityName","aws/guardduty/service/action/awsApiCallAction/api":"GeneratedFindingAPIName","aws/guardduty/service/serviceName":"guardduty","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/geoLocation/lon":"0","aws/guardduty/service/detectorId":"48ba636359b884eb132865311fdeb317","aws/guardduty/service/action/awsApiCallAction/remoteIpDetails/organization/asn":"-1","aws/guardduty/service/eventFirstSeen":"2020-09-28T22:26:15.636Z","aws/guardduty/service/action/awsApiCallAction/affectedResources/AWS::S3::Bucket":"GeneratedFindingS3Bucket","aws/guardduty/service/eventLastSeen":"2020-09-28T22:26:15.636Z","aws/guardduty/service/additionalInfo/unusual/hoursOfDay.0_":"1513609200000","aws/guardduty/service/action/actionType":"AWS_API_CALL","aws/securityhub/FindingId":"arn:aws:securityhub:us-east-1::product/aws/guardduty/arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317/finding/6aba6b696aea10606e8b336f68d98819","aws/securityhub/ProductName":"GuardDuty","aws/securityhub/CompanyName":"Amazon"},"AwsAccountId":"802684071507","Id":"arn:aws:guardduty:us-east-1:802684071507:detector/48ba636359b884eb132865311fdeb317/finding/6aba6b696aea10606e8b336f68d98819","Resources":[{"Partition":"aws","Type":"AwsEc2Instance","Details":{"AwsEc2Instance":{"Type":"m3.xlarge","VpcId":"GeneratedFindingVPCId","ImageId":"ami-99999999","IpV4Addresses":["10.0.0.1","198.51.100.0"],"SubnetId":"GeneratedFindingSubnetId","LaunchedAt":"2016-08-02T02:05:06Z","IamInstanceProfileArn":"arn:aws:iam::802684071507:example/instance/profile"}},"Region":"us-east-1","Id":"arn:aws:ec2:us-east-1:802684071507:instance/i-99999999","Tags":{"GeneratedFindingInstaceTag7":"GeneratedFindingInstaceTagValue7","GeneratedFindingInstaceTag8":"GeneratedFindingInstaceTagValue8","GeneratedFindingInstaceTag9":"GeneratedFindingInstaceTagValue9","GeneratedFindingInstaceTag1":"GeneratedFindingInstaceValue1","GeneratedFindingInstaceTag2":"GeneratedFindingInstaceTagValue2","GeneratedFindingInstaceTag3":"GeneratedFindingInstaceTagValue3","GeneratedFindingInstaceTag4":"GeneratedFindingInstaceTagValue4","GeneratedFindingInstaceTag5":"GeneratedFindingInstaceTagValue5","GeneratedFindingInstaceTag6":"GeneratedFindingInstaceTagValue6"}},{"Partition":"aws","Type":"AwsIamAccessKey","Details":{"AwsIamAccessKey":{"PrincipalId":"GeneratedFindingPrincipalId","PrincipalName":"GeneratedFindingUserName","PrincipalType":"IAMUser"}},"Region":"us-east-1","Id":"AWS::IAM::AccessKey:GeneratedFindingAccessKeyId"},{"Partition":"aws","Type":"AwsS3Bucket","Details":{"AwsS3Bucket":{"OwnerId":"CanonicalId of Owner","CreatedAt":"2017-12-18T15:58:11.551Z","ServerSideEncryptionConfiguration":{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"SSEAlgorithm","KMSMasterKeyID":"arn:aws:kms:region:123456789012:key/key-id"}}]}}},"Region":"us-east-1","Id":"arn:aws:s3:::bucketName","Tags":{"foo":"bar"}}]}' +output_fields: +- dest +- user diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index cc4e50ddddf..e1862f770a3 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -6,6 +6,9 @@ author: Patrick Bareiss, Splunk description: All Azure Active Directory events source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index e297eb5a277..3869fbf15e6 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -13,6 +13,9 @@ mitre_components: - Cloud Service Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add app role assignment to service principal supported_TA: diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 78fafcc82b5..83a0187b4e7 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -13,6 +13,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add member to role supported_TA: diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index f938018d992..98797e74ae7 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -13,6 +13,9 @@ mitre_components: - Cloud Service Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add owner to application supported_TA: diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 56b97e062e3..cf51fd99204 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -13,6 +13,9 @@ mitre_components: - Active Directory Object Creation source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add service principal supported_TA: diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 76e16cdd2d2..49330a89147 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -12,6 +12,9 @@ mitre_components: - Configuration Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Add unverified domain supported_TA: diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 307374437fb..ac76cf04b62 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -13,6 +13,9 @@ mitre_components: - Configuration Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Consent to application supported_TA: diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index f280a63cbb0..b9526d26a97 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Disable Strong Authentication supported_TA: diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index a65079bbfa7..0bfd02aa477 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Enable account supported_TA: diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 1c664c6534f..6e2b626a729 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -11,6 +11,9 @@ mitre_components: - User Account Authentication source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Invite external user supported_TA: diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index d14b21a5e29..006e5033ad5 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -6,6 +6,8 @@ author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory MicrosoftGraphActivityLogs source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services @@ -32,3 +34,9 @@ example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/2 "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' +output_fields: +- dest +- user +- src +- vendor_account +- vendor_product diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index e9bb1f79fbb..d623578d68a 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -6,6 +6,9 @@ author: Bhavin Patel, Splunk description: Data source object for Azure Active Directory NonInteractiveUserSignInLogs source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: signinlogs separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services @@ -170,3 +173,9 @@ example_log: '{"time": "2023-01-12T19:22:14.5285742Z", "resourceId": "/tenants/9 "authenticationStrengths": [], "incomingTokenType": "primaryRefreshToken", "authenticationProtocol": "none", "appServicePrincipalId": null, "resourceServicePrincipalId": null, "rngcStatus": 0}}' +output_fields: +- dest +- user +- src +- vendor_account +- vendor_product diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index d2a0e08a133..31af250e67f 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -11,6 +11,9 @@ mitre_components: - Active Directory Object Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Reset password (by admin) supported_TA: diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index cdf0e2b189f..4c57283bafd 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Set domain authentication supported_TA: diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index a0095fcef75..b04f9493aea 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -11,6 +11,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: signinlogs separator: operationName separator_value: Sign-in activity supported_TA: diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index f723bea62a5..fbf6271885a 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -11,6 +11,9 @@ mitre_components: - Cloud Service Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Update application supported_TA: diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index f0e0c7fb5f8..760e0b56ed7 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -11,6 +11,9 @@ mitre_components: - Active Directory Object Modification source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Update authorization policy supported_TA: diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 56e026cf7b7..4c094ac6d48 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: Update user supported_TA: diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index 4503dadc7f4..8b0ca1ecf40 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -10,6 +10,9 @@ mitre_components: - User Account Metadata source: Azure AD sourcetype: azure:monitor:aad +logsource: + product: azure + service: auditlogs separator: operationName separator_value: User registered security info supported_TA: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 304f8a3fc45..6e66a2aec19 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -10,6 +10,9 @@ mitre_components: - Cloud Service Metadata source: mscs:azure:audit sourcetype: mscs:azure:audit +logsource: + product: azure + service: activitylogs separator: operationName.localizedValue separator_value: Create or Update an Azure Automation account supported_TA: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index cac7a56509c..82e5da1486d 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -10,6 +10,9 @@ mitre_components: - Scheduled Job Creation source: mscs:azure:audit sourcetype: mscs:azure:audit +logsource: + product: azure + service: activitylogs separator: operationName.localizedValue separator_value: Create or Update an Azure Automation Runbook supported_TA: diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 95beb13f6e7..2e62e8c7e87 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -10,6 +10,9 @@ mitre_components: - Scheduled Job Metadata source: mscs:azure:audit sourcetype: mscs:azure:audit +logsource: + product: azure + service: activitylogs separator: operationName.localizedValue separator_value: Create or Update an Azure Automation webhook supported_TA: diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 13c8a8a8177..3570390db6d 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -9,6 +9,9 @@ description: Data source object for Azure Monitor Activity. The Splunk Add-on f settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD sourcetype: azure:monitor:activity +logsource: + product: azure + service: activitylogs separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services diff --git a/data_sources/bro_conn.yml b/data_sources/bro_conn.yml index e30e70818ab..e90379f52a9 100644 --- a/data_sources/bro_conn.yml +++ b/data_sources/bro_conn.yml @@ -12,6 +12,10 @@ mitre_components: - Application Log Content source: bro:conn:json sourcetype: bro:conn:json +logsource: + category: network + product: zeek + service: connection supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_dns.yml b/data_sources/bro_dns.yml index d8634cc0906..966282ca9b0 100644 --- a/data_sources/bro_dns.yml +++ b/data_sources/bro_dns.yml @@ -13,6 +13,9 @@ mitre_components: - Response Metadata source: bro:dns:json sourcetype: bro:dns:json +logsource: + product: zeek + service: dns supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_files.yml b/data_sources/bro_files.yml index 79c04653cbc..6c421b2a17f 100644 --- a/data_sources/bro_files.yml +++ b/data_sources/bro_files.yml @@ -14,6 +14,9 @@ mitre_components: - Application Log Content source: bro:files:json sourcetype: bro:files:json +logsource: + product: zeek + service: files supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_http.yml b/data_sources/bro_http.yml index ff187411b3e..b710847af8b 100644 --- a/data_sources/bro_http.yml +++ b/data_sources/bro_http.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: bro:http:json sourcetype: bro:http:json +logsource: + product: zeek + service: http supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_loaded_scripts.yml b/data_sources/bro_loaded_scripts.yml index df7a99696df..5ebe3660839 100644 --- a/data_sources/bro_loaded_scripts.yml +++ b/data_sources/bro_loaded_scripts.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: bro:loaded_scripts:json sourcetype: bro:loaded_scripts:json +logsource: + product: zeek + service: loaded_scripts supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_ntp.yml b/data_sources/bro_ntp.yml index 0bd08ad6ef1..f73d81579b9 100644 --- a/data_sources/bro_ntp.yml +++ b/data_sources/bro_ntp.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: bro:ntp:json sourcetype: bro:ntp:json +logsource: + product: zeek + service: ntp supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_ocsp.yml b/data_sources/bro_ocsp.yml index c091b2b4c05..ba344f6ac79 100644 --- a/data_sources/bro_ocsp.yml +++ b/data_sources/bro_ocsp.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: bro:ocsp:json sourcetype: bro:ocsp:json +logsource: + product: zeek + service: ocsp supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_ssl.yml b/data_sources/bro_ssl.yml index ed2dd04ec9f..c20e6c5e737 100644 --- a/data_sources/bro_ssl.yml +++ b/data_sources/bro_ssl.yml @@ -13,6 +13,9 @@ mitre_components: - Application Log Content source: bro:ssl:json sourcetype: bro:ssl:json +logsource: + product: zeek + service: ssl supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_weird.yml b/data_sources/bro_weird.yml index 8bfbfa57c26..4be678c4eff 100644 --- a/data_sources/bro_weird.yml +++ b/data_sources/bro_weird.yml @@ -13,6 +13,9 @@ mitre_components: - Host Status source: bro:weird:json sourcetype: bro:weird:json +logsource: + product: zeek + service: weird supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/bro_x509.yml b/data_sources/bro_x509.yml index 220cc54412e..5167ef46bc8 100644 --- a/data_sources/bro_x509.yml +++ b/data_sources/bro_x509.yml @@ -13,6 +13,9 @@ mitre_components: - Host Status source: bro:x509:json sourcetype: bro:x509:json +logsource: + product: zeek + service: x509 supported_TA: - name: TA for Zeek url: https://splunkbase.splunk.com/app/5466 diff --git a/data_sources/circleci.yml b/data_sources/circleci.yml index dc231daca73..ebe607211ed 100644 --- a/data_sources/circleci.yml +++ b/data_sources/circleci.yml @@ -13,6 +13,8 @@ mitre_components: - Host Status source: circleci sourcetype: circleci +logsource: + product: circleci supported_TA: - name: App for CircleCI url: https://splunkbase.splunk.com/app/5162 diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index 185368d248f..ca0baa22370 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -6,6 +6,9 @@ author: Bhavin Patel description: Data source object for Cisco AI Defense Alerts source: cisco_ai_defense sourcetype: cisco:ai:defense +logsource: + product: cisco + service: ai_defense separator: null supported_TA: - name: Cisco Security Cloud diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 8b1f3f3f84b..b8f992b66ce 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -17,6 +17,9 @@ description: "Data source object for Cisco ASA system logs. Cisco ASA logs provi \ \n" source: not_applicable sourcetype: cisco:asa +logsource: + product: cisco + service: asa separator: null supported_TA: - name: Cisco Security Cloud diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 04edd15118e..e971538e4c8 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -6,6 +6,9 @@ author: Patrick Bareiss, Splunk description: Data source object for Cisco Duo Activity source: cisco_duo sourcetype: cisco:duo:activity +logsource: + product: cisco + service: duo separator: null supported_TA: - name: Cisco Security Cloud diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index 47efc5e28fa..e9022bfe2d6 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -6,6 +6,9 @@ author: Patrick Bareiss, Splunk description: Data source object for Cisco Duo Administrator source: cisco_duo sourcetype: cisco:duo:administrator +logsource: + product: cisco + service: duo separator: null supported_TA: - name: Cisco Security Cloud diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index 76fdb5228de..77a4108ed63 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -14,6 +14,9 @@ description: Data source object for Cisco IOS system logs. Cisco IOS logs provid data is ingested via SYSLOG. source: cisco:ios sourcetype: cisco:ios +logsource: + product: cisco + service: ios separator: null supported_TA: - name: Cisco Networks Add-on diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index 90212a823a8..f0c6111dcfd 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,6 +10,9 @@ description: "Captures detailed process connection events\u2014including source \ network flows in cloud-native environments." source: not_applicable sourcetype: cisco:isovalent:processConnect +logsource: + category: network_connection + product: linux supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 83db37c5743..08e4201c7e5 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -7,6 +7,9 @@ description: Logs process execution events within Cisco Isovalent environments, visibility into process exec ancestry and Kubernetes workload identity. source: not_applicable sourcetype: cisco:isovalent:processExec +logsource: + category: process_creation + product: linux supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 2efacde64d1..0c921508cdf 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -9,6 +9,8 @@ description: Captures kernel probe (kprobe) telemetry from Cisco Isovalent Runti system tampering. source: not_applicable sourcetype: cisco:isovalent +logsource: + product: linux supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_network_visibility_module_flow_data.yml b/data_sources/cisco_network_visibility_module_flow_data.yml index ebe5e343314..9a6b9c61908 100644 --- a/data_sources/cisco_network_visibility_module_flow_data.yml +++ b/data_sources/cisco_network_visibility_module_flow_data.yml @@ -6,6 +6,10 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for Netflow events from Cisco Network Visibility Module source: not_applicable sourcetype: cisco:nvm:flowdata +logsource: + category: network + product: cisco + service: netflow supported_TA: - name: Cisco NVM Add-on for Splunk url: https://splunkbase.splunk.com/app/4221 diff --git a/data_sources/cisco_network_visibility_module_osquery.yml b/data_sources/cisco_network_visibility_module_osquery.yml index 352bca1a45e..6511e6e643a 100644 --- a/data_sources/cisco_network_visibility_module_osquery.yml +++ b/data_sources/cisco_network_visibility_module_osquery.yml @@ -6,6 +6,8 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for OSquery events from Cisco Network Visibility Module source: not_applicable sourcetype: cisco:nvm:osquery +logsource: + product: osquery supported_TA: - name: Cisco NVM Add-on for Splunk url: https://splunkbase.splunk.com/app/4221 diff --git a/data_sources/cisco_sd_wan_ntce_1000001.yml b/data_sources/cisco_sd_wan_ntce_1000001.yml index 7330a63db4d..d364b707bfd 100644 --- a/data_sources/cisco_sd_wan_ntce_1000001.yml +++ b/data_sources/cisco_sd_wan_ntce_1000001.yml @@ -6,6 +6,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for Cisco SD-WAN Notification Event 1000001 source: /var/log/vsyslog sourcetype: cisco:sdwan:syslog +logsource: + product: cisco + service: syslog supported_TA: [] fields: - _time diff --git a/data_sources/cisco_sd_wan_service_proxy_access_logs.yml b/data_sources/cisco_sd_wan_service_proxy_access_logs.yml index 53a227af18c..8bf654e677e 100644 --- a/data_sources/cisco_sd_wan_service_proxy_access_logs.yml +++ b/data_sources/cisco_sd_wan_service_proxy_access_logs.yml @@ -6,6 +6,9 @@ author: Nasreddine Bencherchali, Splunk description: Data source object for Cisco SD-WAN Service Proxy Access Logs source: /var/log/nms/containers/service-proxy/serviceproxy-access.log sourcetype: cisco:sdwan:access +logsource: + category: webserver + product: cisco supported_TA: [] fields: - _time diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index 3ed63d42722..2b7e6775deb 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -7,6 +7,9 @@ description: Data source object for raw connection events from Cisco Secure Fire Threat Defense source: not_applicable sourcetype: cisco:sfw:estreamer +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index acbea9461bc..8d136b1b430 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -7,6 +7,9 @@ description: Data source object for raw file events from Cisco Secure Firewall T Defense source: not_applicable sourcetype: cisco:sfw:estreamer +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 0cc0593a8f5..ac42bf0447e 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -7,6 +7,9 @@ description: Data source object for raw intrusion events from Cisco Secure Firew Threat Defense source: not_applicable sourcetype: cisco:sfw:estreamer +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 9e15c4f9108..56a8c71f7dd 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -12,6 +12,8 @@ mitre_components: - OS API Execution source: CrowdStrike:Event:Streams sourcetype: CrowdStrike:Event:Streams:JSON +logsource: + product: crowdstrike separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 0f52aa3f243..8b56748a575 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -14,6 +14,9 @@ mitre_components: - OS API Execution source: crowdstrike sourcetype: crowdstrike:events:sensor +logsource: + category: process_creation + product: windows separator: event_simpleName separator_value: ProcessRollup2 supported_TA: diff --git a/data_sources/crushftp.yml b/data_sources/crushftp.yml index 597fda30f8c..abff285abf5 100644 --- a/data_sources/crushftp.yml +++ b/data_sources/crushftp.yml @@ -13,6 +13,8 @@ mitre_components: - Network Traffic Content source: crushftp sourcetype: crushftp:sessionlogs +logsource: + product: crushftp supported_TA: [] fields: - _time diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index fa4d545a336..9f2d094dcd3 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -13,6 +13,8 @@ mitre_components: - Cloud Storage Metadata source: http:gsuite sourcetype: gsuite:drive:json +logsource: + product: gcp supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 @@ -58,3 +60,12 @@ example_log: '{"type": "acl_change", "name": "change_user_access", "parameters": false, "owner": "peter@external_test_email.com", "owner_is_shared_drive": false, "owner_is_team_drive": false}, "email": "peter@external_test_email.com", "unique_id": "123456789", "ip_address": "null", "timestamp": "2021-08-23T09:19:08.200Z"}' +output_fields: +- parameters.owner +- ip_address +- phase +- severity +- email +- parameters.target_user +- parameters.doc_title +- parameters.doc_type diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index e0b1eff8e2a..c633a7cb53d 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -12,6 +12,8 @@ mitre_components: - Cloud Service Metadata source: http:gsuite sourcetype: gsuite:gmail:bigquery +logsource: + product: gcp supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 @@ -113,3 +115,11 @@ example_log: '{"action_type": 10, "rfc2822_message_id": " Date: Tue, 15 Sep 2026 14:57:04 +0200 Subject: [PATCH 2/2] data source improvement --- data_sources/aws_bedrock_claude.yml | 2 ++ data_sources/cisco_sd_wan_auth_log.yml | 3 ++ data_sources/cisco_secure_access_dns.yml | 3 ++ data_sources/cisco_secure_access_firewall.yml | 3 ++ data_sources/cisco_secure_access_proxy.yml | 3 ++ data_sources/linux_messages_syslog.yml | 3 ++ data_sources/osquery_results.yml | 2 ++ data_sources/sysmon_eventid_24.yml | 3 ++ data_sources/sysmon_for_linux_eventid_3.yml | 3 ++ data_sources/windchill_log4j.yml | 2 ++ .../windows_event_log_defender_1116.yml | 3 ++ .../windows_event_log_defender_1117.yml | 3 ++ .../windows_event_log_security_4723.yml | 3 ++ .../windows_event_log_security_5441.yml | 3 ++ .../windows_event_log_security_5447.yml | 3 ++ schemas/DataSource.schema.json | 32 ++++++++++++++++++- 16 files changed, 73 insertions(+), 1 deletion(-) diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 801a3882ead..4618427e937 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -9,6 +9,8 @@ mitre_components: - Application Log Content source: aws_bedrock sourcetype: json_no_timestamp +logsource: + product: aws separator: schemaType separator_value: ModelInvocationLog supported_TA: diff --git a/data_sources/cisco_sd_wan_auth_log.yml b/data_sources/cisco_sd_wan_auth_log.yml index eeed82261e0..d3374ce584e 100644 --- a/data_sources/cisco_sd_wan_auth_log.yml +++ b/data_sources/cisco_sd_wan_auth_log.yml @@ -7,6 +7,9 @@ author: Teoderick Contreras, Splunk description: Data source object for Cisco SD-WAN Auth logs source: /var/log/auth.log sourcetype: cisco:sdwan:syslog +logsource: + product: cisco + service: syslog supported_TA: [] fields: - _time diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index e1ce31ca6d7..f6e9eccb13c 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -9,6 +9,9 @@ description: | This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. source: not_applicable sourcetype: cisco:cloud_security:dns +logsource: + category: dns + product: cisco supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index 4faa2e264e3..90bb6dbdf7b 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -7,6 +7,9 @@ author: Bhavin Patel, Splunk description: Captures firewall connection events from Cisco Secure Access including user identity, source and destination metadata, protocol details, and session statistics. Enables analysis of network traffic patterns, access policy enforcement, brute force attempts, and anomalous connection behavior across cloud-managed network access infrastructure. source: cisco_secure_access:firewall sourcetype: cisco:cloud_security:firewall +logsource: + category: firewall + product: cisco supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index 1c96a73ef5b..aed12c7d3cf 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -9,6 +9,9 @@ description: | This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:proxy +logsource: + category: proxy + product: cisco supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 93e9235f301..5cb82461605 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -12,6 +12,9 @@ mitre_components: - Application Log Content source: /var/log/kern sourcetype: linux_messages_syslog +logsource: + product: linux + service: syslog supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 diff --git a/data_sources/osquery_results.yml b/data_sources/osquery_results.yml index 5445233c455..63e725656d2 100644 --- a/data_sources/osquery_results.yml +++ b/data_sources/osquery_results.yml @@ -13,6 +13,8 @@ mitre_components: - Application Log Content source: osquery sourcetype: osquery:results +logsource: + product: osquery supported_TA: - name: TA-osquery url: https://splunkbase.splunk.com/app/8574 diff --git a/data_sources/sysmon_eventid_24.yml b/data_sources/sysmon_eventid_24.yml index 66a49773a64..44398938e89 100644 --- a/data_sources/sysmon_eventid_24.yml +++ b/data_sources/sysmon_eventid_24.yml @@ -12,6 +12,9 @@ mitre_components: - OS API Execution source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +logsource: + category: clipboard_capture + product: windows separator: EventID separator_value: '24' configuration: https://github.com/SwiftOnSecurity/sysmon-config diff --git a/data_sources/sysmon_for_linux_eventid_3.yml b/data_sources/sysmon_for_linux_eventid_3.yml index ffaa13a39fa..ad8c6346352 100644 --- a/data_sources/sysmon_for_linux_eventid_3.yml +++ b/data_sources/sysmon_for_linux_eventid_3.yml @@ -13,6 +13,9 @@ mitre_components: - OS API Execution source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux +logsource: + category: network_connection + product: linux separator: EventID separator_value: '3' supported_TA: diff --git a/data_sources/windchill_log4j.yml b/data_sources/windchill_log4j.yml index de3a5e644e8..c649d4e56be 100644 --- a/data_sources/windchill_log4j.yml +++ b/data_sources/windchill_log4j.yml @@ -11,6 +11,8 @@ mitre_components: - Response Metadata source: not_applicable sourcetype: log4j +logsource: + product: windchill supported_TA: [] fields: - _time diff --git a/data_sources/windows_event_log_defender_1116.yml b/data_sources/windows_event_log_defender_1116.yml index 9b02654eb11..ecf3e519181 100644 --- a/data_sources/windows_event_log_defender_1116.yml +++ b/data_sources/windows_event_log_defender_1116.yml @@ -11,6 +11,9 @@ mitre_components: - Process Creation source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode separator_value: '1116' supported_TA: diff --git a/data_sources/windows_event_log_defender_1117.yml b/data_sources/windows_event_log_defender_1117.yml index 4eee9d4d80b..99f37b1869f 100644 --- a/data_sources/windows_event_log_defender_1117.yml +++ b/data_sources/windows_event_log_defender_1117.yml @@ -11,6 +11,9 @@ mitre_components: - Process Creation source: WinEventLog:Microsoft-Windows-Windows Defender/Operational sourcetype: XmlWinEventLog +logsource: + product: windows + service: windefend separator: EventCode separator_value: '1117' supported_TA: diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index fd486f8f612..3c424125e49 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -9,6 +9,9 @@ mitre_components: - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '4723' supported_TA: diff --git a/data_sources/windows_event_log_security_5441.yml b/data_sources/windows_event_log_security_5441.yml index e8a62868bd3..b2d3541e16e 100644 --- a/data_sources/windows_event_log_security_5441.yml +++ b/data_sources/windows_event_log_security_5441.yml @@ -11,6 +11,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5441' configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. diff --git a/data_sources/windows_event_log_security_5447.yml b/data_sources/windows_event_log_security_5447.yml index 94e8f2a90cb..2de9fa462e2 100644 --- a/data_sources/windows_event_log_security_5447.yml +++ b/data_sources/windows_event_log_security_5447.yml @@ -11,6 +11,9 @@ mitre_components: - Application Log Content source: XmlWinEventLog:Security sourcetype: XmlWinEventLog +logsource: + product: windows + service: security separator: EventCode separator_value: '5447' configuration: Enable the Audit Filtering Platform Policy Change subcategory to collect Windows Filtering Platform policy events. diff --git a/schemas/DataSource.schema.json b/schemas/DataSource.schema.json index 3abd9b541f0..0d19d6e0be6 100644 --- a/schemas/DataSource.schema.json +++ b/schemas/DataSource.schema.json @@ -328,6 +328,35 @@ "title": "Sourcetype", "type": "string" }, + "logsource": { + "additionalProperties": false, + "description": "Sigma logsource identifying the abstract telemetry this data source provides. At least one of category, product, or service MUST be set.", + "minProperties": 1, + "properties": { + "category": { + "description": "Sigma logsource category, such as process_creation, firewall, or dns.", + "title": "Category", + "type": "string" + }, + "product": { + "description": "Sigma logsource product, such as windows, linux, aws, or cisco.", + "title": "Product", + "type": "string" + }, + "service": { + "description": "Sigma logsource service, such as security, cloudtrail, or auditd.", + "title": "Service", + "type": "string" + }, + "definition": { + "description": "Optional Sigma logsource definition with extra onboarding or scoping notes.", + "title": "Definition", + "type": "string" + } + }, + "title": "Logsource", + "type": "object" + }, "separator": { "anyOf": [ { @@ -444,7 +473,8 @@ "author", "description", "source", - "sourcetype" + "sourcetype", + "logsource" ], "title": "DataSource", "type": "object"