mirror of
https://github.com/vee1e/PcapMonkey.git
synced 2026-09-01 09:51:26 +00:00
95 lines
4.3 KiB
YAML
95 lines
4.3 KiB
YAML
title: Elastic evtx2elk index pattern and field mapping
|
|
order: 20
|
|
backends:
|
|
- es-qs
|
|
- es-dsl
|
|
fieldmappings:
|
|
EventID: winlog.event_id
|
|
AccessMask: Event.EventData.Data.AccessMask
|
|
AccountName: Event.EventData.Data.AccountName
|
|
AllowedToDelegateTo: Event.EventData.Data.AllowedToDelegateTo
|
|
AttributeLDAPDisplayName: Event.EventData.Data.AttributeLDAPDisplayName
|
|
AuditPolicyChanges: Event.EventData.Data.AuditPolicyChanges
|
|
AuthenticationPackageName: Event.EventData.Data.AuthenticationPackageName
|
|
CallingProcessName: Event.EventData.Data.CallingProcessName
|
|
CallTrace: Event.EventData.Data.CallTrace
|
|
Channel: winlog.channel
|
|
CommandLine: Event.EventData.Data.CommandLine
|
|
ComputerName: winlog.ComputerName
|
|
CurrentDirectory: Event.EventData.Data.CurrentDirectory
|
|
Description: Event.EventData.Data.Description
|
|
DestinationHostname: Event.EventData.Data.DestinationHostname
|
|
DestinationIp: Event.EventData.Data.DestinationIp
|
|
dst_ip: Event.EventData.Data.DestinationIp
|
|
DestinationIsIpv6: Event.EventData.Data.DestinationIsIpv6
|
|
DestinationPort: Event.EventData.Data.DestinationPort
|
|
dst_port: Event.EventData.Data.DestinationPort
|
|
Details: Event.EventData.Data.Details
|
|
EngineVersion: Event.EventData.Data.EngineVersion
|
|
EventType: Event.EventData.Data.EventType
|
|
FailureCode: Event.EventData.Data.FailureCode
|
|
FileName: Event.EventData.Data.FileName
|
|
OriginalFileName: Event.EventData.Data.OriginalFileName
|
|
GrantedAccess: Event.EventData.Data.GrantedAccess
|
|
GroupName: Event.EventData.Data.GroupName
|
|
GroupSid: Event.EventData.Data.GroupSid
|
|
Hashes: Event.EventData.Data.Hashes
|
|
HiveName: Event.EventData.Data.HiveName
|
|
HostVersion: Event.EventData.Data.HostVersion
|
|
Image: Event.EventData.Data.Image
|
|
ImageLoaded: Event.EventData.Data.ImageLoaded
|
|
ImagePath: Event.EventData.Data.ImagePath
|
|
Imphash: Event.EventData.Data.Imphash
|
|
IpAddress: Event.EventData.Data.IpAddress
|
|
KeyLength: Event.EventData.Data.KeyLength
|
|
LogonProcessName: Event.EventData.Data.LogonProcessName
|
|
LogonType: Event.EventData.Data.LogonType
|
|
NewProcessName: Event.EventData.Data.NewProcessName
|
|
ObjectClass: Event.EventData.Data.ObjectClass
|
|
ObjectName: Event.EventData.Data.ObjectName
|
|
ObjectType: Event.EventData.Data.ObjectType
|
|
ObjectValueName: Event.EventData.Data.ObjectValueName
|
|
ParentCommandLine: Event.EventData.Data.ParentCommandLine
|
|
ParentProcessName: Event.EventData.Data.ParentProcessName
|
|
ParentImage: Event.EventData.Data.ParentImage
|
|
Path: Event.EventData.Data.Path
|
|
PipeName: Event.EventData.Data.PipeName
|
|
ProcessCommandLine: Event.EventData.Data.ProcessCommandLine
|
|
ProcessName: Event.EventData.Data.ProcessName
|
|
Properties: Event.EventData.Data.Properties
|
|
RuleName: Event.EventData.Data.RuleName
|
|
SecurityID: Event.EventData.Data.SecurityID
|
|
ServiceFileName: Event.EventData.Data.ServiceFileName
|
|
ServiceName: Event.EventData.Data.ServiceName
|
|
ShareName: Event.EventData.Data.ShareName
|
|
Signature: Event.EventData.Data.Signature
|
|
Source: Event.EventData.Data.Source
|
|
SourceImage: Event.EventData.Data.SourceImage
|
|
SourceIp: Event.EventData.Data.SourceIp
|
|
src_ip: Event.EventData.Data.SourceIp
|
|
SourcePort: Event.EventData.Data.SourcePort
|
|
src_port: Event.EventData.Data.SourcePort
|
|
StartModule: Event.EventData.Data.StartModule
|
|
Status: Event.EventData.Data.Status
|
|
SubjectUserName: Event.EventData.Data.SubjectUserName
|
|
SubjectUserSid: Event.EventData.Data.SubjectUserSid
|
|
TargetFilename: Event.EventData.Data.TargetFilename
|
|
TargetImage: Event.EventData.Data.TargetImage
|
|
TargetObject: Event.EventData.Data.TargetObject
|
|
TicketEncryptionType: Event.EventData.Data.TicketEncryptionType
|
|
TicketOptions: Event.EventData.Data.TicketOptions
|
|
User: Event.EventData.Data.User
|
|
WorkstationName: Event.EventData.Data.WorkstationName
|
|
# Channel: WLAN-Autoconfig AND EventID: 8001
|
|
AuthenticationAlgorithm: Event.EventData.Data.AuthenticationAlgorithm
|
|
BSSID: Event.EventData.Data.BSSID
|
|
BSSType: Event.EventData.Data.BSSType
|
|
CipherAlgorithm: Event.EventData.Data.CipherAlgorithm
|
|
ConnectionId: Event.EventData.Data.ConnectionId
|
|
ConnectionMode: Event.EventData.Data.ConnectionMode
|
|
InterfaceDescription: Event.EventData.Data.InterfaceDescription
|
|
InterfaceGuid: Event.EventData.Data.InterfaceGuid
|
|
OnexEnabled: Event.EventData.Data.OnexEnabled
|
|
PHYType: Event.EventData.Data.PHYType
|
|
ProfileName: Event.EventData.Data.ProfileName
|
|
SSID: Event.EventData.Data.SSID
|