Skip to content

Latest commit

 

History

History
36 lines (29 loc) · 1.04 KB

75cb24d1-5364-43b5-8aed-baca1586225c.md

File metadata and controls

36 lines (29 loc) · 1.04 KB

Mappings: Windows - Microsoft-Windows-Sysmon/Operational - 12, 13, and 14

Input Requirements

Input Value
Vendor Microsoft
Product Windows
Log Format Windows
Event ID Regex Pattern Microsoft-Windows-Sysmon/Operational-1([234])

Record Output

Output Value
Vendor Microsoft
Product Windows
Record Type EndpointProcess

Fields Mapped

Cloud SIEM Schema Field Original Record Key Notes
action EventData.EventType
baseImage EventData.Image
changeTarget EventData.TargetObject
changeType EventData.EventType
description None The static text Sysmon observed RegistryEvent is populated in this schema field.
device_hostname Computer
file_path EventData.TargetObject
resource EventData.Details
sourceUid EventRecordID
timestamp EventData.UtcTime We expect the orginal record value of EventData.UtcTime is in the format yyyy-MM-dd HH:mm:ss.SSS
user_userId Security.UserID
user_username EventData.User