Taxonomy

This page defines field names and log sources that should be used to ensure sharable rules.

Log Sources

Generic

• category: process_creation: Defines a process creation event

Specific

• product: windows: Windows Operating System logs
  • service: security: Windows Security Event Log. Some may be covered by generic log sources.
  • service: system: Windows System Event Log
  • service: sysmon: Event Logs created by Sysmon. Some may be covered by generic log sources.
  • service: taskscheduler
  • service: wmi
  • service: application
  • service: dns-server
  • service: driver-framework
  • service: powershell
  • service: powershell-classic: ???
• product: linux: Linux log files
  • service: auth: Linux authentication logs. Usually /var/log/auth.log.
  • service: auditd: Linux audit logs
  • service: clamav: ClamAV logs
• product: apache: Apache httpd logs
  • service: access: Access logs
  • service: error: Error logs
• category: proxy
  • Field Names: W3C Extended Log File Format
• category: firewall
  • Field Names:
    • src_ip, src_port, dst_ip, dst_port`
• category: dns
• category: webserver