Skip to content

Add XQL mappings #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 10, 2024
Merged

Add XQL mappings #132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/webserver.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ platform: Palo Alto XSIAM
source: webserver

default_log_source:
dataset: [apache_tomcat_raw, nginx_nginx_raw, apache_tomcat_raw]
datamodel: datamodel

field_mapping:
c-uri: xdm.network.http.url
Expand Down
12 changes: 12 additions & 0 deletions uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/windows_pipe_created.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
platform: Palo Alto XSIAM
source: windows_pipe_created

default_log_source:
preset: xdr_event_log

field_mapping:
EventID: action_evtlog_event_id

raw_log_fields:
- PipeName
- Image
19 changes: 19 additions & 0 deletions uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/windows_process_access.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
platform: Palo Alto XSIAM
source: windows_process_access

default_log_source:
preset: xdr_event_log

field_mapping:
User: action_process_username

raw_log_fields:
- SourceProcessGUID
- SourceProcessId
- SourceThreadId
- SourceImage
- TargetProcessGUID
- TargerProcessId
- TargetImage
- GrantedAccess
- CallTrace
2 changes: 1 addition & 1 deletion uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/windows_sysmon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ default_log_source:
field_mapping:
EventID: action_evtlog_event_id
OriginalFileName: actor_process_file_original_name
Description: action_evtlog_description

raw_log_fields:
- CommandLine
Expand All @@ -16,7 +17,6 @@ raw_log_fields:
- CallTrace
- Company
- CurrentDirectory
- Description
- DestinationHostname
- DestinationIp
- DestinationIsIpv6
Expand Down
24 changes: 24 additions & 0 deletions uncoder-core/app/translator/mappings/platforms/sigma/windows_process_access.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@

platform: Sigma
source: windows_process_access


log_source:
product: [windows]
category: [process_access]

default_log_source:
product: windows
category: process_access

field_mapping:
SourceProcessGUID: SourceProcessGUID
SourceProcessId: SourceProcessId
SourceThreadId: SourceThreadId
SourceImage: SourceImage
TargetProcessGUID: TargetProcessGUID
TargerProcessId: TargerProcessId
TargetImage: TargetImage
GrantedAccess: GrantedAccess
CallTrace: CallTrace
User: User
Loading