-
Notifications
You must be signed in to change notification settings - Fork 8k
/
manifest.json
119 lines (119 loc) · 3.63 KB
/
manifest.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
{
"id": "siem_winlogbeat",
"title": "Security: Winlogbeat",
"description": "Detect unusual processes and network activity in Winlogbeat data.",
"type": "Winlogbeat data",
"logoFile": "logo.json",
"defaultIndexPattern": "winlogbeat-*",
"query": {
"bool": {
"filter": [
{"term": {"agent.type": "winlogbeat"}}
],
"must_not": { "terms": { "_tier": [ "data_frozen", "data_cold" ] } }
}
},
"jobs": [
{
"id": "rare_process_by_host_windows_ecs",
"file": "rare_process_by_host_windows_ecs.json"
},
{
"id": "windows_anomalous_network_activity_ecs",
"file": "windows_anomalous_network_activity_ecs.json"
},
{
"id": "windows_anomalous_path_activity_ecs",
"file": "windows_anomalous_path_activity_ecs.json"
},
{
"id": "windows_anomalous_process_all_hosts_ecs",
"file": "windows_anomalous_process_all_hosts_ecs.json"
},
{
"id": "windows_anomalous_process_creation",
"file": "windows_anomalous_process_creation.json"
},
{
"id": "windows_anomalous_script",
"file": "windows_anomalous_script.json"
},
{
"id": "windows_anomalous_service",
"file": "windows_anomalous_service.json"
},
{
"id": "windows_anomalous_user_name_ecs",
"file": "windows_anomalous_user_name_ecs.json"
},
{
"id": "windows_rare_user_runas_event",
"file": "windows_rare_user_runas_event.json"
},
{
"id": "windows_rare_metadata_process",
"file": "windows_rare_metadata_process.json"
},
{
"id": "windows_rare_metadata_user",
"file": "windows_rare_metadata_user.json"
}
],
"datafeeds": [
{
"id": "datafeed-rare_process_by_host_windows_ecs",
"file": "datafeed_rare_process_by_host_windows_ecs.json",
"job_id": "rare_process_by_host_windows_ecs"
},
{
"id": "datafeed-windows_anomalous_network_activity_ecs",
"file": "datafeed_windows_anomalous_network_activity_ecs.json",
"job_id": "windows_anomalous_network_activity_ecs"
},
{
"id": "datafeed-windows_anomalous_path_activity_ecs",
"file": "datafeed_windows_anomalous_path_activity_ecs.json",
"job_id": "windows_anomalous_path_activity_ecs"
},
{
"id": "datafeed-windows_anomalous_process_all_hosts_ecs",
"file": "datafeed_windows_anomalous_process_all_hosts_ecs.json",
"job_id": "windows_anomalous_process_all_hosts_ecs"
},
{
"id": "datafeed-windows_anomalous_process_creation",
"file": "datafeed_windows_anomalous_process_creation.json",
"job_id": "windows_anomalous_process_creation"
},
{
"id": "datafeed-windows_anomalous_script",
"file": "datafeed_windows_anomalous_script.json",
"job_id": "windows_anomalous_script"
},
{
"id": "datafeed-windows_anomalous_service",
"file": "datafeed_windows_anomalous_service.json",
"job_id": "windows_anomalous_service"
},
{
"id": "datafeed-windows_anomalous_user_name_ecs",
"file": "datafeed_windows_anomalous_user_name_ecs.json",
"job_id": "windows_anomalous_user_name_ecs"
},
{
"id": "datafeed-windows_rare_user_runas_event",
"file": "datafeed_windows_rare_user_runas_event.json",
"job_id": "windows_rare_user_runas_event"
},
{
"id": "datafeed-windows_rare_metadata_process",
"file": "datafeed_windows_rare_metadata_process.json",
"job_id": "windows_rare_metadata_process"
},
{
"id": "datafeed-windows_rare_metadata_user",
"file": "datafeed_windows_rare_metadata_user.json",
"job_id": "windows_rare_metadata_user"
}
]
}