-
Notifications
You must be signed in to change notification settings - Fork 8k
/
manifest.json
156 lines (156 loc) · 4.56 KB
/
manifest.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
{
"id": "security_windows_v3",
"title": "Security: Windows",
"description": "Anomaly detection jobs for Windows host-based threat hunting and detection.",
"type": "windows data",
"logoFile": "logo.json",
"defaultIndexPattern": "winlogbeat-*,logs-*",
"query": {
"bool": {
"must": [
{
"bool": {
"should": [
{
"match": {
"host.os.family": {
"query": "windows",
"operator": "OR"
}
}
},
{
"match": {
"host.os.type": {
"query": "windows",
"operator": "OR"
}
}
}
]
}
}
],
"must_not": {
"terms": {
"_tier": [
"data_frozen",
"data_cold"
]
}
}
}
},
"jobs": [
{
"id": "v3_windows_anomalous_service",
"file": "v3_windows_anomalous_service.json"
},
{
"id": "v3_windows_rare_user_runas_event",
"file": "v3_windows_rare_user_runas_event.json"
},
{
"id": "v3_windows_rare_user_type10_remote_login",
"file": "v3_windows_rare_user_type10_remote_login.json"
},
{
"id": "v3_rare_process_by_host_windows",
"file": "v3_rare_process_by_host_windows.json"
},
{
"id": "v3_windows_anomalous_network_activity",
"file": "v3_windows_anomalous_network_activity.json"
},
{
"id": "v3_windows_anomalous_path_activity",
"file": "v3_windows_anomalous_path_activity.json"
},
{
"id": "v3_windows_anomalous_process_all_hosts",
"file": "v3_windows_anomalous_process_all_hosts.json"
},
{
"id": "v3_windows_anomalous_process_creation",
"file": "v3_windows_anomalous_process_creation.json"
},
{
"id": "v3_windows_anomalous_user_name",
"file": "v3_windows_anomalous_user_name.json"
},
{
"id": "v3_windows_rare_metadata_process",
"file": "v3_windows_rare_metadata_process.json"
},
{
"id": "v3_windows_rare_metadata_user",
"file": "v3_windows_rare_metadata_user.json"
},
{
"id": "v3_windows_anomalous_script",
"file": "v3_windows_anomalous_script.json"
}
],
"datafeeds": [
{
"id": "datafeed-v3_windows_anomalous_service",
"file": "datafeed_v3_windows_anomalous_service.json",
"job_id": "v3_windows_anomalous_service"
},
{
"id": "datafeed-v3_windows_rare_user_runas_event",
"file": "datafeed_v3_windows_rare_user_runas_event.json",
"job_id": "v3_windows_rare_user_runas_event"
},
{
"id": "datafeed-v3_windows_rare_user_type10_remote_login",
"file": "datafeed_v3_windows_rare_user_type10_remote_login.json",
"job_id": "v3_windows_rare_user_type10_remote_login"
},
{
"id": "datafeed-v3_rare_process_by_host_windows",
"file": "datafeed_v3_rare_process_by_host_windows.json",
"job_id": "v3_rare_process_by_host_windows"
},
{
"id": "datafeed-v3_windows_anomalous_network_activity",
"file": "datafeed_v3_windows_anomalous_network_activity.json",
"job_id": "v3_windows_anomalous_network_activity"
},
{
"id": "datafeed-v3_windows_anomalous_path_activity",
"file": "datafeed_v3_windows_anomalous_path_activity.json",
"job_id": "v3_windows_anomalous_path_activity"
},
{
"id": "datafeed-v3_windows_anomalous_process_all_hosts",
"file": "datafeed_v3_windows_anomalous_process_all_hosts.json",
"job_id": "v3_windows_anomalous_process_all_hosts"
},
{
"id": "datafeed-v3_windows_anomalous_process_creation",
"file": "datafeed_v3_windows_anomalous_process_creation.json",
"job_id": "v3_windows_anomalous_process_creation"
},
{
"id": "datafeed-v3_windows_anomalous_user_name",
"file": "datafeed_v3_windows_anomalous_user_name.json",
"job_id": "v3_windows_anomalous_user_name"
},
{
"id": "datafeed-v3_windows_rare_metadata_process",
"file": "datafeed_v3_windows_rare_metadata_process.json",
"job_id": "v3_windows_rare_metadata_process"
},
{
"id": "datafeed-v3_windows_rare_metadata_user",
"file": "datafeed_v3_windows_rare_metadata_user.json",
"job_id": "v3_windows_rare_metadata_user"
},
{
"id": "datafeed-v3_windows_anomalous_script",
"file": "datafeed_v3_windows_anomalous_script.json",
"job_id": "v3_windows_anomalous_script"
}
]
}