Skip to content

Commit a6c06d0

Browse files
nasbenchnasbench
committed
update: windows event log macros
1 parent 7712cd9 commit a6c06d0

11 files changed

+14
-14
lines changed

‎macros/ms_defender.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: source="WinEventLog:Microsoft-Windows-Windows Defender/Operational"
1+
definition: (source="WinEventLog:Microsoft-Windows-Windows Defender/Operational" OR source="XmlWinEventLog:Microsoft-Windows-Windows Defender/Operational")
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
33
Replace the macro definition with configurations for your Splunk Environment.
44
name: ms_defender

‎macros/powershell.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
1+
definition: (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" OR source=WinEventLog:PowerShellCore/Operational OR source="XmlWinEventLog:PowerShellCore/Operational")
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
33
Replace the macro definition with configurations for your Splunk Environment.
44
name: powershell

‎macros/printservice.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin"
1+
definition: (source="Wineventlog:microsoft-windows-printservice/operational" OR source="XmlWineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin" OR source="XmlWinEventLog:Microsoft-Windows-PrintService/Admin")
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
33
Replace the macro definition with configurations for your Splunk Environment.
44
name: printservice

‎macros/remoteconnectionmanager.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
1+
definition: (source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" OR source="XmlWinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational")
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
33
Replace the macro definition with configurations for your Splunk Environment.
44
name: remoteconnectionmanager

‎macros/sysmon.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational
1+
definition: (source=WinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational)
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
33
Replace the macro definition with configurations for your Splunk Environment.
44
name: sysmon

‎macros/wineventlog_application.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: eventtype=wineventlog_application OR source="XmlWinEventLog:Application"
1+
definition: eventtype="wineventlog_application" OR Channel="application" OR source="XmlWinEventLog:Application" OR source="WinEventLog:Application"
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
33
Replace the macro definition with configurations for your Splunk Environment.
44
name: wineventlog_application

‎macros/wineventlog_rdp.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: source="WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational"
1+
definition: (source="WinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational" OR source="XmlWinEventLog:Microsoft-Windows-TerminalServices-RDPClient/Operational")
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environmnent.
3+
Replace the macro definition with configurations for your Splunk environment.
44
name: wineventlog_rdp

‎macros/wineventlog_security.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: eventtype=wineventlog_security OR Channel=security OR source=XmlWinEventLog:Security
1+
definition: eventtype="wineventlog_security" OR Channel="security" OR source="XmlWinEventLog:Security" OR source="WinEventLog:Security"
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
3+
Replace the macro definition with configurations for your Splunk environment.
44
name: wineventlog_security

‎macros/wineventlog_system.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: eventtype=wineventlog_system
1+
definition: eventtype="wineventlog_system" OR Channel="system" OR source="XmlWinEventLog:System" OR source="WinEventLog:System"
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
3+
Replace the macro definition with configurations for your Splunk environment.
44
name: wineventlog_system

‎macros/wineventlog_task_scheduler.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
definition: (source="XmlWinEventLog:Microsoft-Windows-TaskScheduler/Operational" OR source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational")
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
3-
Replace the macro definition with configurations for your Splunk Environment.
3+
Replace the macro definition with configurations for your Splunk environment.
44
name: wineventlog_task_scheduler

‎macros/wmi.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
definition: sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
1+
definition: (source="WinEventLog:Microsoft-Windows-WMI-Activity/Operational" OR source="XmlWinEventLog:Microsoft-Windows-WMI-Activity/Operational")
22
description: customer specific splunk configurations(eg- index, source, sourcetype).
33
Replace the macro definition with configurations for your Splunk Environment.
44
name: wmi

0 commit comments

Comments
 (0)