From 44114576639c9ce0750af07cc45bfb092bf0879a Mon Sep 17 00:00:00 2001 From: Tanaka Zakku <71482215+YamatoSecurity@users.noreply.github.com> Date: Mon, 8 Aug 2022 10:45:01 +0900 Subject: [PATCH] update profile --- config/profiles.yaml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/config/profiles.yaml b/config/profiles.yaml index 26bcfa34..d3515c29 100644 --- a/config/profiles.yaml +++ b/config/profiles.yaml @@ -35,8 +35,24 @@ verbose: RuleFile: "%RuleFile%" EvtxFile: "%EvtxFile%" -#Verbose-1 profile plus all field information. (Warning: this will more than double the output file size!) +#Verbose profile with all field information instead of the minimal fields defined in Details. verbose-all-field-info: + Timestamp: "%Timestamp%" + Computer: "%Computer%" + Channel: "%Channel%" + EventID: "%EventID%" + Level: "%Level%" + MitreTactics: "%MitreTactics%" + MitreTags: "%MitreTags%" + OtherTags: "%OtherTags%" + RecordID: "%RecordID%" + RuleTitle: "%RuleTitle%" + AllFieldInfo: "%RecordInformation%" + RuleFile: "%RuleFile%" + EvtxFile: "%EvtxFile%" + +#Verbose profile plus all field information. (Warning: this will more than double the output file size!) +verbose-details-and-all-field-info: Timestamp: "%Timestamp%" Computer: "%Computer%" Channel: "%Channel%"