Feature/#140 document (#144)

* update

* fix regexes and whitelist

* underconstructing

* fix

* update

* add pic

* update

* update

* update

* fix

rules/deep_blue_cli/system/104.yml

@@ -1,8 +1,6 @@
 title: The System log file was cleared
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -10,7 +8,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'System Log Clear¥nThe System log was cleared.'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7030.yml

@@ -1,8 +1,6 @@
 title: This service may not function properly
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -12,7 +10,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Interactive service warning¥nService name: %ServiceName%¥nMalware (and some third party software) trigger this warning'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7036.yml

@@ -1,8 +1,6 @@
 title: The ... service entered the stopped|running state
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -12,7 +10,6 @@ detection:
     condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Suspicious Service Name¥nService name: %ServiceName%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7040.yml

@@ -1,8 +1,6 @@
 title: The start type of the Windows Event Log service was changed from auto start to disabled
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -14,7 +12,6 @@ detection:
     condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Service name : %param1%¥nMessage : Event Log Service Stopped¥nResults: Selective event log manipulation may follow this event.'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/system/7045.yml

@@ -1,8 +1,6 @@
 title: A service was installed in the system
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: System
@@ -15,7 +13,6 @@ detection:
     condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'New Service Created¥n%ImagePath¥nService name: %ServiceName%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8