diff --git a/test_files/config/default_profile.txt b/test_files/config/default_profile.txt new file mode 100644 index 00000000..fc20bf69 --- /dev/null +++ b/test_files/config/default_profile.txt @@ -0,0 +1,13 @@ +Timestamp: '%Timestamp%' +Computer: '%Computer%' +Channel: '%Channel%' +Level: '%Level%' +EventID: '%EventID%' +MitreAttack: '%MitreAttack%' +RecordID: '%RecordID%' +RuleTitle: '%RuleTitle%' +Details: '%Details%' +RecordInformation: '%RecordInformation%' +RuleFile: '%RuleFile%' +EvtxFile: '%EvtxFile%' +Tags: '%MitreAttack%' diff --git a/test_files/config/profiles.txt b/test_files/config/profiles.txt new file mode 100644 index 00000000..24ad1419 --- /dev/null +++ b/test_files/config/profiles.txt @@ -0,0 +1,44 @@ +minimal: + Timestamp: '%Timestamp%' + Computer: '%Computer%' + Channel: '%Channel%' + EventID: '%EventID%' + Level: '%Level%' + RuleTitle: '%RuleTitle%' + Details: '%Details%' + +default: + Timestamp: '%Timestamp%' + Computer: '%Computer%' + Channel: '%Channel%' + EventID: '%EventID%' + Level: '%Level%' + Tags: '%MitreAttack%' + RecordID: '%RecordID%' + RuleTitle: '%RuleTitle%' + Details: '%Details%' + +verbose-1: + Timestamp: '%Timestamp%' + Computer: '%Computer%' + Channel: '%Channel%' + EventID: '%EventID%' + Level: '%Level%' + Tags: '%MitreAttack%' + RecordID: '%RecordID%' + RuleTitle: '%RuleTitle%' + Details: '%Details%' + RulePath: '%RulePath%' + FilePath: '%FilePath%' + +verbose-2: + Timestamp: '%Timestamp%' + Computer: '%Computer%' + Channel: '%Channel%' + EventID: '%EventID%' + Level: '%Level%' + Tags: '%MitreAttack%' + RecordID: '%RecordID%' + RuleTitle: '%RuleTitle%' + Details: '%Details%' + AllFieldInfo: '%RecordInformation%' \ No newline at end of file