53 lines
1.5 KiB
YAML
53 lines
1.5 KiB
YAML
#Standard profile minus MITRE ATT&CK Tactics and Record ID.
|
|
minimal:
|
|
Timestamp: "%Timestamp%"
|
|
Computer: "%Computer%"
|
|
Channel: "%Channel%"
|
|
EventID: "%EventID%"
|
|
Level: "%Level%"
|
|
RuleTitle: "%RuleTitle%"
|
|
Details: "%Details%"
|
|
|
|
standard:
|
|
Timestamp: "%Timestamp%"
|
|
Computer: "%Computer%"
|
|
Channel: "%Channel%"
|
|
EventID: "%EventID%"
|
|
Level: "%Level%"
|
|
MitreTactics: "%MitreTactics%"
|
|
RecordID: "%RecordID%"
|
|
RuleTitle: "%RuleTitle%"
|
|
Details: "%Details%"
|
|
|
|
#Standard profile plus MitreTags(MITRE techniques, software and groups), rule filename and EVTX filename.
|
|
verbose:
|
|
Timestamp: "%Timestamp%"
|
|
Computer: "%Computer%"
|
|
Channel: "%Channel%"
|
|
EventID: "%EventID%"
|
|
Level: "%Level%"
|
|
MitreTactics: "%MitreTactics%"
|
|
MitreTags: "%MitreTags%"
|
|
OtherTags: "%OtherTags%"
|
|
RecordID: "%RecordID%"
|
|
RuleTitle: "%RuleTitle%"
|
|
Details: "%Details%"
|
|
RuleFile: "%RuleFile%"
|
|
EvtxFile: "%EvtxFile%"
|
|
|
|
#Verbose-1 profile plus all field information. (Warning: this will more than double the output file size!)
|
|
verbose-all-field-info:
|
|
Timestamp: "%Timestamp%"
|
|
Computer: "%Computer%"
|
|
Channel: "%Channel%"
|
|
EventID: "%EventID%"
|
|
Level: "%Level%"
|
|
MitreTactics: "%MitreTactics%"
|
|
MitreTags: "%MitreTags%"
|
|
OtherTags: "%OtherTags%"
|
|
RecordID: "%RecordID%"
|
|
RuleTitle: "%RuleTitle%"
|
|
Details: "%Details%"
|
|
RuleFile: "%RuleFile%"
|
|
EvtxFile: "%EvtxFile%"
|
|
AllFieldInfo: "%RecordInformation%" |