{
  "description" : "sysmon",
  "processors" : [
    { "set":	{ "field": "event.code", 						"value": "{{winlog.event_id}}",		"override": true	} },     
    { "set":	{ "field": "event.module", 						"value": "sysmon",			"override": true	} },   
    { "set":	{ "if": "ctx.winlog?.computer_name != null",  "field": "observer.name", "value": "{{winlog.computer_name}}",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '1'",	"field": "event.category",	"value": "host,process",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '2'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '3'",	"field": "event.category",	"value": "host,process,network",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '4'",	"field": "event.category",	"value": "host",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '5'",	"field": "event.category",	"value": "host,process",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '6'",	"field": "event.category",	"value": "host,driver",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '7'",	"field": "event.category",	"value": "host,process",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '8'",	"field": "event.category",	"value": "host,process",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '9'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '10'",	"field": "event.category",	"value": "host,process",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '11'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '12'",	"field": "event.category",	"value": "host,registry",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '13'",	"field": "event.category",	"value": "host,registry",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '14'",	"field": "event.category",	"value": "host,registry",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '15'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '16'",	"field": "event.category",	"value": "host",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '17'",	"field": "event.category",	"value": "host,pipe",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '18'",	"field": "event.category",	"value": "host,pipe",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '19'",	"field": "event.category",	"value": "host,wmi",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '20'",	"field": "event.category",	"value": "host,wmi",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '21'",	"field": "event.category",	"value": "host,wmi",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '22'",	"field": "event.category",	"value": "network",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '23'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '24'",	"field": "event.category",	"value": "host,clipboard",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '25'",	"field": "event.category",	"value": "host,process",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '26'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '27'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '28'",	"field": "event.category",	"value": "host,file",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '255'",	"field": "event.category",	"value": "host",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '1'",	"field": "event.dataset",	"value": "process_creation",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '2'",	"field": "event.dataset",	"value": "process_changed_file",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '3'",	"field": "event.dataset",	"value": "network_connection",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '4'",	"field": "event.dataset",	"value": "service_state_changed",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '5'",	"field": "event.dataset",	"value": "process_terminated",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '6'",	"field": "event.dataset",	"value": "driver_loaded",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '7'",	"field": "event.dataset",	"value": "image_loaded",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '8'",	"field": "event.dataset",	"value": "create_remote_thread",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '9'",	"field": "event.dataset",	"value": "raw_file_access_read",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '10'",	"field": "event.dataset",	"value": "process_access",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '11'",	"field": "event.dataset",	"value": "file_create",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '12'",	"field": "event.dataset",	"value": "registry_create_delete",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '13'",	"field": "event.dataset",	"value": "registry_value_set",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '14'",	"field": "event.dataset",	"value": "registry_key_value_rename",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '15'",	"field": "event.dataset",	"value": "file_create_stream_hash",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '16'",	"field": "event.dataset",	"value": "config_change",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '17'",	"field": "event.dataset",	"value": "pipe_created",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '18'",	"field": "event.dataset",	"value": "pipe_connected",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '19'",	"field": "event.dataset",	"value": "wmi_event_filter",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '20'",	"field": "event.dataset",	"value": "wmi_event_consumer",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '21'",	"field": "event.dataset",	"value": "wmi_event_consumer_to_filter","override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '22'",	"field": "event.dataset",	"value": "dns_query",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '23'",	"field": "event.dataset",	"value": "file_delete_archived",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '24'",	"field": "event.dataset",	"value": "clipboard_change",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '25'",	"field": "event.dataset",	"value": "process_tampering",		"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '26'",	"field": "event.dataset",	"value": "file_delete",			"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '27'",	"field": "event.dataset",	"value": "file_block_executable",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '28'",	"field": "event.dataset",	"value": "file_block_shredding",	"override": true 	} },
    { "set":	{ "if": "ctx.event?.code == '255'",	"field": "event.dataset",	"value": "error",			"override": true 	} },
    { "kv":	{ "field": "winlog.event_data.Hashes",  "target_field": "file.hash",    "field_split": ",", "value_split": "=",	"ignore_missing": true 	} },
    { "kv":	{ "field": "winlog.event_data.Hash",	"target_field": "file.hash",    "field_split": ",", "value_split": "=",	"ignore_missing": true	} },
    { "rename":	{ "field": "file.hash.IMPHASH",				"target_field": "hash.imphash",				"ignore_missing": true  } },
    { "rename":	{ "field": "file.hash.MD5",				"target_field": "hash.md5",				"ignore_missing": true  } },
    { "rename":	{ "field": "file.hash.SHA256",				"target_field": "hash.sha256",				"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.SubjectUserName",		"target_field": "user.name",				"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.DestinationHostname",	"target_field": "destination.hostname",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.DestinationIp",		"target_field": "destination.ip",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.DestinationPort",		"target_field": "destination.port",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.image", 			"target_field": "process.executable",			"ignore_missing": true  } }, 
    { "rename":	{ "field": "winlog.event_data.Image", 			"target_field": "process.executable",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.processID",		"target_field": "process.pid",				"ignore_missing": true  } }, 
    { "rename":	{ "field": "winlog.event_data.ProcessId",		"target_field": "process.pid",				"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.processGuid",		"target_field": "process.entity_id",			"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.ProcessGuid",		"target_field": "process.entity_id",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.commandLine",		"target_field": "process.command_line",			"ignore_missing": true  } },    
    { "rename":	{ "field": "winlog.event_data.CommandLine",		"target_field": "process.command_line",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.currentDirectory",	"target_field": "process.working_directory",		"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.CurrentDirectory",	"target_field": "process.working_directory",		"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.description",		"target_field": "process.pe.description",		"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.Description",		"target_field": "process.pe.description",		"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.product",			"target_field": "process.pe.product",			"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.Product",			"target_field": "process.pe.product",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.company",			"target_field": "process.pe.company",			"ignore_missing": true  } }, 
    { "rename":	{ "field": "winlog.event_data.Company",			"target_field": "process.pe.company",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.originalFileName",	"target_field": "process.pe.original_file_name",	"ignore_missing": true  } }, 
    { "rename":	{ "field": "winlog.event_data.OriginalFileName",	"target_field": "process.pe.original_file_name",	"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.fileVersion",		"target_field": "process.pe.file_version",		"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.FileVersion",		"target_field": "process.pe.file_version",		"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.parentCommandLine",	"target_field": "process.parent.command_line",		"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.ParentCommandLine",	"target_field": "process.parent.command_line",		"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.parentImage",		"target_field": "process.parent.executable",		"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.ParentImage",		"target_field": "process.parent.executable",		"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.parentProcessGuid",	"target_field": "process.parent.entity_id",		"ignore_missing": true  } }, 
    { "rename":	{ "field": "winlog.event_data.ParentProcessGuid",	"target_field": "process.parent.entity_id",		"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.parentProcessId",		"target_field": "process.ppid",				"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.ParentProcessId",		"target_field": "process.ppid",				"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.Protocol",		"target_field": "network.transport",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.User",			"target_field": "user.name",				"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.SourceHostname",		"target_field": "source.hostname",			"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.SourceIp",		"target_field": "source.ip",				"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.SourcePort",		"target_field": "source.port",				"ignore_missing": true 	} },   
    { "rename":	{ "field": "winlog.event_data.targetFilename",		"target_field": "file.target",				"ignore_missing": true 	} },
    { "rename":	{ "field": "winlog.event_data.TargetFilename",		"target_field": "file.target",				"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.QueryResults",		"target_field": "dns.answers.name",			"ignore_missing": true  } },
    { "rename":	{ "field": "winlog.event_data.QueryName",		"target_field": "dns.query.name",			"ignore_missing": true  } },
    { "remove":	{ "field": "winlog.event_data.Hash",										"ignore_missing": true  } },
    { "remove":	{ "field": "winlog.event_data.Hashes",										"ignore_missing": true  } },
    { "community_id": {} }
  ]
}
