Improve default sysmon fields and add new network_connection fields

salt/soc/defaults.yaml

@@ -496,16 +496,6 @@ soc:
       - event.severity_label
       - log.id.uid
       - network.community_id
-    ':sysmon:':
-      - soc_timestamp
-      - source.ip
-      - source.port
-      - destination.ip
-      - destination.port
-      - source.hostname
-      - event.dataset
-      - process.executable
-      - user.name
     ':windows_eventlog:':
       - soc_timestamp
       - user.name
@@ -570,6 +560,24 @@ soc:
       - destination.geo.country_iso_code
       - user.name
       - source.ip
+    ':sysmon:':
+      - soc_timestamp
+      - event.dataset
+      - process.executable
+      - user.name
+      - file.target
+      - dns.query.name
+      - winlog.event_data.TargetObject
+    '::network_connection':
+      - soc_timestamp
+      - source.ip
+      - source.port
+      - destination.ip
+      - destination.port
+      - source.hostname
+      - event.dataset
+      - process.executable
+      - user.name
     '::process_terminated': 
       - soc_timestamp
       - process.executable