CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13832 from Security-Onion-Solutions/2.4/sigmapipelines

Browse Source 
Add process and file creation mappings
This commit is contained in:
Josh Brower
2024-10-28 18:30:21 -04:00
committed by GitHub
parent 2c4f65009c f3ca5b1c42
commit 6a3e5415cf
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
salt/soc/files/soc/sigma_so_pipeline.yaml
View File

@@ -106,3 +106,23 @@ transformations:
- type: include_fields - type: include_fields
fields: fields:
- event.code - event.code
# Maps process_creation rules to endpoint process creation logs
# This is an OS-agnostic mapping, to account for logs that don't specify source OS
- id: endpoint_process_create_windows_add-fields
type: add_condition
conditions:
event.category: 'process'
event.type: 'start'
rule_conditions:
- type: logsource
category: process_creation
# Maps file_event rules to endpoint file creation logs
# This is an OS-agnostic mapping, to account for logs that don't specify source OS
- id: endpoint_file_create_add-fields
type: add_condition
conditions:
event.category: 'file'
event.type: 'creation'
rule_conditions:
- type: logsource
category: file_event