Git Product home page Git Product logo

Comments (2)

rw-access avatar rw-access commented on August 18, 2024

For reference to this thread, here's an example event from OSSEM
https://github.com/Cyb3rWard0g/OSSEM/blob/master/data_dictionaries/windows/sysmon/event-22.md

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" /> 
    <EventID>22</EventID> 
    <Version>5</Version> 
    <Level>4</Level> 
    <Task>22</Task> 
    <Opcode>0</Opcode> 
    <Keywords>0x8000000000000000</Keywords> 
    <TimeCreated SystemTime="2019-06-12T00:57:56.373798200Z" /> 
    <EventRecordID>6612437</EventRecordID> 
    <Correlation /> 
    <Execution ProcessID="2312" ThreadID="3252" /> 
    <Channel>Microsoft-Windows-Sysmon/Operational</Channel> 
    <Computer>DESKTOP-WARDOG.RIVENDELL.local</Computer> 
    <Security UserID="S-1-5-18" /> 
  </System>
  <EventData>
    <Data Name="RuleName" /> 
    <Data Name="UtcTime">2019-06-12 00:57:55.254</Data> 
    <Data Name="ProcessGuid">{A98268C1-4DDF-5D00-0000-00102D794100}</Data> 
    <Data Name="ProcessId">416</Data> 
    <Data Name="QueryName">chrome.google.com</Data> 
    <Data Name="QueryStatus">0</Data> 
    <Data Name="QueryResults">type: 5 www3.l.google.com;172.217.7.206;</Data> 
    <Data Name="Image">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data> 
  </EventData>
</Event>

I think normalizing the QueryResults will be a little tricky, because we'll probably want something a little more structured. Maybe an array of just the IPs for now?

from eqllib.

cthulhusec avatar cthulhusec commented on August 18, 2024

@rw-access What are your thoughts on a more structured format? I'm not sure what all we could use here. How is it currently being done in Endgame?

from eqllib.

Related Issues (12)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.