Skip to content

Commit

Permalink
Refresh intakes documentation
Browse files Browse the repository at this point in the history
  • Loading branch information
@sekoia-io-cross-repo-comm-app
sekoia-io-cross-repo-comm-app[bot] authored Sep 20, 2023
1 parent 07e5d5e commit f501578
Show file tree
Hide file tree
Showing 16 changed files with 217 additions and 46 deletions.
4 changes: 3 additions & 1 deletion ...perations_center/integrations/generated/021e9def-5a55-4369-941e-af269b45bef1.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -878,7 +878,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"device": "00:00",
"inode": "25973",
"mode": "0644",
"uid": "0"
"uid": "0",
"name": "oom_score_adj",
"directory": "/proc/1"
},
"host": {
"name": "xps-housetodd",
Expand Down
4 changes: 3 additions & 1 deletion ...perations_center/integrations/generated/07c556c0-0675-478c-9803-e7990afe78b6.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -469,7 +469,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
},
"@timestamp": "2022-04-11T07:18:34.090547Z",
"file": {
"path": "C:\\Windows\\system32\\diskshadow.exe"
"path": "C:\\Windows\\system32\\diskshadow.exe",
"name": "diskshadow.exe",
"directory": "C:\\Windows\\system32"
},
"related": {
"user": [
Expand Down
16 changes: 12 additions & 4 deletions ...perations_center/integrations/generated/10999b99-9a8d-4b92-9fbd-01e3fac01cd5.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -366,7 +366,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"id": "111111111111111"
},
"file": {
"path": "dal_0234.dll"
"path": "dal_0234.dll",
"name": "dal_0234.dll",
"directory": ""
},
"crowdstrike": {
"customer_id": "222222222222222222222"
Expand Down Expand Up @@ -747,7 +749,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"id": "111111111111111"
},
"file": {
"path": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Group Policy\\Users\\S-1-5-21-1111111111-2222222222-3333333333-27500\\History\\{7330D718-94E9-43DB-8BCB-1F2D0C2FB34E}\\S-1-5-21-1111111111-2222222222-3333333333-27500\\Preferences"
"path": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Group Policy\\Users\\S-1-5-21-1111111111-2222222222-3333333333-27500\\History\\{7330D718-94E9-43DB-8BCB-1F2D0C2FB34E}\\S-1-5-21-1111111111-2222222222-3333333333-27500\\Preferences",
"name": "Preferences",
"directory": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Group Policy\\Users\\S-1-5-21-1111111111-2222222222-3333333333-27500\\History\\{7330D718-94E9-43DB-8BCB-1F2D0C2FB34E}\\S-1-5-21-1111111111-2222222222-3333333333-27500"
},
"crowdstrike": {
"customer_id": "222222222222222222222"
Expand Down Expand Up @@ -1097,7 +1101,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"id": "111111111111111"
},
"file": {
"path": "\\Device\\HarddiskVolume3\\Users\\j.doe\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Cache_Data\\f_010051"
"path": "\\Device\\HarddiskVolume3\\Users\\j.doe\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Cache_Data\\f_010051",
"name": "f_010051",
"directory": "\\Device\\HarddiskVolume3\\Users\\j.doe\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Cache_Data"
},
"crowdstrike": {
"customer_id": "222222222222222222222"
Expand Down Expand Up @@ -1145,7 +1151,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"id": "111111111111111"
},
"file": {
"path": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.Edge_123082\\WebView2Loader.dll"
"path": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.Edge_123082\\WebView2Loader.dll",
"name": "WebView2Loader.dll",
"directory": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.Edge_123082"
},
"crowdstrike": {
"customer_id": "222222222222222222222"
Expand Down
8 changes: 5 additions & 3 deletions ...perations_center/integrations/generated/1d172ee6-cdc0-4713-9cfd-43f7d9595777.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"event": {
"severity": 5,
"action": "DELIVERED",
"reason": "'\\=?ISO-8859-15?Q?foo\\=20bar\\=20baz\\=20-\\=123456789?\\='\n\n",
"reason": "'\\=?ISO-8859-15?Q?foo\\=20bar\\=20baz\\=20-\\=123456789?\\='",
"end": "2022-08-01T03:34:23Z",
"start": "2022-08-01T03:30:36Z"
},
Expand Down Expand Up @@ -766,7 +766,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"message": "CEF:0|SEKOIA.IO|SIC|v0.3.12|666|Download|1|msg= sys.log downloaded by [email protected] src=127.0.0.1 cn1=53 cn1Label=seconds cs1Label=type cs1=ssl_download cs2Label=location cs2=home fname=sys.log fsize=666 [email protected]",
"event": {
"severity": 1,
"reason": " sys.log downloaded by [email protected]"
"reason": "sys.log downloaded by [email protected]"
},
"observer": {
"vendor": "SEKOIA.IO",
Expand Down Expand Up @@ -988,7 +988,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
},
"file": {
"inode": "0",
"path": "page-icon.png"
"path": "page-icon.png",
"name": "page-icon.png",
"directory": ""
},
"cef": {
"externalId": "xxxxxxxxxxxxx",
Expand Down
68 changes: 63 additions & 5 deletions ...perations_center/integrations/generated/250e4095-fa08-4101-bb02-e72f870fcbd1.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -647,7 +647,32 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"message": "{\"user\":{\"target\":{\"id\":\"S-1-5-18\",\"name\":\"Syst\u00e8me\",\"domain\":\"AUTORITE NT\"},\"id\":\"S-1-5-18\",\"name\":\"SRV-FOO\",\"domain\":\"MY-DOMAIN\"},\"action\":{\"properties\":{\"AuthenticationPackageName\":\"Negotiate\",\"EventType\":\"AUDIT_SUCCESS\",\"ImpersonationLevel\":\"%%1833\",\"IpAddress\":\"-\",\"IpPort\":\"-\",\"KeyLength\":\"0\",\"Keywords\":\"0x8020000000000000\",\"LmPackageName\":\"-\",\"LogonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"LogonProcessName\":\"Advapi \",\"LogonType\":\"5\",\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\services.exe\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"SubjectDomainName\":\"MY-DOMAIN\",\"SubjectLogonId\":\"0x3E7\",\"SubjectUserName\":\"SRV-FOO\",\"SubjectUserSid\":\"S-1-5-18\",\"TargetDomainName\":\"AUTORITE NT\",\"TargetLogonId\":\"0x3E7\",\"TargetUserName\":\"Syst\u00e8me\",\"TargetUserSid\":\"S-1-5-18\",\"TransmittedServices\":\"-\",\"WorkstationName\":\"-\"},\"id\":4624},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4624},\"agent\":{\"id\":\"1193b609e262926e284b6076cab8919b8725fa9f576a22c7e0041edeb04f5c76\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"SRV-FOO\"},\"process\":{\"executable\":\"C:\\\\Windows\\\\System32\\\\services.exe\",\"name\":\"services.exe\",\"pid\":676},\"@timestamp\":\"2023-06-23T08:15:00.4849617Z\"}\n",
"event": {
"code": "4624",
"provider": "Microsoft-Windows-Security-Auditing"
"provider": "Microsoft-Windows-Security-Auditing",
"category": [
"authentication"
],
"type": [
"start"
],
"action": "authentication_service"
},
"sekoiaio": {
"client": {
"os": {
"type": "windows"
},
"name": "SRV-FOO",
"user": {
"name": "SRV-FOO",
"id": "S-1-5-18"
}
},
"server": {
"name": "SRV-FOO",
"os": {
"type": "windows"
}
}
},
"@timestamp": "2023-06-23T08:15:00.484961Z",
"action": {
Expand Down Expand Up @@ -678,7 +703,8 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"TransmittedServices": "-",
"WorkstationName": "-"
},
"id": 4624
"id": 4624,
"outcome": "success"
},
"agent": {
"id": "1193b609e262926e284b6076cab8919b8725fa9f576a22c7e0041edeb04f5c76",
Expand All @@ -693,7 +719,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
},
"process": {
"executable": "C:\\Windows\\System32\\services.exe",
"name": "services.exe",
"name": "Advapi ",
"pid": 676
},
"user": {
Expand Down Expand Up @@ -727,7 +753,32 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"message": "{\"user\":{\"target\":{\"id\":\"S-1-0-0\",\"name\":\"foo-vm\",\"domain\":\"foo-vm\"},\"id\":\"S-1-0-0\"},\"action\":{\"properties\":{\"AuthenticationPackageName\":\"NTLM\",\"EventType\":\"AUDIT_FAILURE\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"1.1.1.1\",\"IpPort\":\"0\",\"KeyLength\":\"0\",\"Keywords\":\"0x8010000000000000\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":\"3\",\"ProcessName\":\"-\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"Status\":\"0xC000006D\",\"SubStatus\":\"0xC0000064\",\"SubjectDomainName\":\"-\",\"SubjectLogonId\":\"0x0\",\"SubjectUserName\":\"-\",\"SubjectUserSid\":\"S-1-0-0\",\"TargetDomainName\":\"foo-vm\",\"TargetUserName\":\"foo-vm\",\"TargetUserSid\":\"S-1-0-0\",\"TransmittedServices\":\"-\",\"WorkstationName\":\"WIN-FOO\"},\"id\":4625},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4625},\"agent\":{\"id\":\"dd4e2378f7208b8b8557a9b7a725b6d551887b868c72b8cb91668d56eca10c6f\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"foo-vm\"},\"source\":{\"address\":\"1.1.1.1\",\"ip\":\"1.1.1.1\"},\"@timestamp\":\"2023-06-23T08:13:49.4015618Z\"}\n",
"event": {
"code": "4625",
"provider": "Microsoft-Windows-Security-Auditing"
"provider": "Microsoft-Windows-Security-Auditing",
"category": [
"authentication"
],
"type": [
"start"
],
"action": "authentication_network",
"reason": "user_not_exist"
},
"sekoiaio": {
"client": {
"os": {
"type": "windows"
},
"name": "WIN-FOO",
"user": {
"id": "S-1-0-0"
}
},
"server": {
"name": "foo-vm",
"os": {
"type": "windows"
}
}
},
"@timestamp": "2023-06-23T08:13:49.401561Z",
"action": {
Expand Down Expand Up @@ -758,7 +809,8 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"TransmittedServices": "-",
"WorkstationName": "WIN-FOO"
},
"id": 4625
"id": 4625,
"outcome": "failure"
},
"agent": {
"id": "dd4e2378f7208b8b8557a9b7a725b6d551887b868c72b8cb91668d56eca10c6f",
Expand Down Expand Up @@ -790,6 +842,12 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"ip": [
"1.1.1.1"
]
},
"client": {
"ip": "1.1.1.1"
},
"process": {
"name": "NtLmSsp "
}
}
Expand Down
15 changes: 14 additions & 1 deletion ...perations_center/integrations/generated/2815eaab-2425-4eff-8038-3f7d5a3b8b11.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,20 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"message": "{\"category\":\"WindowsEventLogsTable\",\"level\":\"Informational\",\"properties\":{\"Channel\":\"Security\",\"DeploymentId\":\"cbfba34a-3d3d-4425-aefb-968ee470a8f4\",\"Description\":\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t3\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tIdentification\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-1004336348-2052111302-725345543-33053\\r\\n\\tAccount Name:\\t\\tHOSTMON\\r\\n\\tAccount Domain:\\t\\tACME.LOCAL\\r\\n\\tLogon ID:\\t\\t0x6409B67A\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{FF0FDD6A-555D-EA36-45CB-9167DFB9C75D}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x0\\r\\n\\tProcess Name:\\t\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\t-\\r\\n\\tSource Network Address:\\t10.129.224.1\\r\\n\\tSource Port:\\t\\t55731\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tKerberos\\r\\n\\tAuthentication Package:\\tKerberos\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\",\"EventId\":4624,\"Level\":0,\"Opcode\":0,\"Pid\":632,\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"ProviderName\":\"Microsoft-Windows-Security-Auditing\",\"RawXml\":\"<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2019-07-22T11:20:54.558577600Z'/><EventRecordID>9999727</EventRecordID><Correlation ActivityID='{32528DD5-0278-4450-AFD8-22FEBDA102F1}'/><Execution ProcessID='632' ThreadID='904'/><Channel>Security</Channel><Computer>AZNTPI-01.acme.local</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-0-0</Data><Data Name='SubjectUserName'>-</Data><Data Name='SubjectDomainName'>-</Data><Data Name='SubjectLogonId'>0x0</Data><Data Name='TargetUserSid'>S-1-5-21-1004336348-2052111302-725345543-33053</Data><Data Name='TargetUserName'>HOSTMON</Data><Data Name='TargetDomainName'>ACME.LOCAL</Data><Data Name='TargetLogonId'>0x6409b67a</Data><Data Name='LogonType'>3</Data><Data Name='LogonProcessName'>Kerberos</Data><Data Name='AuthenticationPackageName'>Kerberos</Data><Data Name='WorkstationName'>-</Data><Data Name='LogonGuid'>{FF0FDD6A-555D-EA36-45CB-9167DFB9C75D}</Data><Data Name='TransmittedServices'>-</Data><Data Name='LmPackageName'>-</Data><Data Name='KeyLength'>0</Data><Data Name='ProcessId'>0x0</Data><Data Name='ProcessName'>-</Data><Data Name='IpAddress'>10.129.224.1</Data><Data Name='IpPort'>55731</Data><Data Name='ImpersonationLevel'>%%1832</Data><Data Name='RestrictedAdminMode'>-</Data><Data Name='TargetOutboundUserName'>-</Data><Data Name='TargetOutboundDomainName'>-</Data><Data Name='VirtualAccount'>%%1843</Data><Data Name='TargetLinkedLogonId'>0x0</Data><Data Name='ElevatedToken'>%%1842</Data></EventData></Event>\",\"Role\":\"IaaS\",\"RoleInstance\":\"_AZNTPI-01\",\"Task\":12544,\"Tid\":904},\"time\":\"2019-07-22T11:20:54.5585776Z\"}",
"event": {
"code": "4624",
"provider": "Microsoft-Windows-Security-Auditing"
"provider": "Microsoft-Windows-Security-Auditing",
"category": [
"authentication"
],
"type": [
"start"
]
},
"sekoiaio": {
"server": {
"os": {
"type": "windows"
}
}
},
"os": {
"family": "windows",
Expand Down
12 changes: 9 additions & 3 deletions ...perations_center/integrations/generated/3f330d19-fdea-48ac-96bd-91a447bb26bd.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
},
"file": {
"path": "C:\\Users\\XXXXXXXX\\Downloads\\YYYYYYYYYYYYYYYYY.mp4",
"size": 559316722
"size": 559316722,
"name": "YYYYYYYYYYYYYYYYY.mp4",
"directory": "C:\\Users\\XXXXXXXX\\Downloads"
},
"rule": {
"name": "Multimedia file"
Expand Down Expand Up @@ -243,7 +245,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
},
"file": {
"path": "C:\\Users\\XXXXXXXX\\Downloads\\YYYYYYYYYYYYYYYYY.mp4",
"size": 559316722
"size": 559316722,
"name": "YYYYYYYYYYYYYYYYY.mp4",
"directory": "C:\\Users\\XXXXXXXX\\Downloads"
},
"rule": {
"name": "Multimedia file"
Expand Down Expand Up @@ -617,7 +621,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"ip": "1.2.3.4"
},
"file": {
"path": "C:\\Users\\XXXXXXXXXX\\AppData\\Local\\Microsoft\\SquirrelTemp\\tempc"
"path": "C:\\Users\\XXXXXXXXXX\\AppData\\Local\\Microsoft\\SquirrelTemp\\tempc",
"name": "tempc",
"directory": "C:\\Users\\XXXXXXXXXX\\AppData\\Local\\Microsoft\\SquirrelTemp"
},
"rule": {
"name": "Rule Generic PUA"
Expand Down
Loading

0 comments on commit f501578

Please sign in to comment.