SEKOIA-IO · otetard · Sep 20, 2023 · Sep 20, 2023
diff --git a/...perations_center/integrations/generated/021e9def-5a55-4369-941e-af269b45bef1.md b/...perations_center/integrations/generated/021e9def-5a55-4369-941e-af269b45bef1.md
@@ -878,7 +878,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "device": "00:00",
             "inode": "25973",
             "mode": "0644",
-            "uid": "0"
+            "uid": "0",
+            "name": "oom_score_adj",
+            "directory": "/proc/1"
         },
         "host": {
             "name": "xps-housetodd",

diff --git a/...perations_center/integrations/generated/07c556c0-0675-478c-9803-e7990afe78b6.md b/...perations_center/integrations/generated/07c556c0-0675-478c-9803-e7990afe78b6.md
@@ -469,7 +469,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         },
         "@timestamp": "2022-04-11T07:18:34.090547Z",
         "file": {
-            "path": "C:\\Windows\\system32\\diskshadow.exe"
+            "path": "C:\\Windows\\system32\\diskshadow.exe",
+            "name": "diskshadow.exe",
+            "directory": "C:\\Windows\\system32"
         },
         "related": {
             "user": [

diff --git a/...perations_center/integrations/generated/10999b99-9a8d-4b92-9fbd-01e3fac01cd5.md b/...perations_center/integrations/generated/10999b99-9a8d-4b92-9fbd-01e3fac01cd5.md
@@ -366,7 +366,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "id": "111111111111111"
         },
         "file": {
-            "path": "dal_0234.dll"
+            "path": "dal_0234.dll",
+            "name": "dal_0234.dll",
+            "directory": ""
         },
         "crowdstrike": {
             "customer_id": "222222222222222222222"
@@ -747,7 +749,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "id": "111111111111111"
         },
         "file": {
-            "path": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Group Policy\\Users\\S-1-5-21-1111111111-2222222222-3333333333-27500\\History\\{7330D718-94E9-43DB-8BCB-1F2D0C2FB34E}\\S-1-5-21-1111111111-2222222222-3333333333-27500\\Preferences"
+            "path": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Group Policy\\Users\\S-1-5-21-1111111111-2222222222-3333333333-27500\\History\\{7330D718-94E9-43DB-8BCB-1F2D0C2FB34E}\\S-1-5-21-1111111111-2222222222-3333333333-27500\\Preferences",
+            "name": "Preferences",
+            "directory": "\\Device\\HarddiskVolume4\\ProgramData\\Microsoft\\Group Policy\\Users\\S-1-5-21-1111111111-2222222222-3333333333-27500\\History\\{7330D718-94E9-43DB-8BCB-1F2D0C2FB34E}\\S-1-5-21-1111111111-2222222222-3333333333-27500"
         },
         "crowdstrike": {
             "customer_id": "222222222222222222222"
@@ -1097,7 +1101,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "id": "111111111111111"
         },
         "file": {
-            "path": "\\Device\\HarddiskVolume3\\Users\\j.doe\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Cache_Data\\f_010051"
+            "path": "\\Device\\HarddiskVolume3\\Users\\j.doe\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Cache_Data\\f_010051",
+            "name": "f_010051",
+            "directory": "\\Device\\HarddiskVolume3\\Users\\j.doe\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Cache_Data"
         },
         "crowdstrike": {
             "customer_id": "222222222222222222222"
@@ -1145,7 +1151,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "id": "111111111111111"
         },
         "file": {
-            "path": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.Edge_123082\\WebView2Loader.dll"
+            "path": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.Edge_123082\\WebView2Loader.dll",
+            "name": "WebView2Loader.dll",
+            "directory": "\\Device\\HarddiskVolume3\\Program Files\\WindowsApps\\Microsoft.Edge_123082"
         },
         "crowdstrike": {
             "customer_id": "222222222222222222222"

diff --git a/...perations_center/integrations/generated/1d172ee6-cdc0-4713-9cfd-43f7d9595777.md b/...perations_center/integrations/generated/1d172ee6-cdc0-4713-9cfd-43f7d9595777.md
@@ -34,7 +34,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         "event": {
             "severity": 5,
             "action": "DELIVERED",
-            "reason": "'\\=?ISO-8859-15?Q?foo\\=20bar\\=20baz\\=20-\\=123456789?\\='\n\n",
+            "reason": "'\\=?ISO-8859-15?Q?foo\\=20bar\\=20baz\\=20-\\=123456789?\\='",
             "end": "2022-08-01T03:34:23Z",
             "start": "2022-08-01T03:30:36Z"
         },
@@ -766,7 +766,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         "message": "CEF:0|SEKOIA.IO|SIC|v0.3.12|666|Download|1|msg= sys.log downloaded by [email protected] src=127.0.0.1 cn1=53 cn1Label=seconds cs1Label=type cs1=ssl_download cs2Label=location cs2=home fname=sys.log fsize=666 [email protected]",
         "event": {
             "severity": 1,
-            "reason": " sys.log downloaded by [email protected]"
+            "reason": "sys.log downloaded by [email protected]"
         },
         "observer": {
             "vendor": "SEKOIA.IO",
@@ -988,7 +988,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         },
         "file": {
             "inode": "0",
-            "path": "page-icon.png"
+            "path": "page-icon.png",
+            "name": "page-icon.png",
+            "directory": ""
         },
         "cef": {
             "externalId": "xxxxxxxxxxxxx",

diff --git a/...perations_center/integrations/generated/250e4095-fa08-4101-bb02-e72f870fcbd1.md b/...perations_center/integrations/generated/250e4095-fa08-4101-bb02-e72f870fcbd1.md
@@ -647,7 +647,32 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         "message": "{\"user\":{\"target\":{\"id\":\"S-1-5-18\",\"name\":\"Syst\u00e8me\",\"domain\":\"AUTORITE NT\"},\"id\":\"S-1-5-18\",\"name\":\"SRV-FOO\",\"domain\":\"MY-DOMAIN\"},\"action\":{\"properties\":{\"AuthenticationPackageName\":\"Negotiate\",\"EventType\":\"AUDIT_SUCCESS\",\"ImpersonationLevel\":\"%%1833\",\"IpAddress\":\"-\",\"IpPort\":\"-\",\"KeyLength\":\"0\",\"Keywords\":\"0x8020000000000000\",\"LmPackageName\":\"-\",\"LogonGuid\":\"{00000000-0000-0000-0000-000000000000}\",\"LogonProcessName\":\"Advapi \",\"LogonType\":\"5\",\"ProcessName\":\"C:\\\\Windows\\\\System32\\\\services.exe\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"SubjectDomainName\":\"MY-DOMAIN\",\"SubjectLogonId\":\"0x3E7\",\"SubjectUserName\":\"SRV-FOO\",\"SubjectUserSid\":\"S-1-5-18\",\"TargetDomainName\":\"AUTORITE NT\",\"TargetLogonId\":\"0x3E7\",\"TargetUserName\":\"Syst\u00e8me\",\"TargetUserSid\":\"S-1-5-18\",\"TransmittedServices\":\"-\",\"WorkstationName\":\"-\"},\"id\":4624},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4624},\"agent\":{\"id\":\"1193b609e262926e284b6076cab8919b8725fa9f576a22c7e0041edeb04f5c76\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"SRV-FOO\"},\"process\":{\"executable\":\"C:\\\\Windows\\\\System32\\\\services.exe\",\"name\":\"services.exe\",\"pid\":676},\"@timestamp\":\"2023-06-23T08:15:00.4849617Z\"}\n",
         "event": {
             "code": "4624",
-            "provider": "Microsoft-Windows-Security-Auditing"
+            "provider": "Microsoft-Windows-Security-Auditing",
+            "category": [
+                "authentication"
+            ],
+            "type": [
+                "start"
+            ],
+            "action": "authentication_service"
+        },
+        "sekoiaio": {
+            "client": {
+                "os": {
+                    "type": "windows"
+                },
+                "name": "SRV-FOO",
+                "user": {
+                    "name": "SRV-FOO",
+                    "id": "S-1-5-18"
+                }
+            },
+            "server": {
+                "name": "SRV-FOO",
+                "os": {
+                    "type": "windows"
+                }
+            }
         },
         "@timestamp": "2023-06-23T08:15:00.484961Z",
         "action": {
@@ -678,7 +703,8 @@ Find below few samples of events and how they are normalized by Sekoia.io.
                 "TransmittedServices": "-",
                 "WorkstationName": "-"
             },
-            "id": 4624
+            "id": 4624,
+            "outcome": "success"
         },
         "agent": {
             "id": "1193b609e262926e284b6076cab8919b8725fa9f576a22c7e0041edeb04f5c76",
@@ -693,7 +719,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         },
         "process": {
             "executable": "C:\\Windows\\System32\\services.exe",
-            "name": "services.exe",
+            "name": "Advapi ",
             "pid": 676
         },
         "user": {
@@ -727,7 +753,32 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         "message": "{\"user\":{\"target\":{\"id\":\"S-1-0-0\",\"name\":\"foo-vm\",\"domain\":\"foo-vm\"},\"id\":\"S-1-0-0\"},\"action\":{\"properties\":{\"AuthenticationPackageName\":\"NTLM\",\"EventType\":\"AUDIT_FAILURE\",\"FailureReason\":\"%%2313\",\"IpAddress\":\"1.1.1.1\",\"IpPort\":\"0\",\"KeyLength\":\"0\",\"Keywords\":\"0x8010000000000000\",\"LmPackageName\":\"-\",\"LogonProcessName\":\"NtLmSsp \",\"LogonType\":\"3\",\"ProcessName\":\"-\",\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"Severity\":\"LOG_ALWAYS\",\"SourceName\":\"Microsoft-Windows-Security-Auditing\",\"Status\":\"0xC000006D\",\"SubStatus\":\"0xC0000064\",\"SubjectDomainName\":\"-\",\"SubjectLogonId\":\"0x0\",\"SubjectUserName\":\"-\",\"SubjectUserSid\":\"S-1-0-0\",\"TargetDomainName\":\"foo-vm\",\"TargetUserName\":\"foo-vm\",\"TargetUserSid\":\"S-1-0-0\",\"TransmittedServices\":\"-\",\"WorkstationName\":\"WIN-FOO\"},\"id\":4625},\"event\":{\"provider\":\"Microsoft-Windows-Security-Auditing\",\"code\":4625},\"agent\":{\"id\":\"dd4e2378f7208b8b8557a9b7a725b6d551887b868c72b8cb91668d56eca10c6f\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"windows\"},\"hostname\":\"foo-vm\"},\"source\":{\"address\":\"1.1.1.1\",\"ip\":\"1.1.1.1\"},\"@timestamp\":\"2023-06-23T08:13:49.4015618Z\"}\n",
         "event": {
             "code": "4625",
-            "provider": "Microsoft-Windows-Security-Auditing"
+            "provider": "Microsoft-Windows-Security-Auditing",
+            "category": [
+                "authentication"
+            ],
+            "type": [
+                "start"
+            ],
+            "action": "authentication_network",
+            "reason": "user_not_exist"
+        },
+        "sekoiaio": {
+            "client": {
+                "os": {
+                    "type": "windows"
+                },
+                "name": "WIN-FOO",
+                "user": {
+                    "id": "S-1-0-0"
+                }
+            },
+            "server": {
+                "name": "foo-vm",
+                "os": {
+                    "type": "windows"
+                }
+            }
         },
         "@timestamp": "2023-06-23T08:13:49.401561Z",
         "action": {
@@ -758,7 +809,8 @@ Find below few samples of events and how they are normalized by Sekoia.io.
                 "TransmittedServices": "-",
                 "WorkstationName": "WIN-FOO"
             },
-            "id": 4625
+            "id": 4625,
+            "outcome": "failure"
         },
         "agent": {
             "id": "dd4e2378f7208b8b8557a9b7a725b6d551887b868c72b8cb91668d56eca10c6f",
@@ -790,6 +842,12 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "ip": [
                 "1.1.1.1"
             ]
+        },
+        "client": {
+            "ip": "1.1.1.1"
+        },
+        "process": {
+            "name": "NtLmSsp "
         }
     }
     	

diff --git a/...perations_center/integrations/generated/2815eaab-2425-4eff-8038-3f7d5a3b8b11.md b/...perations_center/integrations/generated/2815eaab-2425-4eff-8038-3f7d5a3b8b11.md
@@ -125,7 +125,20 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         "message": "{\"category\":\"WindowsEventLogsTable\",\"level\":\"Informational\",\"properties\":{\"Channel\":\"Security\",\"DeploymentId\":\"cbfba34a-3d3d-4425-aefb-968ee470a8f4\",\"Description\":\"An account was successfully logged on.\\r\\n\\r\\nSubject:\\r\\n\\tSecurity ID:\\t\\tS-1-0-0\\r\\n\\tAccount Name:\\t\\t-\\r\\n\\tAccount Domain:\\t\\t-\\r\\n\\tLogon ID:\\t\\t0x0\\r\\n\\r\\nLogon Information:\\r\\n\\tLogon Type:\\t\\t3\\r\\n\\tRestricted Admin Mode:\\t-\\r\\n\\tVirtual Account:\\t\\tNo\\r\\n\\tElevated Token:\\t\\tYes\\r\\n\\r\\nImpersonation Level:\\t\\tIdentification\\r\\n\\r\\nNew Logon:\\r\\n\\tSecurity ID:\\t\\tS-1-5-21-1004336348-2052111302-725345543-33053\\r\\n\\tAccount Name:\\t\\tHOSTMON\\r\\n\\tAccount Domain:\\t\\tACME.LOCAL\\r\\n\\tLogon ID:\\t\\t0x6409B67A\\r\\n\\tLinked Logon ID:\\t\\t0x0\\r\\n\\tNetwork Account Name:\\t-\\r\\n\\tNetwork Account Domain:\\t-\\r\\n\\tLogon GUID:\\t\\t{FF0FDD6A-555D-EA36-45CB-9167DFB9C75D}\\r\\n\\r\\nProcess Information:\\r\\n\\tProcess ID:\\t\\t0x0\\r\\n\\tProcess Name:\\t\\t-\\r\\n\\r\\nNetwork Information:\\r\\n\\tWorkstation Name:\\t-\\r\\n\\tSource Network Address:\\t10.129.224.1\\r\\n\\tSource Port:\\t\\t55731\\r\\n\\r\\nDetailed Authentication Information:\\r\\n\\tLogon Process:\\t\\tKerberos\\r\\n\\tAuthentication Package:\\tKerberos\\r\\n\\tTransited Services:\\t-\\r\\n\\tPackage Name (NTLM only):\\t-\\r\\n\\tKey Length:\\t\\t0\\r\\n\\r\\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\\r\\n\\r\\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\\r\\n\\r\\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\\r\\n\\r\\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\\r\\n\\r\\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\\r\\n\\r\\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\\r\\n\\r\\nThe authentication information fields provide detailed information about this specific logon request.\\r\\n\\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\\r\\n\\t- Transited services indicate which intermediate services have participated in this logon request.\\r\\n\\t- Package name indicates which sub-protocol was used among the NTLM protocols.\\r\\n\\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.\",\"EventId\":4624,\"Level\":0,\"Opcode\":0,\"Pid\":632,\"ProviderGuid\":\"{54849625-5478-4994-A5BA-3E3B0328C30D}\",\"ProviderName\":\"Microsoft-Windows-Security-Auditing\",\"RawXml\":\"<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-A5BA-3E3B0328C30D}'/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2019-07-22T11:20:54.558577600Z'/><EventRecordID>9999727</EventRecordID><Correlation ActivityID='{32528DD5-0278-4450-AFD8-22FEBDA102F1}'/><Execution ProcessID='632' ThreadID='904'/><Channel>Security</Channel><Computer>AZNTPI-01.acme.local</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-0-0</Data><Data Name='SubjectUserName'>-</Data><Data Name='SubjectDomainName'>-</Data><Data Name='SubjectLogonId'>0x0</Data><Data Name='TargetUserSid'>S-1-5-21-1004336348-2052111302-725345543-33053</Data><Data Name='TargetUserName'>HOSTMON</Data><Data Name='TargetDomainName'>ACME.LOCAL</Data><Data Name='TargetLogonId'>0x6409b67a</Data><Data Name='LogonType'>3</Data><Data Name='LogonProcessName'>Kerberos</Data><Data Name='AuthenticationPackageName'>Kerberos</Data><Data Name='WorkstationName'>-</Data><Data Name='LogonGuid'>{FF0FDD6A-555D-EA36-45CB-9167DFB9C75D}</Data><Data Name='TransmittedServices'>-</Data><Data Name='LmPackageName'>-</Data><Data Name='KeyLength'>0</Data><Data Name='ProcessId'>0x0</Data><Data Name='ProcessName'>-</Data><Data Name='IpAddress'>10.129.224.1</Data><Data Name='IpPort'>55731</Data><Data Name='ImpersonationLevel'>%%1832</Data><Data Name='RestrictedAdminMode'>-</Data><Data Name='TargetOutboundUserName'>-</Data><Data Name='TargetOutboundDomainName'>-</Data><Data Name='VirtualAccount'>%%1843</Data><Data Name='TargetLinkedLogonId'>0x0</Data><Data Name='ElevatedToken'>%%1842</Data></EventData></Event>\",\"Role\":\"IaaS\",\"RoleInstance\":\"_AZNTPI-01\",\"Task\":12544,\"Tid\":904},\"time\":\"2019-07-22T11:20:54.5585776Z\"}",
         "event": {
             "code": "4624",
-            "provider": "Microsoft-Windows-Security-Auditing"
+            "provider": "Microsoft-Windows-Security-Auditing",
+            "category": [
+                "authentication"
+            ],
+            "type": [
+                "start"
+            ]
+        },
+        "sekoiaio": {
+            "server": {
+                "os": {
+                    "type": "windows"
+                }
+            }
         },
         "os": {
             "family": "windows",

diff --git a/...perations_center/integrations/generated/3f330d19-fdea-48ac-96bd-91a447bb26bd.md b/...perations_center/integrations/generated/3f330d19-fdea-48ac-96bd-91a447bb26bd.md
@@ -181,7 +181,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         },
         "file": {
             "path": "C:\\Users\\XXXXXXXX\\Downloads\\YYYYYYYYYYYYYYYYY.mp4",
-            "size": 559316722
+            "size": 559316722,
+            "name": "YYYYYYYYYYYYYYYYY.mp4",
+            "directory": "C:\\Users\\XXXXXXXX\\Downloads"
         },
         "rule": {
             "name": "Multimedia file"
@@ -243,7 +245,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
         },
         "file": {
             "path": "C:\\Users\\XXXXXXXX\\Downloads\\YYYYYYYYYYYYYYYYY.mp4",
-            "size": 559316722
+            "size": 559316722,
+            "name": "YYYYYYYYYYYYYYYYY.mp4",
+            "directory": "C:\\Users\\XXXXXXXX\\Downloads"
         },
         "rule": {
             "name": "Multimedia file"
@@ -617,7 +621,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "ip": "1.2.3.4"
         },
         "file": {
-            "path": "C:\\Users\\XXXXXXXXXX\\AppData\\Local\\Microsoft\\SquirrelTemp\\tempc"
+            "path": "C:\\Users\\XXXXXXXXXX\\AppData\\Local\\Microsoft\\SquirrelTemp\\tempc",
+            "name": "tempc",
+            "directory": "C:\\Users\\XXXXXXXXXX\\AppData\\Local\\Microsoft\\SquirrelTemp"
         },
         "rule": {
             "name": "Rule Generic PUA"