securonix_ems.yml

title: Securonix
order: 20
backends:
  - securonix
logsources:
  win-sysmon:
    product: windows
    service: sysmon
    conditions:
      rg_functionality: Endpoint Management Systems
  win-defender:
    product: windows_defender
    conditions:
      rg_functionality: Endpoint Management Systems
  win-windefend:
    product: windows
    service: windefend
    conditions:
      rg_functionality: Endpoint Management Systems
  win-def:
    category: windows
    product: windef
    conditions:
      rg_functionality: Endpoint Management Systems
  win-antivirus:
    product: antivirus
    conditions:
      rg_functionality: Endpoint Management Systems
fieldmappings:
  SourceImage: 
    - '@filepath'
    - '@filename'
  TargetImage: 
    - '@filename'
    - '@filepath'
  StartModule: '@customstring58'
  StartFunction: '@customstring55'
  TargetFilename: '@filename'
  Image: 
    - '@deviceprocessname'
    - '@sourceprocessname'
    - '@destinationprocessname'
    - '@resourcecustomfield4'
    - '@customstring54'
    - '@customstring57'
  QueryResult: '@customstring53'
  QueryName: '@destinationhostname'
  QueryStatus: '@eventoutcome'
  Imphash: 
    - '@customstring3' 
    - '@filehash'
  IntegrityLevel: '@customstring7'
  ParentProcessCommandLine: '@resourcecustomfield2'
  PipeName: '@filename'
  ProcessID: 
    - '@destinationprocessid'
    - '@sourceprocessid'
  Device: 
    - '@devicehostname'
    - '@devicemacaddress'
    - '@devicentdomain'
  Destination: '@filename'
  ParentImage: '@customstring59'
  CommandLine: '@resourcecustomfield1'
  OiginalFileName: '@oldfilename' 
  #ImageLoaded: '@'
  #TargetProcessAddress: '@'
  #Details: '@'