Skip to content

Commit dc52ae8

Browse files
saltar-uasaltar-ua
authored
Merge pull request #136 from UncoderIO/gis-aql-12-06-2024-2
mapping improvement - stats from 05.06.24
2 parents 32238c6 + 949b3ae commit dc52ae8

File tree

9 files changed

+119
-33
lines changed

9 files changed

+119
-33
lines changed

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/default.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ field_mapping:
7575
NewTargetUserName: xdm.target.user.username
7676
OldTargetUserName: xdm.target.user.username
7777
UserPrincipalName: xdm.source.user.username
78-
7978
DestAddress: xdm.target.ipv4
8079
SubjectUserName: xdm.source.user.username
8180
SubjectUserSid: xdm.source.user.identifier
@@ -115,3 +114,7 @@ field_mapping:
115114
http.method: xdm.network.http.method
116115
method: xdm.network.http.method
117116
notice.user_agent: xdm.network.http.browser
117+
hasIdentity: xdm.source.user.identity_type
118+
SubjectAccountName: xdm.source.user.username
119+
ComputerName: xdm.source.host.hostname
120+
ExternalSeverity: xdm.alert.severity

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/proxy.yml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,17 @@ default_log_source:
66

77
field_mapping:
88
c-uri: xdm.network.http.url
9-
c-useragent: xdm.source.user_agent
9+
c-useragent: xdm.network.http.browser
1010
cs-method: xdm.network.http.method
1111
cs-bytes: xdm.target.sent_bytes
1212
c-uri-query: xdm.network.http.url
1313
cs-referrer: xdm.network.http.referrer
1414
sc-status: xdm.network.http.response_code
15-
cs-host: xdm.network.http.url
16-
cs-uri-query: xdm.network.http.url
15+
cs-host: xdm.network.http.domain
16+
cs-uri-query: xdm.network.http.url
17+
cs-cookie-vars: xdm.network.http.http_header.value
18+
c-uri-extension: xdm.network.http.url
19+
cs-cookie: xdm.network.http.http_header.value
20+
#cs-version: cs-version
21+
r-dns: xdm.network.http.domain
22+
post-body: xdm.network.http.http_header.value

‎uncoder-core/app/translator/mappings/platforms/palo_alto_cortex/windows_process_termination.yml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
platform: Palo Alto XSIAM
2+
source: windows_process_termination
3+
4+
log_source:
5+
preset: xdr_process
6+
7+
default_log_source:
8+
preset: xdr_process
9+
10+
field_mapping:
11+
Image: action_process_image_path
12+
ProcessId: action_process_os_pid
13+
ProcessGuid: ProcessGuid

‎uncoder-core/app/translator/mappings/platforms/qradar/default.yml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,19 @@ field_mapping:
3232
Application:
3333
- Application
3434
- application
35-
SourceHostName: HostCount-source
36-
DestinationHostname: HostCount-destination
35+
SourceHostName:
36+
- HostCount-source
37+
- identityHostName
38+
- sourceAssetName
39+
DestinationHostname:
40+
- HostCount-destination
41+
- Recipient Host
3742
src-packets:
3843
- PacketRatio-src
3944
- src-packets
4045
dst-packets:
4146
- PacketRatio-dst
4247
- dst-packets
4348
src-bytes: src-bytes
44-
dst-bytes: dst-bytes
49+
dst-bytes: dst-bytes
50+
ExternalSeverity: External Severity

‎uncoder-core/app/translator/mappings/platforms/qradar/firewall.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,4 +29,5 @@ field_mapping:
2929
- DstPort
3030
- RemotePort
3131
Protocol: IPProtocol
32+
application: Application
3233
Application: Application

‎uncoder-core/app/translator/mappings/platforms/qradar/proxy.yml

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,23 @@ field_mapping:
1313
- URL
1414
- XForceCategoryByURL
1515
c-useragent: User Agent
16-
cs-method: cs-method
16+
cs-method: HTTP Method
1717
cs-bytes: Bytes Sent
18-
cs-cookie-vars: cs-cookie-vars
18+
#cs-cookie-vars: cs-cookie-vars
1919
c-uri-extension: URL
20-
c-uri-query: URL
21-
cs-cookie: cs-cookie
22-
cs-host: cs-host
23-
cs-referrer: URL Referrer
24-
cs-version: cs-version
25-
r-dns: r-dns
26-
sc-status: sc-status
27-
post-body: post-body
20+
c-uri-query:
21+
- URL
22+
- URL Path
23+
#cs-cookie: cs-cookie
24+
cs-host:
25+
- UrlHost
26+
- URL Host
27+
cs-referrer:
28+
- URL Referrer
29+
- Referrer URL
30+
cs-version: HTTP Version
31+
r-dns:
32+
- UrlHost
33+
- URL Host
34+
sc-status: HTTP Response Code
35+
#post-body: post-body

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_image_load.yml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,12 @@ default_log_source:
1313
qideventcategory: Microsoft-Windows-Sysmon/Operational
1414

1515
field_mapping:
16-
Image: username
17-
ImageLoaded: Process Path
18-
SignatureStatus: Signature Status
16+
Image: Process Path
17+
ImageLoaded:
18+
- Process Path
19+
- LoadedImage
20+
SignatureStatus:
21+
- Signature Status
22+
- SignatureStatus
1923
OriginalFileName: OriginalFileName
2024
Signed: Signed

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_process_termination.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
platform: Qradar
2+
source: windows_process_termination
3+
4+
5+
log_source:
6+
devicetype: [12]
7+
category: [8113]
8+
9+
default_log_source:
10+
devicetype: 12
11+
category: 8113
12+
13+
field_mapping:
14+
Image: Process Path
15+
ProcessId: ProcessId
16+
# ProcessGuid: ProcessGuid

‎uncoder-core/app/translator/mappings/platforms/qradar/windows_security.yml

Lines changed: 42 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,28 +19,44 @@ field_mapping:
1919
AuthenticationPackageName: AuthenticationPackageName
2020
CallingProcessName: CallingProcessName
2121
Channel: Channel
22-
ComputerName: Machine Identifier
22+
ComputerName:
23+
- Machine Identifier
24+
- Hostname
2325
EventType: EventType
2426
FailureReason: FailureReason
2527
FileName: Filename
2628
GrantedAccess: GrantedAccess
2729
Hashes: File Hash
2830
HiveName: HiveName
29-
IpAddress: IpAddress
30-
IpPort: IpPort
31+
IpAddress:
32+
- sourceip
33+
- identityIP
34+
IpPort: sourceport
3135
KeyLength: KeyLength
3236
LogonProcessName: LogonProcessName
33-
LogonType: Logon Type
37+
LogonType:
38+
- Logon Type
39+
- Login Type
40+
- MSLogonType
3441
LinkName: LinkName
3542
MemberName: MemberName
3643
MemberSid: MemberSid
3744
NewProcessName: Process Name
3845
ObjectClass: ObjectClass
39-
ObjectName: Object Name
40-
ObjectType: Object Type
46+
ObjectName:
47+
- Object Name
48+
- objectname
49+
- MSFileObjectName
50+
- ObjectName_Filename
51+
- ObjectName
52+
ObjectType:
53+
- Object Type
54+
- ObjectType
4155
ObjectValueName: ObjectValueName
4256
Path: Path
43-
CommandLine: Command
57+
CommandLine:
58+
- Command
59+
- Process Command Line
4460
OldUacValue: OldUacValue
4561
SubStatus: SubStatus
4662
DisplayName: DisplayName
@@ -55,7 +71,9 @@ field_mapping:
5571
ClientProcessId: ClientProcessId
5672
ParentProcessId: ParentProcessId
5773
AccessList: AccessList
58-
GroupMembership: GroupMembership
74+
GroupMembership:
75+
- GroupMembership
76+
- GroupName
5977
FilterName: FilterName
6078
ChangeType: ChangeType
6179
LayerName: LayerName
@@ -101,23 +119,32 @@ field_mapping:
101119
UserAccountControl: UserAccountControl
102120
RegistryValue: Target Object
103121
SecurityID: SecurityID
104-
ServiceFileName: Service Filename
122+
ServiceFileName:
123+
- Service Filename
124+
- ServiceFileName
105125
SecurityDescriptor: SecurityDescriptor
106126
ServiceName: Service Name
107-
ShareName: Share Name
127+
ShareName:
128+
- Share Name
129+
- ShareName
108130
NewValue: NewValue
109131
Source: Source
110132
Status: Status
111133
SubjectDomainName: SubjectDomainName
112134
SubjectUserName: Target Username
113135
SubjectUserSid: SubjectUserSid
114136
SourceAddr: sourceip
115-
SourceAddress: sourceip
137+
SourceAddress:
138+
- sourceip
139+
- sourceaddress
140+
TargetFilename: File Directory
116141
TargetName: Target Username
117142
ServicePrincipalNames: ServicePrincipalNames
118143
TargetDomainName: TargetDomainName
119144
TargetSid: TargetSid
120-
TargetUserName: Target Username
145+
TargetUserName:
146+
- Target Username
147+
- Target User Name
121148
ObjectServer: ObjectServer
122149
TargetUserSid: TargetUserSid
123150
TicketEncryptionType: TicketEncryptionType
@@ -143,4 +170,6 @@ field_mapping:
143170
StartType: StartType
144171
UserID: UserID
145172
ParentProcessName: Parent Process Name
146-
Service: Service
173+
Service: Service
174+
hasIdentity: hasIdentity
175+
SubjectAccountName: SubjectAccountName

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy