junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk_alert.md

Browse Source
This commit is contained in:
junk
2025-01-12 19:30:11 -05:00
parent 8f7245dd18
commit 1195d13132
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
splunk_alert.md
View File

@ -50,4 +50,9 @@ table _time indextime event_description host_fqdn user_name process_path process
## WMI Whitelist
```
| table _time indextime host_fqdn user_name wmi_consumer_name wmi_consumer_destination
```
## File Create
```
| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger
```