From 1195d13132e3deb2162a6327d0b4ae795a40d622 Mon Sep 17 00:00:00 2001
From: junk <junk@noreply.localhost>
Date: Sun, 12 Jan 2025 19:30:11 -0500
Subject: [PATCH] Update splunk_alert.md

---
 splunk_alert.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/splunk_alert.md b/splunk_alert.md
index 125b89c..9fdf6f7 100644
--- a/splunk_alert.md
+++ b/splunk_alert.md
@@ -50,4 +50,9 @@ table _time indextime event_description host_fqdn user_name process_path process
 ## WMI Whitelist
 ```
 | table _time indextime host_fqdn user_name wmi_consumer_name wmi_consumer_destination
+```
+
+## File Create
+```
+| table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger
 ```
\ No newline at end of file