From 2ee3f07f7fdbe4053ba3a6af9707cf66db862e43 Mon Sep 17 00:00:00 2001 From: junk Date: Sun, 12 Jan 2025 12:07:25 -0500 Subject: [PATCH] Update splunk_alert.md --- splunk_alert.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/splunk_alert.md b/splunk_alert.md index ab3f70c..125b89c 100644 --- a/splunk_alert.md +++ b/splunk_alert.md @@ -43,5 +43,11 @@ priority="" ## Network Whitelist ``` -table _time indextime event_description host_fqdn user_name process_path process_id process_parent_id process_command_line process_guid src_ip dst_ip dst_port src_host_name dst_host_name mitre_category mitre_technique mitre_technique_id hunting_trigger +table _time indextime event_description host_fqdn user_name process_path process_id process_parent_id process_command_line process_guid src_ip dst_ip dst_port src_host_name dst_host_name +``` + + +## WMI Whitelist +``` +| table _time indextime host_fqdn user_name wmi_consumer_name wmi_consumer_destination ``` \ No newline at end of file