junk/spl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update splunk_alert.md

Browse Source
This commit is contained in:
junk
2025-01-12 12:07:25 -05:00
parent 58da7a6327
commit 2ee3f07f7f
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
splunk_alert.md
View File

@ -43,5 +43,11 @@ priority=""
## Network Whitelist ## Network Whitelist
``` ```
table _time indextime event_description host_fqdn user_name process_path process_id process_parent_id process_command_line process_guid src_ip dst_ip dst_port src_host_name dst_host_name mitre_category mitre_technique mitre_technique_id hunting_trigger table _time indextime event_description host_fqdn user_name process_path process_id process_parent_id process_command_line process_guid src_ip dst_ip dst_port src_host_name dst_host_name
```
## WMI Whitelist
```
| table _time indextime host_fqdn user_name wmi_consumer_name wmi_consumer_destination
``` ```