builtin-category-mapping.yaml

title: Conversion for Windows Native Auditing Events
order: 10
logsources:
    process_creation:
        category: process_creation
        product: windows
        conditions:
            EventID: 4688
        rewrite:
            product: windows
            service: security
    registry_event:
        category: registry_event
        product: windows
        conditions:
            EventID: 4657
            OperationType:
                - 'New registry value created'
                - 'Existing registry value modified'
        rewrite:
            product: windows
            service: security
    registry_event_set:
        category: registry_set
        product: windows
        conditions:
            EventID: 4657
            OperationType:
                - 'Existing registry value modified'
        rewrite:
            product: windows
            service: security
    registry_event_add:
        category: registry_add
        product: windows
        conditions:
            EventID: 4657
            OperationType:
                - 'New registry value created'
        rewrite:
            product: windows
            service: security
    network_connection:
        category: network_connection
        product: windows
        conditions:
            EventID: 5156
        rewrite:
            product: windows
            service: security
    antivirus:
        category: antivirus
        conditions:
            EventID:  # https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus IDs with existing 'Threat Name' or 'Path'
                - 1006
                - 1007
                - 1008
                - 1009
                - 1010
                - 1011
                - 1012
                - 1017
                - 1018
                - 1019
                - 1115
                - 1116
        rewrite:
            product: windows
            service: windefend
    wmi_event:
        category: wmi_event
        product: windows
        conditions:
            EventID: 5861
        rewrite:
            product: windows
            service: wmi
fieldmappings_process:
    Image: NewProcessName
    ProcessId: NewProcessId
    ParentImage: ParentProcessName
    ParentProcessId: ProcessId
    LogonId: SubjectLogonId
    IntegrityLevel: MandatoryLabel
    User: SubjectUserName
fieldmappings_registry:
    Image: ProcessName
    User: SubjectUserName
    Details: NewValue
    EventType: OperationType
    TargetObject: ObjectName
fieldmappings_network:
    Image: Application
    Initiated: Direction
    SourceIp: SourceAddress
    DestinationIp: DestAddress
    DestinationPort: DestPort
    Protocol: Protocol
fieldmappings_antivirus:
    Signature: ThreatName
    Filename: Path
fieldmappings_wmi:
    Destination: UserDataPossibleCause