diff --git a/data_sources/aws_bedrock_claude.yml b/data_sources/aws_bedrock_claude.yml index 1ecc4497cc..bd7fc59c23 100644 --- a/data_sources/aws_bedrock_claude.yml +++ b/data_sources/aws_bedrock_claude.yml @@ -4,10 +4,7 @@ version: 1 creation_date: '2026-05-20' modification_date: '2026-05-20' author: Rod Soto, Splunk -description: Amazon Bedrock model invocation logs for Claude models. Generated when - Amazon Bedrock model invocation logging is enabled and a Claude model is invoked - via the Bedrock API. Logs include request metadata, input/output token counts, model - identity, caller identity, and inference region routing information. +description: Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information. mitre_components: - Application Log Content source: aws_bedrock @@ -17,48 +14,48 @@ separator_value: ModelInvocationLog supported_TA: - name: Splunk Add-on for AWS url: https://splunkbase.splunk.com/app/1876 - version: 8.1.1 + version: 8.1.2 fields: -- _time -- accountId -- host -- identity.arn -- inferenceRegion -- input.cacheReadInputTokenCount -- input.cacheWriteInputTokenCount -- input.inputBodyJson.anthropic_beta -- input.inputBodyJson.anthropic_version -- input.inputBodyJson.max_tokens -- input.inputBodyJson.messages{}.content{}.text -- input.inputBodyJson.messages{}.content{}.type -- input.inputBodyJson.messages{}.role -- input.inputBodyJson.metadata.user_id -- input.inputBodyJson.system{}.text -- input.inputBodyJson.system{}.type -- input.inputBodyJson.temperature -- input.inputBodyJson.tools -- input.inputContentType -- input.inputTokenCount -- modelId -- operation -- output.outputBodyJson{}.message.id -- output.outputBodyJson{}.message.model -- output.outputBodyJson{}.message.role -- output.outputBodyJson{}.message.stop_reason -- output.outputBodyJson{}.message.usage.cache_creation_input_tokens -- output.outputBodyJson{}.message.usage.cache_read_input_tokens -- output.outputBodyJson{}.message.usage.input_tokens -- output.outputBodyJson{}.message.usage.output_tokens -- output.outputBodyJson{}.type -- output.outputContentType -- output.outputTokenCount -- region -- requestId -- schemaType -- schemaVersion -- source -- sourcetype -- timestamp + - _time + - accountId + - host + - identity.arn + - inferenceRegion + - input.cacheReadInputTokenCount + - input.cacheWriteInputTokenCount + - input.inputBodyJson.anthropic_beta + - input.inputBodyJson.anthropic_version + - input.inputBodyJson.max_tokens + - input.inputBodyJson.messages{}.content{}.text + - input.inputBodyJson.messages{}.content{}.type + - input.inputBodyJson.messages{}.role + - input.inputBodyJson.metadata.user_id + - input.inputBodyJson.system{}.text + - input.inputBodyJson.system{}.type + - input.inputBodyJson.temperature + - input.inputBodyJson.tools + - input.inputContentType + - input.inputTokenCount + - modelId + - operation + - output.outputBodyJson{}.message.id + - output.outputBodyJson{}.message.model + - output.outputBodyJson{}.message.role + - output.outputBodyJson{}.message.stop_reason + - output.outputBodyJson{}.message.usage.cache_creation_input_tokens + - output.outputBodyJson{}.message.usage.cache_read_input_tokens + - output.outputBodyJson{}.message.usage.input_tokens + - output.outputBodyJson{}.message.usage.output_tokens + - output.outputBodyJson{}.type + - output.outputContentType + - output.outputTokenCount + - region + - requestId + - schemaType + - schemaVersion + - source + - sourcetype + - timestamp example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}' output_fields: - user diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 4b353862ea..a0a2532611 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 output_fields: - dest - user diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 182d512dca..d4c45e3cb9 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add app role assignment to service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index 5031b5cd33..964ffd4bf8 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -17,7 +17,7 @@ separator_value: Add member to role supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index f0c01197f6..d5efa8b2be 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -17,7 +17,7 @@ separator_value: Add owner to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index c5e2c3a4e5..d15f4e6109 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -17,7 +17,7 @@ separator_value: Add service principal supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 7b4411afbd..eb4f327ebe 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -17,7 +17,7 @@ separator_value: Add unverified domain supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 1461a8eaa6..6bb5aac90c 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -17,7 +17,7 @@ separator_value: Consent to application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 177b30e212..f863f7d359 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -16,7 +16,7 @@ separator_value: Disable Strong Authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index b7fd87116e..26056aaaf7 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -16,7 +16,7 @@ separator_value: Enable account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index 22983a3d9f..a31f829e9c 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -16,7 +16,7 @@ separator_value: Invite external user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml index 65cb093d4f..9e8af8668d 100644 --- a/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml +++ b/data_sources/azure_active_directory_microsoftgraphactivitylogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time example_log: '{"time": "2024-04-30T01:22:46.4948958Z", "resourceId": "/TENANTS/225E05A1-5914-4688-A404-7030E60F3143/PROVIDERS/MICROSOFT.AADIAM", "operationName": "Microsoft Graph Activity", "operationVersion": "beta", "category": "MicrosoftGraphActivityLogs", "resultSignature": "200", "durationMs": "948894", "callerIpAddress": "45.83.145.6", "correlationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "level": "Informational", "location": "East US 2", "properties": {"__UDI_RequiredFields_TenantId": "225e05a1-5914-4688-a404-7030e60f3143", "__UDI_RequiredFields_UniqueId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "__UDI_RequiredFields_EventTime": 638500369660000000, "__UDI_RequiredFields_RegionScope": "NA", "timeGenerated": "2024-04-30T01:22:46.4948958Z", "location": "East US 2", "requestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "operationId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "clientRequestId": "8fb849dd-2abe-4c3e-b202-d71af8d1555b", "apiVersion": "beta", "requestMethod": "GET", "responseStatusCode": 200, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143", "durationMs": 948894, "responseSizeBytes": 91, "signInActivityId": "KRsphQ_4s0-oHv_Br8qSAQ", "roles": "", "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "UserPrincipalObjectID": "7b934539-7366-494e-a8ac-3517694d32db", "scopes": "AuditLog.Read.All Directory.AccessAsUser.All email openid profile", "identityProvider": "", "clientAuthMethod": "0", "wids": "b79fbf4d-3ef9-4689-8143-76b194e85509", "C_Idtyp": "user", "C_Iat": "1714439850", "ipAddress": "45.83.145.6", "userAgent": "azurehound/v2.1.8", "requestUri": "https://graph.microsoft.com/beta/servicePrincipals/ffe3e001-d8cf-43a4-89ab-bfce35fd7786/owners?%24top=999", "userId": "7b934539-7366-494e-a8ac-3517694d32db", "tokenIssuedAt": "2024-04-30T01:17:30.0000000Z"}, "tenantId": "225e05a1-5914-4688-a404-7030e60f3143"}' diff --git a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml index 8c5adbf8ae..16df973510 100644 --- a/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml +++ b/data_sources/azure_active_directory_noninteractiveusersigninlogs.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - action - additional_details diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index da60f90a28..2db4d47a9c 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -16,7 +16,7 @@ separator_value: Reset password (by admin) supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 9a0c666f20..1689413757 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -16,7 +16,7 @@ separator_value: Set domain authentication supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index d6888c0dee..831876c413 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -16,7 +16,7 @@ separator_value: Sign-in activity supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index b0ae6b37c9..cbf230589f 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -16,7 +16,7 @@ separator_value: Update application supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 7a086791e4..b98d46e5e2 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -16,7 +16,7 @@ separator_value: Update authorization policy supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index f0ca04a229..56e530b66f 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -15,7 +15,7 @@ separator_value: Update user supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index ce39762a76..aaba9d6bf0 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -15,7 +15,7 @@ separator_value: User registered security info supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index fb083554f3..fdb84eb9cb 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation account supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 1c61b96dac..8098881c4d 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -15,7 +15,7 @@ separator_value: Create or Update an Azure Automation Runbook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index c1d309bda9..17812205b6 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -16,7 +16,7 @@ separator_value: Create or Update an Azure Automation webhook supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 5b89633bdb..6f196a610a 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 6.1.3 + version: 6.3.0 fields: - column - action diff --git a/data_sources/cisco_ai_defense_alerts.yml b/data_sources/cisco_ai_defense_alerts.yml index aa3e7c95cb..f6d66b2b29 100644 --- a/data_sources/cisco_ai_defense_alerts.yml +++ b/data_sources/cisco_ai_defense_alerts.yml @@ -11,5 +11,5 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: diff --git a/data_sources/cisco_asa_logs.yml b/data_sources/cisco_asa_logs.yml index 04a92090d7..bf1e8a39ca 100644 --- a/data_sources/cisco_asa_logs.yml +++ b/data_sources/cisco_asa_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - Cisco_ASA_action - Cisco_ASA_message_id diff --git a/data_sources/cisco_duo_activity.yml b/data_sources/cisco_duo_activity.yml index 3bea5f94aa..36c79c9f75 100644 --- a/data_sources/cisco_duo_activity.yml +++ b/data_sources/cisco_duo_activity.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - access_device.browser - access_device.browser_version diff --git a/data_sources/cisco_duo_administrator.yml b/data_sources/cisco_duo_administrator.yml index b3fa5fb6d7..27c88ee60e 100644 --- a/data_sources/cisco_duo_administrator.yml +++ b/data_sources/cisco_duo_administrator.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - action - actionlabel diff --git a/data_sources/cisco_ios_logs.yml b/data_sources/cisco_ios_logs.yml index 025771a5a9..bf6b6c5e82 100644 --- a/data_sources/cisco_ios_logs.yml +++ b/data_sources/cisco_ios_logs.yml @@ -11,7 +11,7 @@ separator: supported_TA: - name: Cisco Networks Add-on url: https://splunkbase.splunk.com/app/1467 - version: 2.7.9 + version: 2.8.2 fields: - _time - aci_message_text diff --git a/data_sources/cisco_isovalent_process_connect.yml b/data_sources/cisco_isovalent_process_connect.yml index d0c47aadec..38e7825a81 100644 --- a/data_sources/cisco_isovalent_process_connect.yml +++ b/data_sources/cisco_isovalent_process_connect.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processConnect supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - app diff --git a/data_sources/cisco_isovalent_process_exec.yml b/data_sources/cisco_isovalent_process_exec.yml index 5c86c068fd..eed09ca0be 100644 --- a/data_sources/cisco_isovalent_process_exec.yml +++ b/data_sources/cisco_isovalent_process_exec.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent:processExec supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - cluster_name diff --git a/data_sources/cisco_isovalent_process_kprobe.yml b/data_sources/cisco_isovalent_process_kprobe.yml index 8487727aad..637361a36c 100644 --- a/data_sources/cisco_isovalent_process_kprobe.yml +++ b/data_sources/cisco_isovalent_process_kprobe.yml @@ -10,7 +10,7 @@ sourcetype: cisco:isovalent supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - _time - app diff --git a/data_sources/cisco_secure_access_dns.yml b/data_sources/cisco_secure_access_dns.yml index bdf4c50c56..f7cacd0c61 100644 --- a/data_sources/cisco_secure_access_dns.yml +++ b/data_sources/cisco_secure_access_dns.yml @@ -5,115 +5,115 @@ creation_date: '2026-05-06' modification_date: '2026-05-06' author: Bhavin Patel, Splunk description: | - Captures DNS security events from Cisco Secure Access (including Umbrella-style DNS policy and roaming client telemetry) with client identity, query and response metadata, resolved domain, and URL/content categorization. - This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. + Captures DNS security events from Cisco Secure Access (including Umbrella-style DNS policy and roaming client telemetry) with client identity, query and response metadata, resolved domain, and URL/content categorization. + This data source supports detections that correlate user or host activity with high-risk categories such as proxy and anonymizer infrastructure. source: not_applicable sourcetype: cisco:cloud_security:dns supported_TA: - - name: Cisco Secure Access Add-on for Splunk - url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + - name: Cisco Secure Access Add-on for Splunk + url: https://splunkbase.splunk.com/app/7569 + version: 1.0.52 fields: -- RecordType -- ReplyCode -- Timestamp -- _time -- action -- app -- blocked_category -- category -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- destination_countries -- domain -- eventtype -- granular_identity_type -- host -- identities -- identity_type -- index -- linecount -- message_type -- organization_id -- product -- punct -- query -- query_type -- record_type -- reply_code -- reply_code_id -- rule -- rule_id -- s3_uri -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- src_asset -- src_asset_id -- src_asset_tag -- src_bunit -- src_category -- src_city -- src_country -- src_dns -- src_external_ip -- src_ip -- src_is_expected -- src_lat -- src_long -- src_mac -- src_nt_host -- src_owner -- src_pci_domain -- src_priority -- src_requires_av -- src_should_timesync -- src_should_update -- src_translated_ip -- tag -- tag::action -- tag::app -- tag::eventtype -- tag::user_category -- tag::user_identity_tag -- tag::user_watchlist -- timeendpos -- timestartpos -- user -- user_bunit -- user_category -- user_email -- user_endDate -- user_first -- user_identity -- user_identity_id -- user_identity_tag -- user_last -- user_managedBy -- user_nick -- user_phone -- user_prefix -- user_priority -- user_startDate -- user_suffix -- user_watchlist -- user_work_city -- user_work_country -- user_work_lat -- user_work_long -- vendor -- vendor_product + - RecordType + - ReplyCode + - Timestamp + - _time + - action + - app + - blocked_category + - category + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - destination_countries + - domain + - eventtype + - granular_identity_type + - host + - identities + - identity_type + - index + - linecount + - message_type + - organization_id + - product + - punct + - query + - query_type + - record_type + - reply_code + - reply_code_id + - rule + - rule_id + - s3_uri + - source + - sourcetype + - splunk_server + - splunk_server_group + - src + - src_asset + - src_asset_id + - src_asset_tag + - src_bunit + - src_category + - src_city + - src_country + - src_dns + - src_external_ip + - src_ip + - src_is_expected + - src_lat + - src_long + - src_mac + - src_nt_host + - src_owner + - src_pci_domain + - src_priority + - src_requires_av + - src_should_timesync + - src_should_update + - src_translated_ip + - tag + - tag::action + - tag::app + - tag::eventtype + - tag::user_category + - tag::user_identity_tag + - tag::user_watchlist + - timeendpos + - timestartpos + - user + - user_bunit + - user_category + - user_email + - user_endDate + - user_first + - user_identity + - user_identity_id + - user_identity_tag + - user_last + - user_managedBy + - user_nick + - user_phone + - user_prefix + - user_priority + - user_startDate + - user_suffix + - user_watchlist + - user_work_city + - user_work_country + - user_work_lat + - user_work_long + - vendor + - vendor_product output_fields: - - category - - domain - - src_ip - - user + - category + - domain + - src_ip + - user example_log: '"2026-04-20 22:23:29","EC2AMAZ-J8G2CH1","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","Allowed","1 (A)","NOERROR","www.proxysite.com.","Proxy/Anonymizer,Application,Filter Avoidance","Anyconnect Roaming Client","Anyconnect Roaming Client","","139213","","8209150"' diff --git a/data_sources/cisco_secure_access_firewall.yml b/data_sources/cisco_secure_access_firewall.yml index 5b1c49627c..ca67175f6f 100644 --- a/data_sources/cisco_secure_access_firewall.yml +++ b/data_sources/cisco_secure_access_firewall.yml @@ -10,7 +10,7 @@ sourcetype: cisco:cloud_security:firewall supported_TA: - name: Cisco Secure Access Add-on for Splunk url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + version: 1.0.52 fields: - _time - action diff --git a/data_sources/cisco_secure_access_proxy.yml b/data_sources/cisco_secure_access_proxy.yml index 3b981bad63..eb63224d00 100644 --- a/data_sources/cisco_secure_access_proxy.yml +++ b/data_sources/cisco_secure_access_proxy.yml @@ -5,185 +5,185 @@ creation_date: '2026-05-08' modification_date: '2026-05-08' author: Bhavin Patel, Splunk description: | - Captures HTTP/HTTPS proxy access events from Cisco Secure Access, including requesting source, user identity, URL, HTTP method, response status, and user-agent metadata. - This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. + Captures HTTP/HTTPS proxy access events from Cisco Secure Access, including requesting source, user identity, URL, HTTP method, response status, and user-agent metadata. + This data source supports detection of automated web reconnaissance, suspicious browsing patterns, and policy-evasion behavior based on high-volume client errors and URL enumeration activity. source: cisco_cloud_security_addon sourcetype: cisco:cloud_security:proxy supported_TA: - - name: Cisco Secure Access Add-on for Splunk - url: https://splunkbase.splunk.com/app/7569 - version: 1.0.50 + - name: Cisco Secure Access Add-on for Splunk + url: https://splunkbase.splunk.com/app/7569 + version: 1.0.52 fields: -- _time -- action -- action_isolate -- amp_disposition -- amp_malwarename -- amp_score -- app -- application_ids -- av_detection -- blocked_category -- bytes -- bytes_in -- bytes_out -- category -- certificate_errors -- content_type -- data_center -- datamodel -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_asset -- dest_asset_id -- dest_asset_tag -- dest_bunit -- dest_category -- dest_city -- dest_country -- dest_dns -- dest_ip -- dest_is_expected -- dest_lat -- dest_long -- dest_mac -- dest_nt_host -- dest_owner -- dest_pci_domain -- dest_priority -- dest_requires_av -- dest_should_timesync -- dest_should_update -- destination_list_id -- detected_response_file_type -- disposition -- dlp_status -- egress -- eventtype -- file_action -- file_hash -- filename -- forward_method -- geo_location_of_blocked_destination_countries -- host -- hostname -- http_content_type -- http_method -- http_referrer -- http_user_agent -- http_user_agent_length -- identities -- identity_type -- index -- isolateAction -- linecount -- malwarename_name -- message_correlation_id -- msp_organization_id -- organization_id -- policy_identities -- policy_identity_type -- policy_type -- producer -- product -- pua -- punct -- request_method -- request_size -- response_size -- response_size_body -- rule_id -- rule_set_id -- s3_uri -- score -- security_overridden -- server_name -- sha256 -- source -- sourcetype -- splunk_server -- splunk_server_group -- src -- src_asset -- src_asset_id -- src_asset_tag -- src_bunit -- src_category -- src_city -- src_country -- src_dns -- src_ip -- src_is_expected -- src_lat -- src_long -- src_mac -- src_nt_host -- src_owner -- src_pci_domain -- src_priority -- src_requires_av -- src_should_timesync -- src_should_update -- src_translated_ip -- ssl_error -- ssl_subject_common_name -- status -- status_warning -- tag -- tag::action -- tag::app -- tag::dest_requires_av -- tag::dest_should_timesync -- tag::dest_should_update -- tag::eventtype -- tag::user_category -- tag::user_identity_tag -- tag::user_watchlist -- time_based_rule -- timeendpos -- timestartpos -- url -- url_domain -- url_length -- user -- user_bunit -- user_category -- user_email -- user_endDate -- user_first -- user_identity -- user_identity_id -- user_identity_tag -- user_last -- user_managedBy -- user_nick -- user_phone -- user_prefix -- user_priority -- user_startDate -- user_suffix -- user_type -- user_watchlist -- user_work_city -- user_work_country -- user_work_lat -- user_work_long -- vendor -- vendor_product -- warnStatus -- warn_categories + - _time + - action + - action_isolate + - amp_disposition + - amp_malwarename + - amp_score + - app + - application_ids + - av_detection + - blocked_category + - bytes + - bytes_in + - bytes_out + - category + - certificate_errors + - content_type + - data_center + - datamodel + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_asset + - dest_asset_id + - dest_asset_tag + - dest_bunit + - dest_category + - dest_city + - dest_country + - dest_dns + - dest_ip + - dest_is_expected + - dest_lat + - dest_long + - dest_mac + - dest_nt_host + - dest_owner + - dest_pci_domain + - dest_priority + - dest_requires_av + - dest_should_timesync + - dest_should_update + - destination_list_id + - detected_response_file_type + - disposition + - dlp_status + - egress + - eventtype + - file_action + - file_hash + - filename + - forward_method + - geo_location_of_blocked_destination_countries + - host + - hostname + - http_content_type + - http_method + - http_referrer + - http_user_agent + - http_user_agent_length + - identities + - identity_type + - index + - isolateAction + - linecount + - malwarename_name + - message_correlation_id + - msp_organization_id + - organization_id + - policy_identities + - policy_identity_type + - policy_type + - producer + - product + - pua + - punct + - request_method + - request_size + - response_size + - response_size_body + - rule_id + - rule_set_id + - s3_uri + - score + - security_overridden + - server_name + - sha256 + - source + - sourcetype + - splunk_server + - splunk_server_group + - src + - src_asset + - src_asset_id + - src_asset_tag + - src_bunit + - src_category + - src_city + - src_country + - src_dns + - src_ip + - src_is_expected + - src_lat + - src_long + - src_mac + - src_nt_host + - src_owner + - src_pci_domain + - src_priority + - src_requires_av + - src_should_timesync + - src_should_update + - src_translated_ip + - ssl_error + - ssl_subject_common_name + - status + - status_warning + - tag + - tag::action + - tag::app + - tag::dest_requires_av + - tag::dest_should_timesync + - tag::dest_should_update + - tag::eventtype + - tag::user_category + - tag::user_identity_tag + - tag::user_watchlist + - time_based_rule + - timeendpos + - timestartpos + - url + - url_domain + - url_length + - user + - user_bunit + - user_category + - user_email + - user_endDate + - user_first + - user_identity + - user_identity_id + - user_identity_tag + - user_last + - user_managedBy + - user_nick + - user_phone + - user_prefix + - user_priority + - user_startDate + - user_suffix + - user_type + - user_watchlist + - user_work_city + - user_work_country + - user_work_lat + - user_work_long + - vendor + - vendor_product + - warnStatus + - warn_categories output_fields: - - src_ip - - user - - status - - url - - http_user_agent + - src_ip + - user + - status + - url + - http_user_agent example_log: | - "2026-04-20 21:57:29","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","104.20.23.154","text/html","ALLOWED","http://example.com/css-3444","","gobuster/3.8.1","404","","790","528","fb91d75a6bb430787a61b0aec5e374f580030f2878e1613eab5ca6310f7bbb9a","Research/Reference,Reference","","","","","","Anyconnect Roaming Client","","EC2AMAZ-J8G2CH1","Anyconnect Roaming Client","GET","ALLOWED","","css-3444","14303105","139213","","","","","","","","","","mps-7b95df5757-wmc2v.sigproxy.prod_aws_us-east-2_1_0n","PROD_AWS_US-EAST-2_1_0N","false","","false","false","","","8209150" + "2026-04-20 21:57:29","EC2AMAZ-J8G2CH1","10.0.1.115","3.151.127.146","104.20.23.154","text/html","ALLOWED","http://example.com/css-3444","","gobuster/3.8.1","404","","790","528","fb91d75a6bb430787a61b0aec5e374f580030f2878e1613eab5ca6310f7bbb9a","Research/Reference,Reference","","","","","","Anyconnect Roaming Client","","EC2AMAZ-J8G2CH1","Anyconnect Roaming Client","GET","ALLOWED","","css-3444","14303105","139213","","","","","","","","","","mps-7b95df5757-wmc2v.sigproxy.prod_aws_us-east-2_1_0n","PROD_AWS_US-EAST-2_1_0N","false","","false","false","","","8209150" diff --git a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml index ed96cbbe2d..895f9fe20a 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_connection_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - AC_RuleAction - action diff --git a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml index fdfd338ddb..d623fdb85a 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_file_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_file_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - app - Application diff --git a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml index 309b325466..4d9589c58e 100644 --- a/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml +++ b/data_sources/cisco_secure_firewall_threat_defense_intrusion_event.yml @@ -10,7 +10,7 @@ sourcetype: cisco:sfw:estreamer supported_TA: - name: Cisco Security Cloud url: https://splunkbase.splunk.com/app/7404 - version: 3.6.5 + version: 4.0.0 fields: - Application - Classification diff --git a/data_sources/crowdstrike_falcon_stream_alert.yml b/data_sources/crowdstrike_falcon_stream_alert.yml index 32b048111d..9132278b02 100644 --- a/data_sources/crowdstrike_falcon_stream_alert.yml +++ b/data_sources/crowdstrike_falcon_stream_alert.yml @@ -17,7 +17,7 @@ separator: event.DetectName supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 2.0.5 + version: 3.1.1 fields: - action - description diff --git a/data_sources/crowdstrike_processrollup2.yml b/data_sources/crowdstrike_processrollup2.yml index 05c7e2f476..d2f90cb5cf 100644 --- a/data_sources/crowdstrike_processrollup2.yml +++ b/data_sources/crowdstrike_processrollup2.yml @@ -18,7 +18,7 @@ separator_value: ProcessRollup2 supported_TA: - name: Splunk Add-on for CrowdStrike FDR url: https://splunkbase.splunk.com/app/5579 - version: 2.0.5 + version: 3.1.1 fields: - AuthenticationId - AuthenticationId_meaning diff --git a/data_sources/g_suite_drive.yml b/data_sources/g_suite_drive.yml index a9b1f66987..2fe9a8b87d 100644 --- a/data_sources/g_suite_drive.yml +++ b/data_sources/g_suite_drive.yml @@ -16,7 +16,7 @@ sourcetype: gsuite:drive:json supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - email diff --git a/data_sources/g_suite_gmail.yml b/data_sources/g_suite_gmail.yml index 5e9526e61b..a536a2cca4 100644 --- a/data_sources/g_suite_gmail.yml +++ b/data_sources/g_suite_gmail.yml @@ -15,7 +15,7 @@ sourcetype: gsuite:gmail:bigquery supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - action_type diff --git a/data_sources/github_enterprise_audit_logs.yml b/data_sources/github_enterprise_audit_logs.yml index 893b9b4e98..f980d37742 100644 --- a/data_sources/github_enterprise_audit_logs.yml +++ b/data_sources/github_enterprise_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: httpevent supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.2.0 + version: 3.3.1 fields: - _document_id - action diff --git a/data_sources/github_organizations_audit_logs.yml b/data_sources/github_organizations_audit_logs.yml index e6e106f4a1..cf90f2b8cf 100644 --- a/data_sources/github_organizations_audit_logs.yml +++ b/data_sources/github_organizations_audit_logs.yml @@ -10,7 +10,7 @@ sourcetype: github:cloud:audit supported_TA: - name: Splunk Add-on for Github url: https://splunkbase.splunk.com/app/6254 - version: 3.2.0 + version: 3.3.1 fields: - _document_id - action diff --git a/data_sources/google_workspace.yml b/data_sources/google_workspace.yml index acd5970dd5..e6085340b3 100644 --- a/data_sources/google_workspace.yml +++ b/data_sources/google_workspace.yml @@ -10,7 +10,7 @@ sourcetype: gws:reports:login supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - action - actor.callerType diff --git a/data_sources/google_workspace_login_failure.yml b/data_sources/google_workspace_login_failure.yml index ed05961581..ac3e4a7855 100644 --- a/data_sources/google_workspace_login_failure.yml +++ b/data_sources/google_workspace_login_failure.yml @@ -17,7 +17,7 @@ separator_value: login_failure supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - actor.email diff --git a/data_sources/google_workspace_login_success.yml b/data_sources/google_workspace_login_success.yml index 4b61dd8b5f..353d1d40cf 100644 --- a/data_sources/google_workspace_login_success.yml +++ b/data_sources/google_workspace_login_success.yml @@ -17,7 +17,7 @@ separator_value: login_success supported_TA: - name: Splunk Add-on for Google Workspace url: https://splunkbase.splunk.com/app/5556 - version: 3.1.1 + version: 4.0.0 fields: - _time - actor.email diff --git a/data_sources/linux_auditd_add_user.yml b/data_sources/linux_auditd_add_user.yml index 164e9aefb7..cf1a8a10f0 100644 --- a/data_sources/linux_auditd_add_user.yml +++ b/data_sources/linux_auditd_add_user.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_cwd.yml b/data_sources/linux_auditd_cwd.yml index afbe0ec701..bb4692329a 100644 --- a/data_sources/linux_auditd_cwd.yml +++ b/data_sources/linux_auditd_cwd.yml @@ -13,7 +13,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - cwd - date_hour diff --git a/data_sources/linux_auditd_daemon_abort.yml b/data_sources/linux_auditd_daemon_abort.yml index 9b83e49dc1..f82333876b 100644 --- a/data_sources/linux_auditd_daemon_abort.yml +++ b/data_sources/linux_auditd_daemon_abort.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_end.yml b/data_sources/linux_auditd_daemon_end.yml index f7b4fcf4dd..bdca049e91 100644 --- a/data_sources/linux_auditd_daemon_end.yml +++ b/data_sources/linux_auditd_daemon_end.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_daemon_start.yml b/data_sources/linux_auditd_daemon_start.yml index 9f96075a6e..5b58a4785a 100644 --- a/data_sources/linux_auditd_daemon_start.yml +++ b/data_sources/linux_auditd_daemon_start.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - type - op diff --git a/data_sources/linux_auditd_execve.yml b/data_sources/linux_auditd_execve.yml index 1d5c039877..ed4e76f993 100644 --- a/data_sources/linux_auditd_execve.yml +++ b/data_sources/linux_auditd_execve.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_path.yml b/data_sources/linux_auditd_path.yml index 6f0953cec0..64f681c8dc 100644 --- a/data_sources/linux_auditd_path.yml +++ b/data_sources/linux_auditd_path.yml @@ -19,7 +19,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_proctitle.yml b/data_sources/linux_auditd_proctitle.yml index 44e2a8935b..842bd99048 100644 --- a/data_sources/linux_auditd_proctitle.yml +++ b/data_sources/linux_auditd_proctitle.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - proctitle - msg diff --git a/data_sources/linux_auditd_service_stop.yml b/data_sources/linux_auditd_service_stop.yml index 1db5103e14..02f1314857 100644 --- a/data_sources/linux_auditd_service_stop.yml +++ b/data_sources/linux_auditd_service_stop.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_auditd_syscall.yml b/data_sources/linux_auditd_syscall.yml index b5d9647033..c385210b04 100644 --- a/data_sources/linux_auditd_syscall.yml +++ b/data_sources/linux_auditd_syscall.yml @@ -18,7 +18,7 @@ configuration: https://github.com/Neo23x0/auditd/blob/master/audit.rules supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - msg - type diff --git a/data_sources/linux_messages_syslog.yml b/data_sources/linux_messages_syslog.yml index 090a768534..c84136000d 100644 --- a/data_sources/linux_messages_syslog.yml +++ b/data_sources/linux_messages_syslog.yml @@ -4,53 +4,52 @@ version: 1 creation_date: '2025-05-06' modification_date: '2025-05-06' author: Ravent Tait, Splunk -description: Logs kernel events on a Linux system, including - service starts/stops, hardware events, authentication notices, and other OS-level activity. +description: Logs kernel events on a Linux system, including service starts/stops, hardware events, authentication notices, and other OS-level activity. mitre_components: -- Service Modification -- Service Metadata -- OS API Execution -- Application Log Content + - Service Modification + - Service Metadata + - OS API Execution + - Application Log Content source: /var/log/kern sourcetype: linux_messages_syslog supported_TA: -- name: Splunk Add-on for Unix and Linux - url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + - name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 10.3.1 fields: -- _time -- action -- app -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dvc -- eventtype -- host -- index -- linecount -- pid -- process -- punct -- source -- sourcetype -- splunk_server -- src -- src_port -- sshd_protocol -- tag -- tag::action -- tag::eventtype -- timeendpos -- timestartpos -- user -- user_name -- vendor_action -- vendor_product + - _time + - action + - app + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dvc + - eventtype + - host + - index + - linecount + - pid + - process + - punct + - source + - sourcetype + - splunk_server + - src + - src_port + - sshd_protocol + - tag + - tag::action + - tag::eventtype + - timeendpos + - timestartpos + - user + - user_name + - vendor_action + - vendor_product example_log: 'May 6 17:24:00 ubuntu kernel: [ 801.664268] NET: Registered PF_ALG protocol family' diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index b8dd8ae5ba..56434973a9 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -16,7 +16,7 @@ sourcetype: linux_secure supported_TA: - name: Splunk Add-on for Unix and Linux url: https://splunkbase.splunk.com/app/833 - version: 10.2.0 + version: 10.3.1 fields: - _time - action diff --git a/data_sources/ntlm_operational_8004.yml b/data_sources/ntlm_operational_8004.yml index 141ebdf0de..7b095e9329 100644 --- a/data_sources/ntlm_operational_8004.yml +++ b/data_sources/ntlm_operational_8004.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8005.yml b/data_sources/ntlm_operational_8005.yml index da24c4688c..b6673df534 100644 --- a/data_sources/ntlm_operational_8005.yml +++ b/data_sources/ntlm_operational_8005.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/ntlm_operational_8006.yml b/data_sources/ntlm_operational_8006.yml index e4ec349eb5..12a1f1dc03 100644 --- a/data_sources/ntlm_operational_8006.yml +++ b/data_sources/ntlm_operational_8006.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/okta.yml b/data_sources/okta.yml index 01fc34cfdf..13546f1ac4 100644 --- a/data_sources/okta.yml +++ b/data_sources/okta.yml @@ -16,7 +16,7 @@ sourcetype: OktaIM2:log supported_TA: - name: Splunk Add-on for Okta Identity Cloud url: https://splunkbase.splunk.com/app/6553 - version: 5.0.2 + version: 5.0.3 output_fields: - dest - src diff --git a/data_sources/palo_alto_network_threat.yml b/data_sources/palo_alto_network_threat.yml index b83bd67d0b..7ed3330faa 100644 --- a/data_sources/palo_alto_network_threat.yml +++ b/data_sources/palo_alto_network_threat.yml @@ -16,7 +16,7 @@ sourcetype: pan:threat supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.1 fields: - _time - date_hour diff --git a/data_sources/palo_alto_network_traffic.yml b/data_sources/palo_alto_network_traffic.yml index 00e9798ece..0f6d642ea8 100644 --- a/data_sources/palo_alto_network_traffic.yml +++ b/data_sources/palo_alto_network_traffic.yml @@ -16,7 +16,7 @@ sourcetype: pan:traffic supported_TA: - name: Palo Alto Networks Add-on url: https://splunkbase.splunk.com/app/7523 - version: 3.1.0 + version: 3.2.1 fields: - _time - date_hour diff --git a/data_sources/powershell_script_block_logging_4104.yml b/data_sources/powershell_script_block_logging_4104.yml index 6a20ab8128..394ee4689e 100644 --- a/data_sources/powershell_script_block_logging_4104.yml +++ b/data_sources/powershell_script_block_logging_4104.yml @@ -18,7 +18,7 @@ separator_value: '4104' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/sysmon_eventid_1.yml b/data_sources/sysmon_eventid_1.yml index f0a8effbdf..0c6c58dfb1 100644 --- a/data_sources/sysmon_eventid_1.yml +++ b/data_sources/sysmon_eventid_1.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_10.yml b/data_sources/sysmon_eventid_10.yml index d54f84444d..d1ba331c5b 100644 --- a/data_sources/sysmon_eventid_10.yml +++ b/data_sources/sysmon_eventid_10.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - CallTrace diff --git a/data_sources/sysmon_eventid_11.yml b/data_sources/sysmon_eventid_11.yml index 47c82f9ac8..847bf94914 100644 --- a/data_sources/sysmon_eventid_11.yml +++ b/data_sources/sysmon_eventid_11.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_12.yml b/data_sources/sysmon_eventid_12.yml index bfc98a539c..b52aefa9f7 100644 --- a/data_sources/sysmon_eventid_12.yml +++ b/data_sources/sysmon_eventid_12.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_13.yml b/data_sources/sysmon_eventid_13.yml index 9e4f2384db..9dd9afc34d 100644 --- a/data_sources/sysmon_eventid_13.yml +++ b/data_sources/sysmon_eventid_13.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_14.yml b/data_sources/sysmon_eventid_14.yml index 4a0eea5ee2..877834a5fd 100644 --- a/data_sources/sysmon_eventid_14.yml +++ b/data_sources/sysmon_eventid_14.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time example_log: '' diff --git a/data_sources/sysmon_eventid_15.yml b/data_sources/sysmon_eventid_15.yml index bcae8778e0..45aa929ea7 100644 --- a/data_sources/sysmon_eventid_15.yml +++ b/data_sources/sysmon_eventid_15.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_17.yml b/data_sources/sysmon_eventid_17.yml index b149c566ed..53031fbf53 100644 --- a/data_sources/sysmon_eventid_17.yml +++ b/data_sources/sysmon_eventid_17.yml @@ -15,7 +15,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_18.yml b/data_sources/sysmon_eventid_18.yml index 09741457b3..01dec72da3 100644 --- a/data_sources/sysmon_eventid_18.yml +++ b/data_sources/sysmon_eventid_18.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_20.yml b/data_sources/sysmon_eventid_20.yml index a92ac49516..2e0e8db5f8 100644 --- a/data_sources/sysmon_eventid_20.yml +++ b/data_sources/sysmon_eventid_20.yml @@ -17,7 +17,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_21.yml b/data_sources/sysmon_eventid_21.yml index c1add4adfd..a17d1dea05 100644 --- a/data_sources/sysmon_eventid_21.yml +++ b/data_sources/sysmon_eventid_21.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_22.yml b/data_sources/sysmon_eventid_22.yml index e267c09d70..fdaa49c146 100644 --- a/data_sources/sysmon_eventid_22.yml +++ b/data_sources/sysmon_eventid_22.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_23.yml b/data_sources/sysmon_eventid_23.yml index d9436f249c..6d934d8138 100644 --- a/data_sources/sysmon_eventid_23.yml +++ b/data_sources/sysmon_eventid_23.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Archived diff --git a/data_sources/sysmon_eventid_26.yml b/data_sources/sysmon_eventid_26.yml index ee3d6376a2..07fabf9724 100644 --- a/data_sources/sysmon_eventid_26.yml +++ b/data_sources/sysmon_eventid_26.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time output_fields: diff --git a/data_sources/sysmon_eventid_29.yml b/data_sources/sysmon_eventid_29.yml index 75955a4689..4ab79dacf8 100644 --- a/data_sources/sysmon_eventid_29.yml +++ b/data_sources/sysmon_eventid_29.yml @@ -12,7 +12,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - action diff --git a/data_sources/sysmon_eventid_3.yml b/data_sources/sysmon_eventid_3.yml index 71d8619875..2b0e1cfab0 100644 --- a/data_sources/sysmon_eventid_3.yml +++ b/data_sources/sysmon_eventid_3.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_5.yml b/data_sources/sysmon_eventid_5.yml index d62d02fe1b..e4c67f2509 100644 --- a/data_sources/sysmon_eventid_5.yml +++ b/data_sources/sysmon_eventid_5.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_6.yml b/data_sources/sysmon_eventid_6.yml index 2aa7542d3a..bb5efed138 100644 --- a/data_sources/sysmon_eventid_6.yml +++ b/data_sources/sysmon_eventid_6.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_7.yml b/data_sources/sysmon_eventid_7.yml index 00a6d580c0..b4ec9a8fd3 100644 --- a/data_sources/sysmon_eventid_7.yml +++ b/data_sources/sysmon_eventid_7.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_8.yml b/data_sources/sysmon_eventid_8.yml index ef49b5b310..53a5c3c09b 100644 --- a/data_sources/sysmon_eventid_8.yml +++ b/data_sources/sysmon_eventid_8.yml @@ -18,7 +18,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/sysmon_eventid_9.yml b/data_sources/sysmon_eventid_9.yml index 6f6ee986d5..134244241d 100644 --- a/data_sources/sysmon_eventid_9.yml +++ b/data_sources/sysmon_eventid_9.yml @@ -19,7 +19,7 @@ configuration: https://github.com/SwiftOnSecurity/sysmon-config supported_TA: - name: Splunk Add-on for Sysmon url: https://splunkbase.splunk.com/app/5709 - version: 5.0.0 + version: 5.0.1 fields: - _time - Channel diff --git a/data_sources/windows_active_directory_admon.yml b/data_sources/windows_active_directory_admon.yml index 7e1ec4fde7..10f397dfe8 100644 --- a/data_sources/windows_active_directory_admon.yml +++ b/data_sources/windows_active_directory_admon.yml @@ -16,7 +16,7 @@ sourcetype: ActiveDirectory supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Guid diff --git a/data_sources/windows_event_log_application_15457.yml b/data_sources/windows_event_log_application_15457.yml index 4ef6ecee00..1134642e1e 100644 --- a/data_sources/windows_event_log_application_15457.yml +++ b/data_sources/windows_event_log_application_15457.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_17135.yml b/data_sources/windows_event_log_application_17135.yml index fb960b1d42..c819d61225 100644 --- a/data_sources/windows_event_log_application_17135.yml +++ b/data_sources/windows_event_log_application_17135.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_application_2282.yml b/data_sources/windows_event_log_application_2282.yml index 9107707eaf..0dc7ec7343 100644 --- a/data_sources/windows_event_log_application_2282.yml +++ b/data_sources/windows_event_log_application_2282.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_3000.yml b/data_sources/windows_event_log_application_3000.yml index a98f34690b..25989597c4 100644 --- a/data_sources/windows_event_log_application_3000.yml +++ b/data_sources/windows_event_log_application_3000.yml @@ -17,7 +17,7 @@ separator_value: '3000' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_application_8128.yml b/data_sources/windows_event_log_application_8128.yml index b45b9b50fa..8b97db5796 100644 --- a/data_sources/windows_event_log_application_8128.yml +++ b/data_sources/windows_event_log_application_8128.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_400.yml b/data_sources/windows_event_log_appxdeployment_server_400.yml index 869197ab81..954960673c 100644 --- a/data_sources/windows_event_log_appxdeployment_server_400.yml +++ b/data_sources/windows_event_log_appxdeployment_server_400.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_854.yml b/data_sources/windows_event_log_appxdeployment_server_854.yml index 792a15ebbc..e1fed6202a 100644 --- a/data_sources/windows_event_log_appxdeployment_server_854.yml +++ b/data_sources/windows_event_log_appxdeployment_server_854.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxdeployment_server_855.yml b/data_sources/windows_event_log_appxdeployment_server_855.yml index 22e3b71725..fd04a03871 100644 --- a/data_sources/windows_event_log_appxdeployment_server_855.yml +++ b/data_sources/windows_event_log_appxdeployment_server_855.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_appxpackaging_171.yml b/data_sources/windows_event_log_appxpackaging_171.yml index 00920b4b37..e015fea468 100644 --- a/data_sources/windows_event_log_appxpackaging_171.yml +++ b/data_sources/windows_event_log_appxpackaging_171.yml @@ -19,7 +19,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_capi2_70.yml b/data_sources/windows_event_log_capi2_70.yml index 2701795166..cea7a04b89 100644 --- a/data_sources/windows_event_log_capi2_70.yml +++ b/data_sources/windows_event_log_capi2_70.yml @@ -18,7 +18,7 @@ separator_value: '70' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_capi2_81.yml b/data_sources/windows_event_log_capi2_81.yml index f4e7771023..d190dd24f6 100644 --- a/data_sources/windows_event_log_capi2_81.yml +++ b/data_sources/windows_event_log_capi2_81.yml @@ -18,7 +18,7 @@ separator_value: '81' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_certificateservicesclient_1007.yml b/data_sources/windows_event_log_certificateservicesclient_1007.yml index 14d92e22a7..44dbde3791 100644 --- a/data_sources/windows_event_log_certificateservicesclient_1007.yml +++ b/data_sources/windows_event_log_certificateservicesclient_1007.yml @@ -18,7 +18,7 @@ separator_value: '1007' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1121.yml b/data_sources/windows_event_log_defender_1121.yml index 011347afb2..cf58df9f88 100644 --- a/data_sources/windows_event_log_defender_1121.yml +++ b/data_sources/windows_event_log_defender_1121.yml @@ -16,7 +16,7 @@ separator_value: '1121' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1122.yml b/data_sources/windows_event_log_defender_1122.yml index 9c97a01efe..24794c9317 100644 --- a/data_sources/windows_event_log_defender_1122.yml +++ b/data_sources/windows_event_log_defender_1122.yml @@ -16,7 +16,7 @@ separator_value: '1122' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1125.yml b/data_sources/windows_event_log_defender_1125.yml index 77928d8273..e24a33ffc0 100644 --- a/data_sources/windows_event_log_defender_1125.yml +++ b/data_sources/windows_event_log_defender_1125.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time example_log: 112204000x80000000000000003701Microsoft-Windows-Windows Defender/OperationalresearchvmhaaMicrosoft Defender Antivirus4.18.23100.2009E6DB77E5-3DF2-4CF1-B95A-636979351E5B2023-11-26T23:43:08.709Z(unknown user)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1.401.1247.01.1.23100.2009ENT\ConsRC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe0x00000000 diff --git a/data_sources/windows_event_log_defender_1126.yml b/data_sources/windows_event_log_defender_1126.yml index b0b5c2cef0..50358cbb4a 100644 --- a/data_sources/windows_event_log_defender_1126.yml +++ b/data_sources/windows_event_log_defender_1126.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_defender_1129.yml b/data_sources/windows_event_log_defender_1129.yml index 8d9767ba9c..4d880bdfc9 100644 --- a/data_sources/windows_event_log_defender_1129.yml +++ b/data_sources/windows_event_log_defender_1129.yml @@ -16,7 +16,7 @@ separator_value: '1129' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_defender_1131.yml b/data_sources/windows_event_log_defender_1131.yml index 7b59c9cd6b..7ce4f4f10b 100644 --- a/data_sources/windows_event_log_defender_1131.yml +++ b/data_sources/windows_event_log_defender_1131.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1132.yml b/data_sources/windows_event_log_defender_1132.yml index 1a813f46f9..d9c500e81b 100644 --- a/data_sources/windows_event_log_defender_1132.yml +++ b/data_sources/windows_event_log_defender_1132.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1133.yml b/data_sources/windows_event_log_defender_1133.yml index 88cb4531d3..052c42d354 100644 --- a/data_sources/windows_event_log_defender_1133.yml +++ b/data_sources/windows_event_log_defender_1133.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_1134.yml b/data_sources/windows_event_log_defender_1134.yml index 3b54c95906..7ca20f0675 100644 --- a/data_sources/windows_event_log_defender_1134.yml +++ b/data_sources/windows_event_log_defender_1134.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - ActivityID - CategoryString diff --git a/data_sources/windows_event_log_defender_5007.yml b/data_sources/windows_event_log_defender_5007.yml index 882e7a7bd0..0d27f6ebcd 100644 --- a/data_sources/windows_event_log_defender_5007.yml +++ b/data_sources/windows_event_log_defender_5007.yml @@ -14,7 +14,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_printservice_316.yml b/data_sources/windows_event_log_printservice_316.yml index 257bd4a5d4..6d6662b271 100644 --- a/data_sources/windows_event_log_printservice_316.yml +++ b/data_sources/windows_event_log_printservice_316.yml @@ -15,7 +15,7 @@ separator_value: '316' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_printservice_4909.yml b/data_sources/windows_event_log_printservice_4909.yml index 529620eb60..492b6118b0 100644 --- a/data_sources/windows_event_log_printservice_4909.yml +++ b/data_sources/windows_event_log_printservice_4909.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time example_log: '' diff --git a/data_sources/windows_event_log_printservice_808.yml b/data_sources/windows_event_log_printservice_808.yml index d952de1f7e..eaa8668f29 100644 --- a/data_sources/windows_event_log_printservice_808.yml +++ b/data_sources/windows_event_log_printservice_808.yml @@ -16,7 +16,7 @@ separator_value: '808' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName diff --git a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml index 6bd7d957fc..dbff470f19 100644 --- a/data_sources/windows_event_log_remoteconnectionmanager_1149.yml +++ b/data_sources/windows_event_log_remoteconnectionmanager_1149.yml @@ -16,7 +16,7 @@ separator_value: '1149' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_1100.yml b/data_sources/windows_event_log_security_1100.yml index 3dbf23664f..95c41e545d 100644 --- a/data_sources/windows_event_log_security_1100.yml +++ b/data_sources/windows_event_log_security_1100.yml @@ -15,7 +15,7 @@ separator_value: '1100' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_1102.yml b/data_sources/windows_event_log_security_1102.yml index 8586c6984d..90fec45a0a 100644 --- a/data_sources/windows_event_log_security_1102.yml +++ b/data_sources/windows_event_log_security_1102.yml @@ -16,7 +16,7 @@ separator_value: '1102' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4624.yml b/data_sources/windows_event_log_security_4624.yml index 3971f62bfc..a19e174445 100644 --- a/data_sources/windows_event_log_security_4624.yml +++ b/data_sources/windows_event_log_security_4624.yml @@ -16,7 +16,7 @@ separator_value: '4624' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4625.yml b/data_sources/windows_event_log_security_4625.yml index 28e5d9fead..094b017f2f 100644 --- a/data_sources/windows_event_log_security_4625.yml +++ b/data_sources/windows_event_log_security_4625.yml @@ -15,7 +15,7 @@ separator_value: '4625' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4627.yml b/data_sources/windows_event_log_security_4627.yml index e8c1fb0efb..92817c9c7d 100644 --- a/data_sources/windows_event_log_security_4627.yml +++ b/data_sources/windows_event_log_security_4627.yml @@ -16,7 +16,7 @@ separator_value: '4627' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4648.yml b/data_sources/windows_event_log_security_4648.yml index 6b8fa7d829..aef95a0736 100644 --- a/data_sources/windows_event_log_security_4648.yml +++ b/data_sources/windows_event_log_security_4648.yml @@ -15,7 +15,7 @@ separator_value: '4648' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4662.yml b/data_sources/windows_event_log_security_4662.yml index c0dc0121e4..2aee0b516c 100644 --- a/data_sources/windows_event_log_security_4662.yml +++ b/data_sources/windows_event_log_security_4662.yml @@ -15,7 +15,7 @@ separator_value: '4662' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4663.yml b/data_sources/windows_event_log_security_4663.yml index f74d26c94a..a4b77b42f4 100644 --- a/data_sources/windows_event_log_security_4663.yml +++ b/data_sources/windows_event_log_security_4663.yml @@ -15,7 +15,7 @@ separator_value: '4663' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_4672.yml b/data_sources/windows_event_log_security_4672.yml index 280d7f8262..d75420c82a 100644 --- a/data_sources/windows_event_log_security_4672.yml +++ b/data_sources/windows_event_log_security_4672.yml @@ -15,7 +15,7 @@ separator_value: '4672' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4688.yml b/data_sources/windows_event_log_security_4688.yml index 642687b596..d968667265 100644 --- a/data_sources/windows_event_log_security_4688.yml +++ b/data_sources/windows_event_log_security_4688.yml @@ -16,7 +16,7 @@ configuration: Enabling Windows event log process command line logging via group supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - Caller_Domain - Caller_User_Name diff --git a/data_sources/windows_event_log_security_4698.yml b/data_sources/windows_event_log_security_4698.yml index 3b4b6a9c06..a36980f988 100644 --- a/data_sources/windows_event_log_security_4698.yml +++ b/data_sources/windows_event_log_security_4698.yml @@ -15,7 +15,7 @@ separator_value: '4698' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4699.yml b/data_sources/windows_event_log_security_4699.yml index a80ed23a9b..590d5e1f8c 100644 --- a/data_sources/windows_event_log_security_4699.yml +++ b/data_sources/windows_event_log_security_4699.yml @@ -15,7 +15,7 @@ separator_value: '4699' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4700.yml b/data_sources/windows_event_log_security_4700.yml index 4dc60cd9bd..fdb23972cb 100644 --- a/data_sources/windows_event_log_security_4700.yml +++ b/data_sources/windows_event_log_security_4700.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - EventID example_log: 4700 0 0 12804 0 0x8020000000000000 344861 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin LeastPrivilege CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4702.yml b/data_sources/windows_event_log_security_4702.yml index 7184ff77e3..9824e45fd8 100644 --- a/data_sources/windows_event_log_security_4702.yml +++ b/data_sources/windows_event_log_security_4702.yml @@ -11,7 +11,7 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - EventID example_log: 4702 0 0 12804 0 0x8020000000000000 344863 Security DC01.contoso.local S-1-5-21-3457937927-2839227994-823803824-1104 dadmin CONTOSO 0x364eb \\Microsoft\\StartListener 2015-09-22T19:03:06.9258653 CONTOSO\\dadmin HighestAvailable CONTOSO\\dadmin InteractiveToken IgnoreNew true true true false false true false true true false false false P3D 7 C:\\Documents\\listener.exe diff --git a/data_sources/windows_event_log_security_4703.yml b/data_sources/windows_event_log_security_4703.yml index 5c1d729155..8efa4d630a 100644 --- a/data_sources/windows_event_log_security_4703.yml +++ b/data_sources/windows_event_log_security_4703.yml @@ -15,7 +15,7 @@ separator_value: '4703' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4719.yml b/data_sources/windows_event_log_security_4719.yml index 06b3adb988..19c9db852d 100644 --- a/data_sources/windows_event_log_security_4719.yml +++ b/data_sources/windows_event_log_security_4719.yml @@ -15,7 +15,7 @@ separator_value: '4719' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4720.yml b/data_sources/windows_event_log_security_4720.yml index 31484a3587..049f915001 100644 --- a/data_sources/windows_event_log_security_4720.yml +++ b/data_sources/windows_event_log_security_4720.yml @@ -14,7 +14,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4723.yml b/data_sources/windows_event_log_security_4723.yml index 5105961915..4778011edf 100644 --- a/data_sources/windows_event_log_security_4723.yml +++ b/data_sources/windows_event_log_security_4723.yml @@ -6,7 +6,7 @@ modification_date: '2026-06-15' author: Raven Tait, Splunk description: Logs an event when an attempt is made to change an account's password, whether successful or not. mitre_components: -- User Account Modification + - User Account Modification source: XmlWinEventLog:Security sourcetype: XmlWinEventLog separator: EventCode @@ -14,103 +14,92 @@ separator_value: '4723' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: -- _time -- Caller_Domain -- Caller_User_Name -- CategoryString -- Channel -- Computer -- Error_Code -- EventCode -- EventData_Xml -- EventID -- EventRecordID -- Guid -- Keywords -- Level -- Logon_ID -- Name -- Opcode -- ProcessID -- RecordNumber -- SubjectDomainName -- SubjectLogonId -- SubjectUserName -- SubjectUserSid -- SystemTime -- System_Props_Xml -- TargetDomainName -- TargetSid -- TargetUserName -- Target_Domain -- Target_User_Name -- Task -- ThreadID -- Version -- action -- app -- change_type -- date_hour -- date_mday -- date_minute -- date_month -- date_second -- date_wday -- date_year -- date_zone -- dest -- dest_nt_domain -- dvc -- dvc_nt_host -- event_id -- eventtype -- host -- id -- index -- linecount -- name -- object -- object_attrs -- object_category -- object_id -- product -- punct -- result -- session_id -- signature -- signature_id -- source -- sourcetype -- splunk_server -- src_nt_domain -- src_user -- src_user_name -- status -- subject -- ta_windows_action -- ta_windows_security_CategoryString -- tag -- tag::eventtype -- timeendpos -- timestartpos -- user -- user_group -- user_name -- vendor -- vendor_product + - _time + - Caller_Domain + - Caller_User_Name + - CategoryString + - Channel + - Computer + - Error_Code + - EventCode + - EventData_Xml + - EventID + - EventRecordID + - Guid + - Keywords + - Level + - Logon_ID + - Name + - Opcode + - ProcessID + - RecordNumber + - SubjectDomainName + - SubjectLogonId + - SubjectUserName + - SubjectUserSid + - SystemTime + - System_Props_Xml + - TargetDomainName + - TargetSid + - TargetUserName + - Target_Domain + - Target_User_Name + - Task + - ThreadID + - Version + - action + - app + - change_type + - date_hour + - date_mday + - date_minute + - date_month + - date_second + - date_wday + - date_year + - date_zone + - dest + - dest_nt_domain + - dvc + - dvc_nt_host + - event_id + - eventtype + - host + - id + - index + - linecount + - name + - object + - object_attrs + - object_category + - object_id + - product + - punct + - result + - session_id + - signature + - signature_id + - source + - sourcetype + - splunk_server + - src_nt_domain + - src_user + - src_user_name + - status + - subject + - ta_windows_action + - ta_windows_security_CategoryString + - tag + - tag::eventtype + - timeendpos + - timestartpos + - user + - user_group + - user_name + - vendor + - vendor_product output_fields: -- dest -example_log: - 472300138240 - 0x8010000000000000 - 781490 - Security - WIN10-21H1.strt.labs - AdministratorWIN10-21H1 - S-1-5-21-1538153195-943065003-848949206-500 - S-1-5-21-1538153195-943065003-848949206-1003bob - WIN10-21H10x61a292 - - + - dest +example_log: 472300138240 0x8010000000000000 781490 Security WIN10-21H1.strt.labs AdministratorWIN10-21H1 S-1-5-21-1538153195-943065003-848949206-500 S-1-5-21-1538153195-943065003-848949206-1003bob WIN10-21H10x61a292 - diff --git a/data_sources/windows_event_log_security_4724.yml b/data_sources/windows_event_log_security_4724.yml index 0b06b7823a..2e1ab15fd5 100644 --- a/data_sources/windows_event_log_security_4724.yml +++ b/data_sources/windows_event_log_security_4724.yml @@ -14,7 +14,7 @@ separator_value: '4724' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4725.yml b/data_sources/windows_event_log_security_4725.yml index ca05c7b840..4b4a6cb80c 100644 --- a/data_sources/windows_event_log_security_4725.yml +++ b/data_sources/windows_event_log_security_4725.yml @@ -14,7 +14,7 @@ separator_value: '4725' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4726.yml b/data_sources/windows_event_log_security_4726.yml index 6ddc2aba57..bffa3f61d6 100644 --- a/data_sources/windows_event_log_security_4726.yml +++ b/data_sources/windows_event_log_security_4726.yml @@ -14,7 +14,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4727.yml b/data_sources/windows_event_log_security_4727.yml index 0aa2c2f0b7..087aff4eea 100644 --- a/data_sources/windows_event_log_security_4727.yml +++ b/data_sources/windows_event_log_security_4727.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4728.yml b/data_sources/windows_event_log_security_4728.yml index bcba79a79d..0e6346d3b2 100644 --- a/data_sources/windows_event_log_security_4728.yml +++ b/data_sources/windows_event_log_security_4728.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4730.yml b/data_sources/windows_event_log_security_4730.yml index 9487a6ac52..06c4b66e66 100644 --- a/data_sources/windows_event_log_security_4730.yml +++ b/data_sources/windows_event_log_security_4730.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4731.yml b/data_sources/windows_event_log_security_4731.yml index 30f8bc23e8..87ad0bceae 100644 --- a/data_sources/windows_event_log_security_4731.yml +++ b/data_sources/windows_event_log_security_4731.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4732.yml b/data_sources/windows_event_log_security_4732.yml index d95f852eb8..5c7de0fd65 100644 --- a/data_sources/windows_event_log_security_4732.yml +++ b/data_sources/windows_event_log_security_4732.yml @@ -14,7 +14,7 @@ separator_value: '4732' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_security_4737.yml b/data_sources/windows_event_log_security_4737.yml index f128bbfcc4..4c27227db2 100644 --- a/data_sources/windows_event_log_security_4737.yml +++ b/data_sources/windows_event_log_security_4737.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - CategoryString - Channel diff --git a/data_sources/windows_event_log_security_4738.yml b/data_sources/windows_event_log_security_4738.yml index fb6f1f3ca8..9db856f358 100644 --- a/data_sources/windows_event_log_security_4738.yml +++ b/data_sources/windows_event_log_security_4738.yml @@ -14,7 +14,7 @@ separator_value: '4738' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4739.yml b/data_sources/windows_event_log_security_4739.yml index b0f6314703..d055166b55 100644 --- a/data_sources/windows_event_log_security_4739.yml +++ b/data_sources/windows_event_log_security_4739.yml @@ -15,7 +15,7 @@ separator_value: '4739' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Caller_Domain diff --git a/data_sources/windows_event_log_security_4741.yml b/data_sources/windows_event_log_security_4741.yml index 7b643fb3d0..eb0238ac90 100644 --- a/data_sources/windows_event_log_security_4741.yml +++ b/data_sources/windows_event_log_security_4741.yml @@ -17,7 +17,7 @@ separator_value: '4741' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4742.yml b/data_sources/windows_event_log_security_4742.yml index eb26156fe9..513872af7e 100644 --- a/data_sources/windows_event_log_security_4742.yml +++ b/data_sources/windows_event_log_security_4742.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountExpires diff --git a/data_sources/windows_event_log_security_4744.yml b/data_sources/windows_event_log_security_4744.yml index 216eb54d2c..eca1bb9609 100644 --- a/data_sources/windows_event_log_security_4744.yml +++ b/data_sources/windows_event_log_security_4744.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4749.yml b/data_sources/windows_event_log_security_4749.yml index 8b61381ede..37cd80c800 100644 --- a/data_sources/windows_event_log_security_4749.yml +++ b/data_sources/windows_event_log_security_4749.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4754.yml b/data_sources/windows_event_log_security_4754.yml index 4dbe460a36..48f80c0979 100644 --- a/data_sources/windows_event_log_security_4754.yml +++ b/data_sources/windows_event_log_security_4754.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4756.yml b/data_sources/windows_event_log_security_4756.yml index c53348491f..8f7b0b077e 100644 --- a/data_sources/windows_event_log_security_4756.yml +++ b/data_sources/windows_event_log_security_4756.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4759.yml b/data_sources/windows_event_log_security_4759.yml index 9db0814db3..d8110c1a28 100644 --- a/data_sources/windows_event_log_security_4759.yml +++ b/data_sources/windows_event_log_security_4759.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4768.yml b/data_sources/windows_event_log_security_4768.yml index 0d954d3b5c..d11908d257 100644 --- a/data_sources/windows_event_log_security_4768.yml +++ b/data_sources/windows_event_log_security_4768.yml @@ -17,7 +17,7 @@ separator_value: '4768' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4769.yml b/data_sources/windows_event_log_security_4769.yml index 2b1506eda9..61f7a15c8e 100644 --- a/data_sources/windows_event_log_security_4769.yml +++ b/data_sources/windows_event_log_security_4769.yml @@ -17,7 +17,7 @@ separator_value: '4769' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4771.yml b/data_sources/windows_event_log_security_4771.yml index 16751ea4ef..41d424b7e8 100644 --- a/data_sources/windows_event_log_security_4771.yml +++ b/data_sources/windows_event_log_security_4771.yml @@ -17,7 +17,7 @@ separator_value: '4771' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4776.yml b/data_sources/windows_event_log_security_4776.yml index 408aaa466b..fd970cd422 100644 --- a/data_sources/windows_event_log_security_4776.yml +++ b/data_sources/windows_event_log_security_4776.yml @@ -17,7 +17,7 @@ separator_value: '4776' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_security_4781.yml b/data_sources/windows_event_log_security_4781.yml index ed8f3691a8..7e55eadbc3 100644 --- a/data_sources/windows_event_log_security_4781.yml +++ b/data_sources/windows_event_log_security_4781.yml @@ -17,7 +17,7 @@ separator_value: '4781' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4783.yml b/data_sources/windows_event_log_security_4783.yml index 4b239b5056..b0f7b5fe5c 100644 --- a/data_sources/windows_event_log_security_4783.yml +++ b/data_sources/windows_event_log_security_4783.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4790.yml b/data_sources/windows_event_log_security_4790.yml index 8a945e0fe8..301fcb7215 100644 --- a/data_sources/windows_event_log_security_4790.yml +++ b/data_sources/windows_event_log_security_4790.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_security_4794.yml b/data_sources/windows_event_log_security_4794.yml index 70bae43f05..222bc3fad3 100644 --- a/data_sources/windows_event_log_security_4794.yml +++ b/data_sources/windows_event_log_security_4794.yml @@ -17,7 +17,7 @@ separator_value: supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4798.yml b/data_sources/windows_event_log_security_4798.yml index 8eebe0e5a9..feb4495106 100644 --- a/data_sources/windows_event_log_security_4798.yml +++ b/data_sources/windows_event_log_security_4798.yml @@ -16,7 +16,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4876.yml b/data_sources/windows_event_log_security_4876.yml index bdd7735a81..ca4e0c7c95 100644 --- a/data_sources/windows_event_log_security_4876.yml +++ b/data_sources/windows_event_log_security_4876.yml @@ -17,7 +17,7 @@ separator_value: '4876' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4886.yml b/data_sources/windows_event_log_security_4886.yml index 9379641c7d..e33210fe21 100644 --- a/data_sources/windows_event_log_security_4886.yml +++ b/data_sources/windows_event_log_security_4886.yml @@ -17,7 +17,7 @@ separator_value: '4886' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4887.yml b/data_sources/windows_event_log_security_4887.yml index 2016e280f6..7646c112a2 100644 --- a/data_sources/windows_event_log_security_4887.yml +++ b/data_sources/windows_event_log_security_4887.yml @@ -17,7 +17,7 @@ separator_value: '4887' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_4946.yml b/data_sources/windows_event_log_security_4946.yml index 2d9e806305..44ee333e11 100644 --- a/data_sources/windows_event_log_security_4946.yml +++ b/data_sources/windows_event_log_security_4946.yml @@ -12,7 +12,7 @@ separator_value: '4946' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4947.yml b/data_sources/windows_event_log_security_4947.yml index b10ef8870b..2b0894834e 100644 --- a/data_sources/windows_event_log_security_4947.yml +++ b/data_sources/windows_event_log_security_4947.yml @@ -12,7 +12,7 @@ separator_value: '4947' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_4948.yml b/data_sources/windows_event_log_security_4948.yml index 961be864ee..67478d0f08 100644 --- a/data_sources/windows_event_log_security_4948.yml +++ b/data_sources/windows_event_log_security_4948.yml @@ -12,7 +12,7 @@ separator_value: '4948' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - EventID diff --git a/data_sources/windows_event_log_security_5136.yml b/data_sources/windows_event_log_security_5136.yml index b2035008e4..ab04793a83 100644 --- a/data_sources/windows_event_log_security_5136.yml +++ b/data_sources/windows_event_log_security_5136.yml @@ -17,7 +17,7 @@ separator_value: '5136' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5137.yml b/data_sources/windows_event_log_security_5137.yml index 253ce10397..5340ac3d62 100644 --- a/data_sources/windows_event_log_security_5137.yml +++ b/data_sources/windows_event_log_security_5137.yml @@ -17,7 +17,7 @@ separator_value: '5137' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AppCorrelationID diff --git a/data_sources/windows_event_log_security_5140.yml b/data_sources/windows_event_log_security_5140.yml index f5f3cf1116..abf49c3db8 100644 --- a/data_sources/windows_event_log_security_5140.yml +++ b/data_sources/windows_event_log_security_5140.yml @@ -17,7 +17,7 @@ separator_value: '5140' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_security_5141.yml b/data_sources/windows_event_log_security_5141.yml index 393098f288..2a40fdcf81 100644 --- a/data_sources/windows_event_log_security_5141.yml +++ b/data_sources/windows_event_log_security_5141.yml @@ -17,7 +17,7 @@ separator_value: '5141' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActivityID diff --git a/data_sources/windows_event_log_security_5145.yml b/data_sources/windows_event_log_security_5145.yml index 1647d2e832..dbdf8114b3 100644 --- a/data_sources/windows_event_log_security_5145.yml +++ b/data_sources/windows_event_log_security_5145.yml @@ -17,7 +17,7 @@ separator_value: '5145' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccessList diff --git a/data_sources/windows_event_log_system_104.yml b/data_sources/windows_event_log_system_104.yml index faea29ccad..6ccea0b238 100644 --- a/data_sources/windows_event_log_system_104.yml +++ b/data_sources/windows_event_log_system_104.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_event_log_system_4720.yml b/data_sources/windows_event_log_system_4720.yml index 49df88f658..47015e8dd1 100644 --- a/data_sources/windows_event_log_system_4720.yml +++ b/data_sources/windows_event_log_system_4720.yml @@ -17,7 +17,7 @@ separator_value: '4720' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4726.yml b/data_sources/windows_event_log_system_4726.yml index 642359a985..31d4f0ca60 100644 --- a/data_sources/windows_event_log_system_4726.yml +++ b/data_sources/windows_event_log_system_4726.yml @@ -17,7 +17,7 @@ separator_value: '4726' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_4728.yml b/data_sources/windows_event_log_system_4728.yml index dd3e3849ea..728e981ba5 100644 --- a/data_sources/windows_event_log_system_4728.yml +++ b/data_sources/windows_event_log_system_4728.yml @@ -17,7 +17,7 @@ separator_value: '4728' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Account_Domain diff --git a/data_sources/windows_event_log_system_7036.yml b/data_sources/windows_event_log_system_7036.yml index 0cf395b1d2..b14cad1c4c 100644 --- a/data_sources/windows_event_log_system_7036.yml +++ b/data_sources/windows_event_log_system_7036.yml @@ -17,7 +17,7 @@ separator_value: '7036' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7040.yml b/data_sources/windows_event_log_system_7040.yml index 518d67eacf..552b3d1027 100644 --- a/data_sources/windows_event_log_system_7040.yml +++ b/data_sources/windows_event_log_system_7040.yml @@ -17,7 +17,7 @@ separator_value: '7040' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - Channel diff --git a/data_sources/windows_event_log_system_7045.yml b/data_sources/windows_event_log_system_7045.yml index a1fda46fe8..95bbb82590 100644 --- a/data_sources/windows_event_log_system_7045.yml +++ b/data_sources/windows_event_log_system_7045.yml @@ -17,7 +17,7 @@ separator_value: '7045' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - AccountName diff --git a/data_sources/windows_event_log_taskscheduler_200.yml b/data_sources/windows_event_log_taskscheduler_200.yml index e7fe0ff722..618165e9f7 100644 --- a/data_sources/windows_event_log_taskscheduler_200.yml +++ b/data_sources/windows_event_log_taskscheduler_200.yml @@ -17,7 +17,7 @@ separator_value: '200' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ActionName diff --git a/data_sources/windows_event_log_taskscheduler_201.yml b/data_sources/windows_event_log_taskscheduler_201.yml index 01ff84004b..bd708a219d 100644 --- a/data_sources/windows_event_log_taskscheduler_201.yml +++ b/data_sources/windows_event_log_taskscheduler_201.yml @@ -11,7 +11,7 @@ separator: EventCode supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time output_fields: diff --git a/data_sources/windows_iis.yml b/data_sources/windows_iis.yml index a3412a3b42..6306f875ca 100644 --- a/data_sources/windows_iis.yml +++ b/data_sources/windows_iis.yml @@ -16,4 +16,4 @@ separator: EventID supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 diff --git a/data_sources/windows_iis_29.yml b/data_sources/windows_iis_29.yml index 8c6977fd3a..85da612242 100644 --- a/data_sources/windows_iis_29.yml +++ b/data_sources/windows_iis_29.yml @@ -17,7 +17,7 @@ separator_value: '29' supported_TA: - name: Splunk Add-on for Microsoft Windows url: https://splunkbase.splunk.com/app/742 - version: 10.0.1 + version: 10.1.2 fields: - _time - ComputerName