e245dddf · cryptotaxi247/CoPilot · siGit Code & Deploy

@@ -1,1280 +0,0 @@

1 -[Settings]

2 -version = 3

3 -api_url = https://api.laggar.gcw.crowdstrike.com/sensors/entities/datafeed/v2

4 -request_token_url = https://api.laggar.gcw.crowdstrike.com/oauth2/token

5 -app_id = SIEM-Connector-v2.0.0

6 -

7 -enable_correlation_id = false

8 -format_floats_as_scientific = true

9 -

10 -# API Client ID

11 -client_id = 59b2a0df58364db2a5772b1d6f3dd60b

12 -# API Client Secret

13 -client_secret = fVR354s9rhb8a2UDdCmpGO0ikEBnxvSLcT176Ylj

14 -

15 -# Amount of time (in seconds) we will wait for a connect to complete.

16 -connection_timeout = 10

17 -# Amount of time to wait (in seconds) for a server's response headers after fully writing the request.

18 -read_timeout = 30

19 -

20 -# Specify partition number 0 to n or 'all' (without quote) for all partitions

21 -partition = all

22 -

23 -http_proxy =

24 -

25 -# Output formats

26 -# Supported formats are

27 -# 1.syslog: will output syslog format with flat key=value pairs uses the mapping configuration below.

28 -; Use syslog format if CEF/LEEF output is required.

29 -# 2.json: will output raw json format received from FalconHose API (default)

30 -output_format = syslog

31 -

32 -# Will be true regardless if Syslog is not enabled

33 -# If path does not exist or user has no permission, log file will be used

34 -output_to_file = false

35 -output_path = /var/log/crowdstrike/falconhoseclient/output

36 -

37 -# Offset file full filepath and filename

38 -offset_path = /var/log/crowdstrike/falconhoseclient/stream_offsets

39 -

40 -[Output_File_Rotation]

41 -# If the output is writing to a file, then the settings below will govern output file rotation

42 -#

43 -# If true, then the rotation rules will apply. If not, the client will continue to write to the same file.

44 -rotate_file = true

45 -# Maximum individual output file size in MB

46 -max_size = 500

47 -# Number of backups of the output file to be stored

48 -max_backups = 10

49 -# Maximum age of backup output files before it is deleted in DAYS

50 -max_age = 30

51 -

52 -[Logging]

53 -verbose_log = true

54 -# Maximum individual log file size in MB

55 -max_size = 500

56 -# Number of backups to be stored

57 -max_backups = 10

58 -# Maximum age of backup files before it is deleted in DAYS

59 -max_age = 30

60 -

61 -[Syslog]

62 -send_to_syslog_server = true

63 -host = ashgrl02.socfortress.local

64 -port = 5556

65 -protocol = tcp

66 -

67 -# CEF/LEEF Headers, header_prefix will be appended before any other header information

68 -# Within each mapping section, we can add __header.{n} (note double underscore) where n is consecutive integer

69 -# starting with 0 which will be added sequentially.

70 -# Value of headers can be:

71 -# 1. As specified: enclose by single-quote

72 -# 2. Field value: just specify which field name

73 -header_delim = |

74 -header_prefix = CEF:0|CrowdStrike|FalconHost|1.0|

75 -

76 -# Character Escaping Setting

77 -# Syntax Guidelines:

78 -# - Enclose characters with double-quote i.e. "|"

79 -# - From and To characters are delimited by colon

80 -# - Character(s) that needs to be escaped is placed on the left side of a colon (:) and character to replace with is on the right i.e. "from":"to"

81 -# - Multiple character escape setting is delimited by a common i.e. "from1":"to1","from2":"to2" and so on

82 -# - header_prefix setting (above) will not be escaped

83 -escape_header = "|":"\|","\\":"\\\\"

84 -escape_ext = "\\":"\\\\","=":"\=","\n":"\\n","\r":"\\r"

85 -

86 -# Delimiter separating key and value, example: if the delimiter is '='(equal): filename=abc.txt

87 -key_val_delim = =

88 -

89 -# Delimiter separating 2 key-value pairs , example: if the delimiter is ','(comma): filename=abc.txt,domain=www.google.com

90 -# Note: For space just leave it empty

91 -field_delim =

92 -

93 -val_enclosure =

94 -

95 -# These fields will be converted to time format, field name should be the key on the mapping section (RFC3339)

96 -time_fields = deviceCustomDate1

97 -time_format = MMM dd yyyy HH:mm:ss

98 -

99 -# This will be use for filtering

100 -event_type_field = metadata.eventType

101 -event_subtype_field = event.subType

102 -

103 -# Max length of syslog line in bytes

104 -max_length = 2048

105 -

106 -# Send retry interval in seconds (applicable only for TCP)

107 -retry_interval_secs = 10

108 -

109 -# Static order fields

110 -keys_ordered = true

111 -

112 -[EventTypeCollection]

113 -DetectionSummaryEvent = true

114 -AuthActivityAuditEvent = true

115 -UserActivityAuditEvent = true

116 -HashSpreadingEvent = true

117 -RemoteResponseSessionStartEvent = true

118 -RemoteResponseSessionEndEvent = true

119 -FirewallMatchEvent = true

120 -CSPMSearchStreamingEvent = true

121 -CSPMIOAStreamingEvent = true

122 -IncidentSummaryEvent = true

123 -CustomerIOCEvent = true

124 -IdentityProtectionEvent = true

125 -ReconNotificationSummaryEvent = true

126 -ScheduledReportNotificationEvent = true

127 -MobileDetectionSummaryEvent = true

128 -XdrDetectionSummaryEvent = true

129 -IdpDetectionSummaryEvent = true

130 -

131 -# ----------------------------------------------------------------------------------------------------------------

132 -# Below configurations only applies if syslog is ENABLED (under Syslog: enabled=true

133 -# ----------------------------------------------------------------------------------------------------------------

134 -

135 -[EventSubTypeCollection]

136 -# Format: <EvenType>_<EventSubType> = true/false

137 -DetectionSummaryEvent_DnsRequests = true

138 -DetectionSummaryEvent_NetworkAccesses = true

139 -DetectionSummaryEvent_DocumentsAccessed = true

140 -DetectionSummaryEvent_ScanResults = true

141 -DetectionSummaryEvent_ExecutablesWritten = true

142 -DetectionSummaryEvent_QuarantineFiles = true

143 -HashSpreadingEvent_Sensors = true

144 -RemoteResponseSessionEndEvent_Commands = true

145 -MobileDetectionSummaryEvent_MobileAppsDetails = true

146 -MobileDetectionSummaryEvent_MobileNetworkConnections = true

147 -MobileDetectionSummaryEvent_MobileDnsRequests = true

148 -MobileDetectionSummaryEvent_MountedVolumes = true

149 -MobileDetectionSummaryEvent_Trampolines = true

150 -MobileDetectionSummaryEvent_LoadedObjects = true

151 -MobileDetectionSummaryEvent_ObjectiveCRuntimesAltered = true

152 -MobileDetectionSummaryEvent_RootAccessIndicators = true

153 -MobileDetectionSummaryEvent_Certificates = true

154 -MobileDetectionSummaryEvent_EnvironmentVariables = true

155 -MobileDetectionSummaryEvent_SystemProperties = true

156 -

157 -

158 -# FIELD MAPPINGS

159 -# Section name format: <EventType> OR <EventType>_<EventSubType>

160 -# Reserved keys:

161 -# __header.{n} where n is integer starting with 0

162 -#

163 -# There are 2 possible values for the mapping

164 -# 1. Literals which will be used as-is (for labelling) should be enclosed by single quotes

165 -# 2. Value based on incoming event

166 -#

167 -# If field mapping is not specified, then field will not appear in the results

168 -# DetectName has been deprecated because CrowdStrike now supports MITRE framework

169 -

170 -[DetectionSummaryEvent]

171 -__header.0 = metadata.eventType

172 -__header.1 = metadata.eventType

173 -__header.2 = event.Severity

174 -

175 -cat = event.Tactic

176 -externalId = event.SensorId

177 -cn2Label = 'ProcessId'

178 -cn2 = event.ProcessId

179 -cn1Label = 'ParentProcessId'

180 -cn1 = event.ParentProcessId

181 -dhost = event.ComputerName

182 -duser = event.UserName

183 -msg = event.DetectDescription

184 -fname = event.FileName

185 -filePath = event.FilePath

186 -cs5Label = 'CommandLine'

187 -cs5 = event.CommandLine

188 -fileHash = event.MD5String

189 -dntdom = event.MachineDomain

190 -cs6Label = 'FalconHostLink'

191 -cs6 = event.FalconHostLink

192 -cn3Label = 'Offset'

193 -cn3 = metadata.offset

194 -rt = metadata.eventCreationTime

195 -tactic = event.Tactic

196 -technique = event.Technique

197 -objective = event.Objective

198 -patternDisposition = event.PatternDispositionDescription

199 -outcome = event.PatternDispositionValue

200 -

201 -

202 -[DetectionSummaryEvent_DnsRequests]

203 -__header.0 = 'DNS Request In A Detection Summary Event'

204 -__header.1 = 'DNS Request In A Detection Summary Event'

205 -__header.2 = event.Severity

206 -

207 -cat = event.Tactic

208 -externalId = event.SensorId

209 -cn2Label = 'ProcessId'

210 -cn2 = event.ProcessId

211 -dhost = event.ComputerName

212 -duser = event.UserName

213 -fname = event.FileName

214 -filePath = event.FilePath

215 -dntdom = event.MachineDomain

216 -cs5Label = 'CommandLine'

217 -cs5 = event.CommandLine

218 -cs6Label = 'FalconHostLink'

219 -cs6 = event.FalconHostLink

220 -cn3Label = 'Offset'

221 -cn3 = metadata.offset

222 -deviceCustomDate1Label = 'DNS Request Time'

223 -deviceCustomDate1 = event.DnsRequests.LoadTime

224 -rt = metadata.eventCreationTime

225 -tactic = event.Tactic

226 -technique = event.Technique

227 -objective = event.Objective

228 -patternDisposition = event.PatternDispositionDescription

229 -outcome = event.PatternDispositionValue

230 -

231 -

232 -[DetectionSummaryEvent_NetworkAccesses]

233 -__header.0 = 'Network Access In A Detection Summary Event'

234 -__header.1 = 'Network Access In A Detection Summary Event'

235 -__header.2 = event.Severity

236 -

237 -cat = event.Tactic

238 -externalId = event.SensorId

239 -cn2Label = 'ProcessId'

240 -cn2 = event.ProcessId

241 -dhost = event.ComputerName

242 -duser = event.UserName

243 -fname = event.FileName

244 -filePath = event.FilePath

245 -cs5Label = 'CommandLine'

246 -cs5 = event.CommandLine

247 -dntdom = event.MachineDomain

248 -src = event.NetworkAccesses.LocalAddress

249 -c6a2 = event.NetworkAccesses.LocalAddress

250 -dst = event.NetworkAccesses.RemoteAddress

251 -c6a3 = event.NetworkAccesses.RemoteAddress

252 -spt = event.NetworkAccesses.LocalPort

253 -dpt = event.NetworkAccesses.RemotePort

254 -cs6Label = 'FalconHostLink'

255 -cs6 = event.FalconHostLink

256 -cn3Label = 'Offset'

257 -cn3 = metadata.offset

258 -deviceCustomDate1Label = 'Network Access Timestamp'

259 -deviceCustomDate1 = event.NetworkAccesses.AccessTimestamp

260 -rt = metadata.eventCreationTime

261 -tactic = event.Tactic

262 -technique = event.Technique

263 -objective = event.Objective

264 -patternDisposition = event.PatternDispositionDescription

265 -outcome = event.PatternDispositionValue

266 -

267 -

268 -[DetectionSummaryEvent_DocumentsAccessed]

269 -__header.0 = 'Document Access In A Detection Summary Event'

270 -__header.1 = 'Document Access In A Detection Summary Event'

271 -__header.2 = event.Severity

272 -

273 -cat = event.Tactic

274 -externalId = event.SensorId

275 -cn2Label = 'ProcessId'

276 -cn2 = event.ProcessId

277 -dhost = event.ComputerName

278 -duser = event.UserName

279 -fname = event.FileName

280 -filePath = event.FilePath

281 -dntdom = event.MachineDomain

282 -cs2Label = 'AccessedDocFileName'

283 -cs2 = event.DocumentsAccessed.FileName

284 -cs3Label = 'AccessedDocFilePath'

285 -cs3 = event.DocumentsAccessed.FilePath

286 -cs5Label = 'CommandLine'

287 -cs5 = event.CommandLine

288 -cs6Label = 'FalconHostLink'

289 -cs6 = event.FalconHostLink

290 -cn3Label = 'Offset'

291 -cn3 = metadata.offset

292 -deviceCustomDate1Label = 'Document Accessed Timestamp'

293 -deviceCustomDate1 = event.DocumentsAccessed.Timestamp

294 -rt = metadata.eventCreationTime

295 -tactic = event.Tactic

296 -technique = event.Technique

297 -objective = event.Objective

298 -patternDisposition = event.PatternDispositionDescription

299 -outcome = event.PatternDispositionValue

300 -

301 -[DetectionSummaryEvent_ScanResults]

302 -__header.0 = 'AV Scan Results In A Detection Summary Event'

303 -__header.1 = 'AV Scan Results In A Detection Summary Event'

304 -__header.2 = event.Severity

305 -

306 -cat = event.Tactic

307 -externalId = event.SensorId

308 -cn2Label = 'ProcessId'

309 -cn2 = event.ProcessId

310 -dhost = event.ComputerName

311 -duser = event.UserName

312 -fname = event.FileName

313 -filePath = event.FilePath

314 -fileHash = event.MD5String

315 -dntdom = event.MachineDomain

316 -cs2Label = 'ScanResultEngine'

317 -cs2 = event.ScanResults.Engine

318 -cs1Label = 'ScanResultName'

319 -cs1 = event.ScanResults.ResultName

320 -cs4Label = 'ScanResultVersion'

321 -cs4 = event.ScanResults.Version

322 -cs5Label = 'CommandLine'

323 -cs5 = event.CommandLine

324 -cs6Label = 'FalconHostLink'

325 -cs6 = event.FalconHostLink

326 -cn3Label = 'Offset'

327 -cn3 = metadata.offset

328 -rt = metadata.eventCreationTime

329 -tactic = event.Tactic

330 -technique = event.Technique

331 -objective = event.Objective

332 -patternDisposition = event.PatternDispositionDescription

333 -outcome = event.PatternDispositionValue

334 -

335 -[DetectionSummaryEvent_ExecutablesWritten]

336 -__header.0 = 'Executable Written In A Detection Summary Event'

337 -__header.1 = 'Executable Written In A Detection Summary Event'

338 -__header.2 = event.Severity

339 -

340 -cat = event.Tactic

341 -externalId = event.SensorId

342 -cn2Label = 'ProcessId'

343 -cn2 = event.ProcessId

344 -dhost = event.ComputerName

345 -duser = event.UserName

346 -fname = event.FileName

347 -filePath = event.FilePath

348 -dntdom = event.MachineDomain

349 -cs2Label = 'WrittenExeFileName'

350 -cs2 = event.ExecutablesWritten.FileName

351 -cs3Label = 'WrittenExeFilePath'

352 -cs3 = event.ExecutablesWritten.FilePath

353 -cs5Label = 'CommandLine'

354 -cs5 = event.CommandLine

355 -cs6Label = 'FalconHostLink'

356 -cs6 = event.FalconHostLink

357 -cn3Label = 'Offset'

358 -cn3 = metadata.offset

359 -deviceCustomDate1Label = 'ExeWrittenTimestamp'

360 -deviceCustomDate1 = event.ExecutablesWritten.Timestamp

361 -rt = metadata.eventCreationTime

362 -tactic = event.Tactic

363 -technique = event.Technique

364 -objective = event.Objective

365 -patternDisposition = event.PatternDispositionDescription

366 -outcome = event.PatternDispositionValue

367 -

368 -[DetectionSummaryEvent_QuarantineFiles]

369 -__header.0 = 'Quarantined Files In A Detection Summary Event'

370 -__header.1 = 'Quarantined Files In A Detection Summary Event'

371 -__header.2 = event.Severity

372 -

373 -cat = event.Tactic

374 -externalId = event.SensorId

375 -cn2Label = 'ProcessId'

376 -cn2 = event.ProcessId

377 -dhost = event.ComputerName

378 -duser = event.UserName

379 -fname = event.FileName

380 -filePath = event.FilePath

381 -dntdom = event.MachineDomain

382 -cs2Label = 'QuarantineFileSHA256'

383 -cs2 = event.QuarantineFiles.SHA256HashData

384 -cs3Label = 'QuarantineFilePath'

385 -cs3 = event.QuarantineFiles.ImageFileName

386 -cs5Label = 'CommandLine'

387 -cs5 = event.CommandLine

388 -cs6Label = 'FalconHostLink'

389 -cs6 = event.FalconHostLink

390 -cn3Label = 'Offset'

391 -cn3 = metadata.offset

392 -deviceCustomDate1Label = 'ExeWrittenTimestamp'

393 -deviceCustomDate1 = event.ExecutablesWritten.Timestamp

394 -rt = metadata.eventCreationTime

395 -tactic = event.Tactic

396 -technique = event.Technique

397 -objective = event.Objective

398 -patternDisposition = event.PatternDispositionDescription

399 -outcome = event.PatternDispositionValue

400 -

401 -[UserActivityAuditEvent]

402 -__header.0 = metadata.eventType

403 -__header.1 = event.OperationName

404 -__header.2 = '1'

405 -

406 -cat = metadata.eventType

407 -destinationTranslatedAddress = event.UserIp

408 -duser = event.UserId

409 -deviceProcessName = event.ServiceName

410 -cn3Label = 'Offset'

411 -cn3 = metadata.offset

412 -outcome = event.Success

413 -rt = metadata.eventCreationTime

414 -

415 -[AuthActivityAuditEvent]

416 -__header.0 = event.OperationName

417 -__header.1 = event.OperationName

418 -__header.2 = '1'

419 -

420 -cat = metadata.eventType

421 -destinationTranslatedAddress = event.UserIp

422 -duser = event.UserId

423 -deviceProcessName = event.ServiceName

424 -cn3Label = 'Offset'

425 -cn3 = metadata.offset

426 -outcome = event.Success

427 -deviceCustomDate1Label = 'Timestamp'

428 -deviceCustomDate1 = event.UTCTimestamp

429 -rt = metadata.eventCreationTime

430 -

431 -[HashSpreadingEvent]

432 -__header.0 = 'Hash Spreading Summary'

433 -__header.1 = 'Hash Spreading Event-Summary'

434 -__header.2 = '5'

435 -

436 -cat = event.ExecutionType

437 -deviceCustomDate1Label = 'DocAccessTimestamp'

438 -deviceCustomDate1 = event.AlertTime

439 -fname=event.FileName

440 -fileHash=event.SHA256String

441 -deviceCustomDate2Label = 'HashSpreadingEventTime'

442 -deviceCustomDate2 = metadata.eventCreationTime

443 -

444 -[HashSpreadingEvent_Sensors]

445 -__header.0 = 'Hash Spreading Sensor'

446 -__header.1 = 'Hash Spreading Event-Sensor Details'

447 -__header.2 = '5'

448 -

449 -cat = event.ExecutionType

450 -deviceCustomDate1Label = 'DocAccessTimestamp'

451 -deviceCustomDate1 = event.AlertTime

452 -fname = event.Sensors.Filename

453 -fileHash=event.SHA256String

454 -dhost = event.Sensors.HostnameField

455 -deviceCustomDate2Label = 'HashSpreadingSensorEventTime'

456 -deviceCustomDate2 = event.Sensors.LastWriteTime

457 -

458 -[RemoteResponseSessionStartEvent]

459 -__header.0 = metadata.eventType

460 -__header.1 = 'Remote Response Session Start event'

461 -__header.2 = '1'

462 -

463 -cat = metadata.eventType

464 -cn3Label = 'Offset'

465 -cn3 = metadata.offset

466 -rt = metadata.eventCreationTime

467 -dhost = event.HostnameField

468 -duser = event.UserName

469 -sessionStartTimestampLabel = 'RemoteResponseSessionStartTimestamp'

470 -sessionStartTimestamp = event.StartTimestamp

471 -

472 -[RemoteResponseSessionEndEvent]

473 -__header.0 = metadata.eventType

474 -__header.1 = 'Remote Response Session End event'

475 -__header.2 = '1'

476 -

477 -cat = metadata.eventType

478 -cn3Label = 'Offset'

479 -cn3 = metadata.offset

480 -rt = metadata.eventCreationTime

481 -dhost = event.HostnameField

482 -duser = event.UserName

483 -sessionEndTimestampLabel = 'RemoteResponseSessionEndTimestamp'

484 -sessionEndTimestamp = event.EndTimestamp

485 -

486 -[RemoteResponseSessionEndEvent_Commands]

487 -__header.0 = metadata.eventType

488 -__header.1 = 'Remote Response Session End event'

489 -__header.2 = '1'

490 -

491 -cat = metadata.eventType

492 -cn3Label = 'Offset'

493 -cn3 = metadata.offset

494 -rt = metadata.eventCreationTime

495 -dhost = event.HostnameField

496 -duser = event.UserName

497 -sessionEndTimestampLabel = 'RemoteResponseSessionEndTimestamp'

498 -sessionEndTimestamp = event.EndTimestamp

499 -cmdLabel = 'Command'

500 -cmd = event.Commands

501 -

502 -

503 -[FirewallMatchEvent]

504 -__header.0 = metadata.eventType

505 -__header.1 = 'Firewall Match event'

506 -__header.2 = '1'

507 -

508 -cat = metadata.eventType

509 -deviceId = event.DeviceId

510 -ipVLabel = 'IpV'

511 -ipV = event.IpV

512 -cmdLineLabel = 'Command Line'

513 -cmdLine = event.CommandLine

514 -connectionDirectionLabel = 'Connection Direction'

515 -connectionDirection = event.ConnectionDirection

516 -eventType = event.EventType

517 -flags = event.Flags

518 -hostName = event.HostName

519 -icmpCodeLabel = 'ICMP Code'

520 -icmpCode = event.ICMPCode

521 -icmpTypeLabel = 'ICMP Type'

522 -icmpType = event.ICMPType

523 -imageFileNameLabel = 'Image File Name'

524 -imageFileName = event.ImageFileName

525 -localAddressLabel = 'Local Address'

526 -localAddress = event.LocalAddress

527 -localPortLabel = 'Local Port'

528 -localPort = event.LocalPort

529 -matchCountLabel = 'Match Count'

530 -matchCount = event.MatchCount

531 -matchCountSinceLastReportLabel = 'Match Count Since Last Report'

532 -matchCount = event.MatchCountSinceLastReport

533 -networkProfileLabel = 'Network Profile'

534 -networkProfile = event.NetworkProfile

535 -PolicyNameLabel = 'Policy Name'

536 -networkProfile = event.PolicyName

537 -protocolLabel = 'Protocol'

538 -protocol = event.Protocol

539 -remoteAddressLabel = 'Remote Address'

540 -remoteAddress = event.RemoteAddress

541 -remotePortLabel = 'Remote Port'

542 -remotePort = event.RemotePort

543 -ruleActionLabel = 'Rule Action'

544 -ruleAction = event.RuleAction

545 -ruleDescriptionLabel = 'Rule Description'

546 -ruleDescription = event.RuleDescription

547 -ruleGroupNameLabel = 'Rule Group Name'

548 -ruleGroupName = event.RuleGroupName

549 -ruleNameLabel = 'Rule Name'

550 -ruleName = event.RuleName

551 -statusLabel = 'Status'

552 -status = event.Status

553 -cn3Label = 'Offset'

554 -cn3 = metadata.offset

555 -rt = metadata.eventCreationTime

556 -

557 -

558 -[CSPMSearchStreamingEvent]

559 -__header.0 = metadata.eventType

560 -__header.1 = 'CSPM Search Streaming event'

561 -__header.2 = '1'

562 -

563 -cat = metadata.eventType

564 -accountIdLabel = 'AccountId'

565 -accountId = event.AccountId

566 -regionLabel = 'Region'

567 -region = event.Region

568 -resourceIdLabel = 'ResourceId'

569 -resourceId = event.ResourceId

570 -resourceIdTypeLabel = 'ResourceIdType'

571 -resourceIdType = event.ResourceIdType

572 -resourceNameLabel = 'ResourceName'

573 -resourceName = event.ResourceName

574 -resourceCreateTimeLabel = 'ResourceCreateTime'

575 -resourceCreateTime = event.ResourceCreateTime

576 -policyStatementLabel = 'PolicyStatement'

577 -policyStatement = event.PolicyStatement

578 -severityNameLabel = 'SeverityName'

579 -severityName = event.SeverityName

580 -cloudPlatformLabel = 'CloudPlatform'

581 -cloudPlatform = event.CloudPlatform

582 -cloudServiceLabel = 'CloudService'

583 -cloudService = event.CloudService

584 -dispositionLabel = 'Disposition'

585 -disposition = event.Disposition

586 -resourceUrlLabel = 'ResourceUrl'

587 -resourceUrl = event.ResourceUrl

588 -findingLabel = 'Finding'

589 -finding = event.Finding

590 -resourceAttributesLabel = 'ResourceAttributes'

591 -resourceAttributes = event.ResourceAttributes

592 -tagsLabel = 'Tags'

593 -tags = event.Tags

594 -timestampLabel = 'Timestamp'

595 -timestamp = event.Timestamp

596 -

597 -[CSPMIOAStreamingEvent]

598 -__header.0 = metadata.eventType

599 -__header.1 = 'CSPM IOA Streaming event'

600 -__header.2 = '1'

601 -

602 -cat = metadata.eventType

603 -accountIdLabel = 'AccountId'

604 -accountId = event.AccountId

605 -policyStatementLabel = 'PolicyStatement'

606 -policyStatement = event.PolicyStatement

607 -cloudProviderLabel = 'CloudProvider'

608 -cloudProvider = event.CloudProvider

609 -cloudServiceLabel = 'CloudService'

610 -cloudService = event.CloudService

611 -severityNameLabel = 'SeverityName'

612 -severityName = event.SeverityName

613 -eventActionLabel = 'EventAction'

614 -eventAction = event.EventAction

615 -eventSourceLabel = 'EventSource'

616 -eventSource = event.EventSource

617 -eventCreatedTimeLabel = 'EventCreatedTimestamp'

618 -eventCreatedTime = event.EventCreatedTimestamp

619 -userIdLabel = 'UserId'

620 -userId = event.UserId

621 -userNameLabel = 'UserName'

622 -userName = event.UserName

623 -userSourceIpLabel = 'UserSourceIp'

624 -userSourceIp = event.UserSourceIp

625 -tacticLabel = 'Tactic'

626 -tactic = event.Tactic

627 -techniqueLabel = 'Technique'

628 -technique = event.Technique

629 -

630 -[CustomerIOCEvent]

631 -__header.0 = 'Indicator of Compromise'

632 -cat = metadata.eventType

633 -devTimeFormat='yyyy-MM-dd HH:mm:ss'

634 -devTime = metadata.eventCreationTime

635 -commandLine = event.CommandLine

636 -resource = event.ComputerName

637 -fileName = event.FileName

638 -filePath = event.FilePath

639 -dnsRequestDomain = event.DomainName

640 -dstIPv4 = event.IPv4

641 -dstIPv6 = event.IPv6

642 -md5 = event.MD5String

643 -sha1 = event.SHA1String

644 -sha256 = event.SHA256String

645 -

646 -[IncidentSummaryEvent]

647 -__header.0 = metadata.eventType

648 -__header.1 = metadata.eventType

649 -__header.2 = '5'

650 -cat = metadata.eventType

651 -cs1Label = 'FalconHostLink'

652 -cs1 = event.FalconHostLink

653 -cs2Label = 'State'

654 -cs2 = event.State

655 -cn3Label = 'FineScore'

656 -cn3 = event.FineScore

657 -deviceCustomDate1Label = 'IncidentStartTime'

658 -deviceCustomDate1 = event.IncidentStartTime

659 -deviceCustomDate2Label = 'IncidentEndTime'

660 -deviceCustomDate2 = event.IncidentEndTime

661 -deviceCustomDate2 = event.IncidentEndTime

662 -

663 -[IdentityProtectionEvent]

664 -__header.0 = event.Category

665 -__header.1 = event.Severity

666 -

667 -cat = event.Category

668 -cs1Label = 'incidentType'

669 -cs1 = event.IncidentType

670 -severityNameLabel = 'severityName'

671 -severityName = event.SeverityName

672 -msg = event.IncidentDescription

673 -deviceCustomDate1Label = 'startTime'

674 -deviceCustomDate1 = event.StartTime

675 -deviceCustomDate2Label = 'endTime'

676 -deviceCustomDate2 = event.EndTime

677 -cs2Label = 'identityProtectionIncidentId'

678 -cs2 = event.IdentityProtectionIncidentId

679 -duser = event.UserName

680 -dhost = event.EndpointName

681 -cs3Label = 'endpointIp'

682 -cs3 = event.EndpointIp

683 -cn1Label = 'numberOfCompromisedEntities'

684 -cn1 = event.NumberOfCompromisedEntities

685 -cn2Label = 'numbersOfAlerts'

686 -cn2 = event.NumbersOfAlerts

687 -cs4Label = 'falconHostLink'

688 -cs4 = event.FalconHostLink

689 -stateLabel = 'state'

690 -state = event.State

691 -

692 -[ReconNotificationSummaryEvent]

693 -__header.0 = metadata.eventType

694 -__header.1 = 'Recon Notification Summary Event'

695 -__header.2 = '1'

696 -

697 -cat = metadata.eventType

698 -notificationIdLabel = 'NotificationId'

699 -notificationId = event.NotificationId

700 -highlightsLabel = 'MatchHighlights'

701 -highlights = event.Highlights

702 -matchedTimestampLabel = 'MatchTimestamp'

703 -matchedTimestamp = event.MatchedTimestamp

704 -ruleIdLabel = 'MonitoringRuleId'

705 -ruleId = event.RuleId

706 -ruleNameLabel = 'MonitoringRuleName'

707 -ruleName = event.RuleName

708 -ruleTopicLabel = 'MonitoringRuleTopic'

709 -ruleTopic = event.RuleTopic

710 -rulePriorityLabel = 'MonitoringRulePriority'

711 -rulePriority = event.RulePriority

712 -itemIdLabel = 'RawIntelligenceItemId'

713 -itemId = event.ItemId

714 -itemTypeLabel = 'RawIntelligenceItemType'

715 -itemType = event.ItemType

716 -itemPostedTimestampLabel = 'RawIntelligenceItemPostedTimestamp'

717 -itemPostedTimestamp = event.ItemPostedTimestamp

718 -

719 -[ScheduledReportNotificationEvent]

720 -__header.0 = metadata.eventType

721 -__header.1 = 'Scheduled Report Notification Event'

722 -__header.2 = '1'

723 -

724 -cat = metadata.eventType

725 -userUUIDLabel = 'UserUUID'

726 -userUUID = event.UserUUID

727 -userIDLabel = 'UserID'

728 -userID = event.UserID

729 -executionIDLabel = 'ExecutionID'

730 -executionID = event.ExecutionID

731 -reportIDLabel = 'ReportID'

732 -reportID = event.ReportID

733 -reportNameLabel = 'ReportName'

734 -reportName = event.ReportName

735 -reportTypeLabel = 'ReportType'

736 -reportType = event.ReportType

737 -reportFileReferenceLabel = 'ReportFileReference'

738 -reportFileReference = event.ReportFileReference

739 -statusLabel = 'Status'

740 -status = event.Status

741 -statusMessageLabel = 'StatusMessage'

742 -statusMessage = event.StatusMessage

743 -executionMetadataLabel = 'ExecutionMetadata'

744 -executionMetadata = event.ExecutionMetadata

745 -

746 -[MobileDetectionSummaryEvent]

747 -__header.0 = metadata.eventType

748 -__header.1 = metadata.eventType

749 -__header.2 = event.Severity

750 -

751 -cat = event.Tactic

752 -externalId = event.SensorId

753 -dhost = event.ComputerName

754 -duser = event.UserName

755 -msg = event.DetectDescription

756 -dvcpid = event.ProcessId

757 -cn1Label = 'SELinuxEnforcementPolicy'

758 -cn1 = event.SELinuxEnforcementPolicy

759 -cs6Label = 'FalconHostLink'

760 -cs6 = event.FalconHostLink

761 -cn3Label = 'Offset'

762 -cn3 = metadata.offset

763 -deviceCustomDate1Label = 'ContextTimeStamp'

764 -deviceCustomDate1 = event.ContextTimeStamp

765 -rt = metadata.eventCreationTime

766 -tactic = event.Tactic

767 -technique = event.Technique

768 -objective = event.Objective

769 -

770 -[MobileDetectionSummaryEvent_MobileAppsDetails]

771 -__header.0 = 'Mobile Application Details In A Mobile Detection Summary Event'

772 -__header.1 = 'Mobile Application Details In A Mobile Detection Summary Event'

773 -__header.2 = event.Severity

774 -

775 -cat = event.Tactic

776 -externalId = event.SensorId

777 -dhost = event.ComputerName

778 -duser = event.UserName

779 -msg = event.DetectDescription

780 -dvcpid = event.ProcessId

781 -cs1Label = 'AppIdentifier'

782 -cs1 = event.MobileAppsDetails.AppIdentifier

783 -cs2Label = 'AppInstallerInformation'

784 -cs2 = event.MobileAppsDetails.AppInstallerInformation

785 -fname = event.MobileAppsDetails.ImageFileName

786 -fileHash = event.MobileAppsDetails.SHA256HashData

787 -cs3Label = 'DexFileHashes'

788 -cs3 = event.MobileAppsDetails.DexFileHashes

789 -cs4Label = 'AndroidAppVersionName'

790 -cs4 = event.MobileAppsDetails.AndroidAppVersionName

791 -cn1Label = 'HarmfulAppCategory'

792 -cn1 = event.MobileAppsDetails.HarmfulAppCategory

793 -cs5Label = 'AndroidComponentName'

794 -cs5 = event.MobileAppsDetails.AndroidComponentName

795 -cs6Label = 'FalconHostLink'

796 -cs6 = event.FalconHostLink

797 -cn3Label = 'Offset'

798 -cn3 = metadata.offset

799 -deviceCustomDate1Label = 'ContextTimeStamp'

800 -deviceCustomDate1 = event.ContextTimeStamp

801 -rt = metadata.eventCreationTime

802 -tactic = event.Tactic

803 -technique = event.Technique

804 -objective = event.Objective

805 -

806 -[MobileDetectionSummaryEvent_MobileNetworkConnections]

807 -__header.0 = 'Network Connection In A Mobile Detection Summary Event'

808 -__header.1 = 'Network Connection In A Mobile Detection Summary Event'

809 -__header.2 = event.Severity

810 -

811 -cat = event.Tactic

812 -externalId = event.SensorId

813 -dhost = event.ComputerName

814 -duser = event.UserName

815 -msg = event.DetectDescription

816 -dvcpid = event.ProcessId

817 -cs1Label = 'Protocol'

818 -cs1 = event.MobileNetworkConnections.Protocol

819 -cn1Label = 'ConnectionFlags'

820 -cn1 = event.MobileNetworkConnections.ConnectionFlags

821 -src = event.MobileNetworkConnections.LocalAddress

822 -c6a2 = event.MobileNetworkConnections.LocalAddress

823 -dst = event.MobileNetworkConnections.RemoteAddress

824 -c6a3 = event.MobileNetworkConnections.RemoteAddress

825 -spt = event.MobileNetworkConnections.LocalPort

826 -dpt = event.MobileNetworkConnections.RemotePort

827 -deviceDirection = MobileNetworkConnections.ConnectionDirection

828 -request = event.MobileNetworkConnections.Url

829 -cs2Label = 'AppIdentifier'

830 -cs2 = event.MobileNetworkConnections.AppIdentifier

831 -cs3Label = 'IsAndroidAppContainerized'

832 -cs3 = event.MobileNetworkConnections.IsAndroidAppContainerized

833 -cn2Label = 'ContextProcessId'

834 -cn2 = event.MobileNetworkConnections.ContextProcessId

835 -cs6Label = 'FalconHostLink'

836 -cs6 = event.FalconHostLink

837 -cn3Label = 'Offset'

838 -cn3 = metadata.offset

839 -deviceCustomDate1Label = 'Network Connection Timestamp'

840 -deviceCustomDate1 = event.MobileNetworkConnections.AccessTimestamp

841 -rt = metadata.eventCreationTime

842 -tactic = event.Tactic

843 -technique = event.Technique

844 -objective = event.Objective

845 -

846 -[MobileDetectionSummaryEvent_MobileDnsRequests]

847 -__header.0 = 'Dns Request In A Mobile Detection Summary Event'

848 -__header.1 = 'Dns Request In A Mobile Detection Summary Event'

849 -__header.2 = event.Severity

850 -

851 -cat = event.Tactic

852 -externalId = event.SensorId

853 -dhost = event.ComputerName

854 -duser = event.UserName

855 -msg = event.DetectDescription

856 -dvcpid = event.ProcessId

857 -destinationDnsDomain = event.MobileDnsRequests.DomainName

858 -cs1Label = 'RequestType'

859 -cs1 = event.MobileDnsRequests.RequestType

860 -cs2Label = 'AppIdentifier'

861 -cs2 = event.MobileDnsRequests.AppIdentifier

862 -dst = event.MobileDnsRequests.IpAddress

863 -c6a3 = event.MobileDnsRequests.IpAddress

864 -cn1Label = 'ContextProcessId'

865 -cn1 = event.MobileDnsRequests.ContextProcessId

866 -cs6Label = 'FalconHostLink'

867 -cs6 = event.FalconHostLink

868 -cn3Label = 'Offset'

869 -cn3 = metadata.offset

870 -deviceCustomDate1Label = 'DNS Request Timestamp'

871 -deviceCustomDate1 = event.MobileDnsRequests.AccessTimestamp

872 -rt = metadata.eventCreationTime

873 -tactic = event.Tactic

874 -technique = event.Technique

875 -objective = event.Objective

876 -

877 -[MobileDetectionSummaryEvent_MountedVolumes]

878 -__header.0 = 'Mounted Volume In A Mobile Detection Summary Event'

879 -__header.1 = 'Mounted Volume In A Mobile Detection Summary Event'

880 -__header.2 = event.Severity

881 -

882 -cat = event.Tactic

883 -externalId = event.SensorId

884 -dhost = event.ComputerName

885 -duser = event.UserName

886 -msg = event.DetectDescription

887 -dvcpid = event.ProcessId

888 -cs1Label = 'Type'

889 -cs1 = event.MountedVolumes.Type

890 -cs2Label = 'MountPoint'

891 -cs2 = event.MountedVolumes.MountPoint

892 -cs3Label = 'MountFlags'

893 -cs3 = event.MountedVolumes.MountFlags

894 -cs4Label = 'RealDeviceName'

895 -cs4 = event.MountedVolumes.RealDeviceName

896 -cs6Label = 'FalconHostLink'

897 -cs6 = event.FalconHostLink

898 -cn3Label = 'Offset'

899 -cn3 = metadata.offset

900 -deviceCustomDate1Label = 'ContextTimeStamp'

901 -deviceCustomDate1 = event.ContextTimeStamp

902 -rt = metadata.eventCreationTime

903 -tactic = event.Tactic

904 -technique = event.Technique

905 -objective = event.Objective

906 -

907 -[MobileDetectionSummaryEvent_Trampolines]

908 -__header.0 = 'Trampoline In A Mobile Detection Summary Event'

909 -__header.1 = 'Trampoline In A Mobile Detection Summary Event'

910 -__header.2 = event.Severity

911 -

912 -cat = event.Tactic

913 -externalId = event.SensorId

914 -dhost = event.ComputerName

915 -duser = event.UserName

916 -msg = event.DetectDescription

917 -dvcpid = event.ProcessId

918 -cs1Label = 'FunctionName'

919 -cs1 = event.Trampolines.FunctionName

920 -cs2Label = 'ExecutableBytes'

921 -cs2 = event.Trampolines.ExecutableBytes

922 -fname = event.Trampolines.ImageFileName

923 -cs6Label = 'FalconHostLink'

924 -cs6 = event.FalconHostLink

925 -cn3Label = 'Offset'

926 -cn3 = metadata.offset

927 -deviceCustomDate1Label = 'ContextTimeStamp'

928 -deviceCustomDate1 = event.ContextTimeStamp

929 -rt = metadata.eventCreationTime

930 -tactic = event.Tactic

931 -technique = event.Technique

932 -objective = event.Objective

933 -

934 -[MobileDetectionSummaryEvent_LoadedObjects]

935 -__header.0 = 'Loaded Object In A Mobile Detection Summary Event'

936 -__header.1 = 'Loaded Object In A Mobile Detection Summary Event'

937 -__header.2 = event.Severity

938 -

939 -cat = event.Tactic

940 -externalId = event.SensorId

941 -dhost = event.ComputerName

942 -duser = event.UserName

943 -msg = event.DetectDescription

944 -dvcpid = event.ProcessId

945 -fname = event.LoadedObjects.FileName

946 -fileHash = event.LoadedObjects.SHA256HashData

947 -cs1Label = 'CodeSigningFlags'

948 -cs1 = event.LoadedObjects.CodeSigningFlags

949 -cs6Label = 'FalconHostLink'

950 -cs6 = event.FalconHostLink

951 -cn3Label = 'Offset'

952 -cn3 = metadata.offset

953 -deviceCustomDate1Label = 'ContextTimeStamp'

954 -deviceCustomDate1 = event.ContextTimeStamp

955 -rt = metadata.eventCreationTime

956 -tactic = event.Tactic

957 -technique = event.Technique

958 -objective = event.Objective

959 -

960 -[MobileDetectionSummaryEvent_ObjectiveCRuntimesAltered]

961 -__header.0 = 'ObjectiveC Runtime Altered In A Mobile Detection Summary Event'

962 -__header.1 = 'ObjectiveC Runtime Altered In A Mobile Detection Summary Event'

963 -__header.2 = event.Severity

964 -

965 -cat = event.Tactic

966 -externalId = event.SensorId

967 -dhost = event.ComputerName

968 -duser = event.UserName

969 -msg = event.DetectDescription

970 -dvcpid = event.ProcessId

971 -cs1Label = 'MethodSignature'

972 -cs1 = event.ObjectiveCRuntimesAltered.MethodSignature

973 -fname = event.ObjectiveCRuntimesAltered.ImageFileName

974 -cs2Label = 'ExpectedImageFileName'

975 -cs2 = event.ObjectiveCRuntimesAltered.ExpectedImageFileName

976 -cs3Label = 'SuspectAddress'

977 -cs3 = event.ObjectiveCRuntimesAltered.SuspectAddress

978 -cs4Label = 'ExpectedAddress'

979 -cs4 = event.ObjectiveCRuntimesAltered.ExpectedAddress

980 -cs6Label = 'FalconHostLink'

981 -cs6 = event.FalconHostLink

982 -cn3Label = 'Offset'

983 -cn3 = metadata.offset

984 -deviceCustomDate1Label = 'ContextTimeStamp'

985 -deviceCustomDate1 = event.ContextTimeStamp

986 -rt = metadata.eventCreationTime

987 -tactic = event.Tactic

988 -technique = event.Technique

989 -objective = event.Objective

990 -

991 -[MobileDetectionSummaryEvent_RootAccessIndicators]

992 -__header.0 = 'Root Access Indicators In A Mobile Detection Summary Event'

993 -__header.1 = 'Root Access Indicators In A Mobile Detection Summary Event'

994 -__header.2 = event.Severity

995 -

996 -cat = event.Tactic

997 -externalId = event.SensorId

998 -dhost = event.ComputerName

999 -duser = event.UserName

1000 -msg = event.DetectDescription

1001 -dvcpid = event.ProcessId

1002 -cs1Label = 'LogcatMessage'

1003 -cs1 = event.RootAccessIndicators.LogcatMessage

1004 -cs2Label = 'AndroidStackTrace'

1005 -cs2 = event.RootAccessIndicators.AndroidStackTrace

1006 -cs3Label = 'HookedFunctionName'

1007 -cs3 = event.RootAccessIndicators.HookedFunctionName

1008 -cs4Label = 'AndroidInitServiceName'

1009 -cs4 = event.RootAccessIndicators.AndroidInitServiceName

1010 -cs6Label = 'FalconHostLink'

1011 -cs6 = event.FalconHostLink

1012 -cn3Label = 'Offset'

1013 -cn3 = metadata.offset

1014 -deviceCustomDate1Label = 'ContextTimeStamp'

1015 -deviceCustomDate1 = event.ContextTimeStamp

1016 -rt = metadata.eventCreationTime

1017 -tactic = event.Tactic

1018 -technique = event.Technique

1019 -objective = event.Objective

1020 -

1021 -[MobileDetectionSummaryEvent_Certificates]

1022 -__header.0 = 'Certificate In A Mobile Detection Summary Event'

1023 -__header.1 = 'Certificate In A Mobile Detection Summary Event'

1024 -__header.2 = event.Severity

1025 -

1026 -cat = event.Tactic

1027 -externalId = event.SensorId

1028 -dhost = event.ComputerName

1029 -duser = event.UserName

1030 -msg = event.DetectDescription

1031 -dvcpid = event.ProcessId

1032 -cs1Label = 'CertificateName'

1033 -cs1 = event.Certificates.Name

1034 -cs2Label = 'CertificateIssuer'

1035 -cs2 = event.Certificates.Issuer

1036 -cs3Label = 'CertificateFingerPrint'

1037 -cs3 = event.Certificates.FingerPrint

1038 -cs6Label = 'FalconHostLink'

1039 -cs6 = event.FalconHostLink

1040 -cn3Label = 'Offset'

1041 -cn3 = metadata.offset

1042 -deviceCustomDate1Label = 'ContextTimeStamp'

1043 -deviceCustomDate1 = event.ContextTimeStamp

1044 -rt = metadata.eventCreationTime

1045 -tactic = event.Tactic

1046 -technique = event.Technique

1047 -objective = event.Objective

1048 -

1049 -[MobileDetectionSummaryEvent_EnvironmentVariables]

1050 -__header.0 = 'Environment Variable In A Mobile Detection Summary Event'

1051 -__header.1 = 'Environment Variable In A Mobile Detection Summary Event'

1052 -__header.2 = event.Severity

1053 -

1054 -cat = event.Tactic

1055 -externalId = event.SensorId

1056 -dhost = event.ComputerName

1057 -duser = event.UserName

1058 -msg = event.DetectDescription

1059 -dvcpid = event.ProcessId

1060 -cs1Label = 'EnvironmentVariableName'

1061 -cs1 = event.EnvironmentVariables.Name

1062 -cs2Label = 'EnvironmentVariableValue'

1063 -cs2 = event.EnvironmentVariables.Value

1064 -cs6Label = 'FalconHostLink'

1065 -cs6 = event.FalconHostLink

1066 -cn3Label = 'Offset'

1067 -cn3 = metadata.offset

1068 -deviceCustomDate1Label = 'ContextTimeStamp'

1069 -deviceCustomDate1 = event.ContextTimeStamp

1070 -rt = metadata.eventCreationTime

1071 -tactic = event.Tactic

1072 -technique = event.Technique

1073 -objective = event.Objective

1074 -

1075 -[MobileDetectionSummaryEvent_SystemProperties]

1076 -__header.0 = 'System Property In A Mobile Detection Summary Event'

1077 -__header.1 = 'System Property In A Mobile Detection Summary Event'

1078 -__header.2 = event.Severity

1079 -

1080 -cat = event.Tactic

1081 -externalId = event.SensorId

1082 -dhost = event.ComputerName

1083 -duser = event.UserName

1084 -msg = event.DetectDescription

1085 -dvcpid = event.ProcessId

1086 -cs1Label = 'SystemPropertyName'

1087 -cs1 = event.SystemProperties.Name

1088 -cs2Label = 'SystemPropertyValue'

1089 -cs2 = event.SystemProperties.Value

1090 -cs6Label = 'FalconHostLink'

1091 -cs6 = event.FalconHostLink

1092 -cn3Label = 'Offset'

1093 -cn3 = metadata.offset

1094 -deviceCustomDate1Label = 'ContextTimeStamp'

1095 -deviceCustomDate1 = event.ContextTimeStamp

1096 -rt = metadata.eventCreationTime

1097 -tactic = event.Tactic

1098 -technique = event.Technique

1099 -objective = event.Objective

1100 -

1101 -[XdrDetectionSummaryEvent]

1102 -__header.0 = metadata.eventType

1103 -__header.1 = 'XDR Detection Summary Event'

1104 -__header.2 = event.Severity

1105 -

1106 -cat = metadata.eventType

1107 -msg = event.Description

1108 -rt = metadata.eventCreationTime

1109 -tactics = event.Tactics

1110 -techniques = event.Techniques

1111 -xdrTypeLabel = 'XdrType'

1112 -xdrType = event.XdrType

1113 -authorLabel = 'Author'

1114 -author = event.Author

1115 -

1116 -scheduledSearchExecutionIdLabel = 'ScheduledSearchExecutionId'

1117 -scheduledSearchExecutionId = event.ScheduledSearchExecutionId

1118 -scheduledSearchIdLabel = 'ScheduledSearchId'

1119 -scheduledSearchId = event.ScheduledSearchId

1120 -scheduledSearchUserIdLabel = 'ScheduledSearchUserId'

1121 -scheduledSearchUserId = event.ScheduledSearchUserId

1122 -scheduledSearchUserUUIDLabel = 'ScheduledSearchUserUUID'

1123 -scheduledSearchUserUUID = event.ScheduledSearchUserUUID

1124 -

1125 -sourceProductsLabel = 'SourceProducts'

1126 -sourceProducts = event.SourceProducts

1127 -sourceVendorsLabel = 'SourceVendors'

1128 -sourceVendors = event.SourceVendors

1129 -dataDomainsLabel = 'DataDomains'

1130 -dataDomains = event.DataDomains

1131 -ipv4AddressesLabel = 'IPv4Addresses'

1132 -ipv4Addresses = event.IPv4Addresses

1133 -ipv6AddressesLabel = 'IPv6Addresses'

1134 -ipv6Addresses = event.IPv6Addresses

1135 -hostNamesLabel = 'HostNames'

1136 -hostNames = event.HostNames

1137 -domainNamesLabel = 'DomainNames'

1138 -domainNames = event.DomainNames

1139 -emailAddressesLabel = 'EmailAddresses'

1140 -emailAddresses = event.EmailAddresses

1141 -sha256HashesLabel = 'SHA256Hashes'

1142 -sha256Hashes = event.SHA256Hashes

1143 -md5HashesLabel = 'MD5Hashes'

1144 -md5Hashes = event.MD5Hashes

1145 -usersLabel = 'Users'

1146 -users = event.Users

1147 -

1148 -cn3Label = 'Offset'

1149 -cn3 = metadata.offset

1150 -

1151 -

1152 -

1153 -[IdpDetectionSummaryEvent]

1154 -__header.0 = metadata.eventType

1155 -__header.1 = 'Identity Protection Detection Summary Event'

1156 -__header.2 = event.Severity

1157 -

1158 -cat = metadata.eventType

1159 -msg = event.DetectDescription

1160 -rt = metadata.eventCreationTime

1161 -tactic = event.Tactic

1162 -technique = event.Technique

1163 -

1164 -targetServiceAccessIdentifierLabel = 'TargetServiceAccessIdentifier'

1165 -targetServiceAccessIdentifier = event.TargetServiceAccessIdentifier

1166 -targetEndpointSensorIdLabel = 'TargetEndpointSensorId'

1167 -targetEndpointSensorId = event.TargetEndpointSensorId

1168 -targetEndpointHostNameLabel = 'TargetEndpointHostName'

1169 -targetEndpointHostName = event.TargetEndpointHostName

1170 -targetEndpointAccountObjectSidLabel = 'TargetEndpointAccountObjectSid'

1171 -targetEndpointAccountObjectSid = event.TargetEndpointAccountObjectSid

1172 -targetEndpointAccountObjectGuidLabel = 'TargetEndpointAccountObjectGuid'

1173 -targetEndpointAccountObjectGuid = event.TargetEndpointAccountObjectGuid

1174 -targetAccountUpnLabel = 'TargetAccountUpn'

1175 -targetAccountUpn = event.TargetAccountUpn

1176 -targetAccountObjectSidLabel = 'TargetAccountObjectSid'

1177 -targetAccountObjectSid = event.TargetAccountObjectSid

1178 -targetAccountNameLabel = 'TargetAccountName'

1179 -targetAccountName = event.TargetAccountName

1180 -targetAccountDomainLabel = 'TargetAccountDomain'

1181 -targetAccountDomain = event.TargetAccountDomain

1182 -suspiciousMachineAccountAlterationTypeLabel = 'SuspiciousMachineAccountAlterationType'

1183 -suspiciousMachineAccountAlterationType = event.SuspiciousMachineAccountAlterationType

1184 -startTimeLabel = 'StartTime'

1185 -startTime = event.StartTime

1186 -ssoApplicationIdentifierLabel = 'SsoApplicationIdentifier'

1187 -ssoApplicationIdentifier = event.SsoApplicationIdentifier

1188 -sourceEndpointSensorIdLabel = 'SourceEndpointSensorId'

1189 -sourceEndpointSensorId = event.SourceEndpointSensorId

1190 -sourceEndpointIpReputationLabel = 'SourceEndpointIpReputation'

1191 -sourceEndpointIpReputation = event.SourceEndpointIpReputation

1192 -sourceEndpointIpAddressLabel = 'SourceEndpointIpAddress'

1193 -sourceEndpointIpAddress = event.SourceEndpointIpAddress

1194 -sourceEndpointHostNameLabel = 'SourceEndpointHostName'

1195 -sourceEndpointHostName = event.SourceEndpointHostName

1196 -sourceEndpointAccountObjectSidLabel = 'SourceEndpointAccountObjectGuid'

1197 -sourceEndpointAccountObjectSid = event.SourceEndpointAccountObjectGuid

1198 -sourceEndpointAccountObjectSidLabel = 'SourceEndpointAccountObjectSid'

1199 -sourceEndpointAccountObjectSid = event.SourceEndpointAccountObjectSid

1200 -sourceAccountUpnLabel = 'SourceAccountUpn'

1201 -sourceAccountUpn = event.SourceAccountUpn

1202 -sourceAccountObjectSidLabel = 'SourceAccountObjectSid'

1203 -sourceAccountObjectSid = event.SourceAccountObjectSid

1204 -sourceAccountNameLabel = 'SourceAccountName'

1205 -sourceAccountName = event.SourceAccountName

1206 -sourceAccountDomainLabel = 'SourceAccountDomain'

1207 -sourceAccountDomain = event.SourceAccountDomain

1208 -severityNameLabel = 'SeverityName'

1209 -severityName = event.SeverityName

1210 -rpcOpClassificationLabel = 'RpcOpClassification'

1211 -rpcOpClassification = event.RpcOpClassification

1212 -protocolAnomalyClassificationLabel = 'ProtocolAnomalyClassification'

1213 -protocolAnomalyClassification = event.ProtocolAnomalyClassification

1214 -previousPrivilegesLabel = 'PreviousPrivileges'

1215 -previousPrivileges = event.PreviousPrivileges

1216 -precedingActivityTimeStampLabel = 'PrecedingActivityTimeStamp'

1217 -precedingActivityTimeStamp = event.PrecedingActivityTimeStamp

1218 -patternIdLabel = 'PatternId'

1219 -patternId = event.PatternId

1220 -objectiveLabel = 'Objective'

1221 -objective = event.Objective

1222 -mostRecentActivityTimeStampLabel = 'MostRecentActivityTimeStamp'

1223 -mostRecentActivityTimeStamp = event.MostRecentActivityTimeStamp

1224 -locationCountryCodeLabel = 'LocationCountryCode'

1225 -locationCountryCode = event.LocationCountryCode

1226 -ldapSearchQueryAttackLabel = 'LdapSearchQueryAttack'

1227 -ldapSearchQueryAttack = event.LdapSearchQueryAttack

1228 -idpPolicyRuleTriggerLabel = 'IdpPolicyRuleTrigger'

1229 -idpPolicyRuleTrigger = event.IdpPolicyRuleTrigger

1230 -idpPolicyRuleNameLabel = 'IdpPolicyRuleName'

1231 -idpPolicyRuleName = event.IdpPolicyRuleName

1232 -idpPolicyRuleActionLabel = 'IdpPolicyRuleAction'

1233 -idpPolicyRuleAction = event.IdpPolicyRuleAction

1234 -falconHostLinkLabel = 'FalconHostLink'

1235 -falconHostLink = event.FalconHostLink

1236 -endTimeLabel = 'EndTime'

1237 -endTime = event.EndTime

1238 -detectNameLabel = 'DetectName'

1239 -detectName = event.DetectName

1240 -detectIdLabel = 'DetectId'

1241 -detectId = event.DetectId

1242 -contextTimeStampLabel = 'ContextTimeStamp'

1243 -contextTimeStamp = event.ContextTimeStamp

1244 -attemptOutcomeLabel = 'AttemptOutcome'

1245 -attemptOutcome = event.AttemptOutcome

1246 -anomalousTicketContentClassificationLabel = 'AnomalousTicketContentClassification'

1247 -anomalousTicketContentClassification = event.AnomalousTicketContentClassification

1248 -additionalSsoApplicationIdentifierLabel = 'AdditionalSsoApplicationIdentifier'

1249 -additionalSsoApplicationIdentifier = event.AdditionalSsoApplicationIdentifier

1250 -additionalLocationCountryCodeLabel = 'AdditionalLocationCountryCode'

1251 -additionalLocationCountryCode = event.AdditionalLocationCountryCode

1252 -additionalEndpointSensorIdLabel = 'AdditionalEndpointSensorId'

1253 -additionalEndpointSensorId = event.AdditionalEndpointSensorId

1254 -additionalEndpointIpAddressLabel = 'AdditionalEndpointIpAddress'

1255 -additionalEndpointIpAddress = event.AdditionalEndpointIpAddress

1256 -additionalEndpointHostNameLabel = 'AdditionalEndpointHostName'

1257 -additionalEndpointHostName = event.AdditionalEndpointHostName

1258 -additionalEndpointAccountObjectSidLabel = 'AdditionalEndpointAccountObjectSid'

1259 -additionalEndpointAccountObjectSid = event.AdditionalEndpointAccountObjectSid

1260 -additionalEndpointAccountObjectGuidLabel = 'AdditionalEndpointAccountObjectGuid'

1261 -additionalEndpointAccountObjectGuid = event.AdditionalEndpointAccountObjectGuid

1262 -additionalActivityIdLabel = 'AdditionalActivityId'

1263 -additionalActivityId = event.AdditionalActivityId

1264 -additionalAccountUpnLabel = 'AdditionalAccountUpn'

1265 -additionalAccountUpn = event.AdditionalAccountUpn

1266 -additionalAccountObjectSidLabel = 'AdditionalAccountObjectSid'

1267 -additionalAccountObjectSid = event.AdditionalAccountObjectSid

1268 -additionalAccountNameLabel = 'AdditionalAccountName'

1269 -additionalAccountName = event.AdditionalAccountName

1270 -additionalAccountDomainLabel = 'AdditionalAccountDomain'

1271 -additionalAccountDomain = event.AdditionalAccountDomain

1272 -addedPrivilegeLabel = 'AddedPrivilege'

1273 -addedPrivilege = event.AddedPrivilege

1274 -activityIdLabel = 'ActivityId'

1275 -activityId = event.ActivityId

1276 -accountCreationTimeStampLabel = 'AccountCreationTimeStamp'

1277 -accountCreationTimeStamp = event.AccountCreationTimeStamp

1278 -

1279 -cn3Label = 'Offset'

1280 -cn3 = metadata.offset

chore: Remove unused docker-compose file for SOC Fortress (#208)