update: add new fields in appxdeployment-server service

Author: swachchhanda000

sigma/validators/sigmahq/sigmahq_data.py

@@ -870,7 +870,7 @@
     ): "zeek_",
 }
 
-taxonomy_version: str = "20251103"
+taxonomy_version: str = "20251117"
 ref_sigmahq_fieldsname: Dict[SigmaLogSource, List[str]] = {
     SigmaLogSource(
         category=None,
@@ -2115,15 +2115,33 @@
         "Channel",
         "Computer",
         "DeploymentOperation",
+        "DeploymentOptions",
         "ErrorCode",
         "EventID",
+        "ExternalLocation",
         "FilePath",
+        "Flags",
+        "FlagsHigh",
+        "HasFullTrust",
+        "HasWin32alacarte",
+        "IsCentennial",
+        "IsInRelatedSet",
+        "IsOptional",
+        "IsPackageEncrypted",
+        "IsPackageUsingBDC",
+        "IsStreamingPackage",
+        "MainPackageFamilyName",
+        "MountPoint",
         "PackageDisplayName",
+        "PackageFlags",
+        "PackageFlags2",
         "PackageFullName",
         "PackageSourceUri",
+        "PackageType",
         "Path",
-        "Provider_Name",
-        "Security_UserID",
+        "StorageId",
+        "SystemVolume",
+        "TargetPlatform",
     ],
     SigmaLogSource(
         category=None,
@@ -2132,16 +2150,7 @@
         definition=None,
         source=None,
         custom_attributes=None,
-    ): [
-        "Channel",
-        "Computer",
-        "EventID",
-        "Flags",
-        "HasFullTrust",
-        "Provider_Name",
-        "Security_UserID",
-        "subjectName",
-    ],
+    ): ["Channel", "Computer", "EventID", "Provider_Name", "Security_UserID", "subjectName"],
     SigmaLogSource(
         category=None,
         product="windows",

tools/sigmahq_taxonomy.json

@@ -1,6 +1,6 @@
 {
     "title": "Sigma taxonomy",
-    "version": "20251103",
+    "version": "20251117",
     "taxonomy": {
         "aws_none_cloudtrail": {
             "logsource": {
@@ -1741,15 +1741,33 @@
                     "Channel",
                     "Computer",
                     "DeploymentOperation",
+                    "DeploymentOptions",
                     "ErrorCode",
                     "EventID",
+                    "ExternalLocation",
                     "FilePath",
+                    "Flags",
+                    "FlagsHigh",
+                    "HasFullTrust",
+                    "HasWin32alacarte",
+                    "IsCentennial",
+                    "IsInRelatedSet",
+                    "IsOptional",
+                    "IsPackageEncrypted",
+                    "IsPackageUsingBDC",
+                    "IsStreamingPackage",
+                    "MainPackageFamilyName",
+                    "MountPoint",
                     "PackageDisplayName",
+                    "PackageFlags",
+                    "PackageFlags2",
                     "PackageFullName",
                     "PackageSourceUri",
+                    "PackageType",
                     "Path",
-                    "Provider_Name",
-                    "Security_UserID"
+                    "StorageId",
+                    "SystemVolume",
+                    "TargetPlatform"
                 ],
                 "custom": [],
                 "redundant": []
@@ -1770,9 +1788,7 @@
                     "EventID",
                     "Provider_Name",
                     "Security_UserID",
-                    "subjectName",
-                    "Flags",
-                    "HasFullTrust"
+                    "subjectName"
                 ],
                 "custom": [],
                 "redundant": []