security_content/data_sources/windows_event_log_defender_1134.yml at 2b6d541b4c179dc3fc0dbabcb420fb98ba1d5f88 · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
name: Windows Event Log Defender 1134
id: 26abac7d-d026-44e9-b1a3-13e3e11b232d
version: 3
creation_date: '2025-02-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
description: Data source object for Windows Event Log Defender 1134
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
separator: EventCode
supported_TA:
    - name: Splunk Add-on for Microsoft Windows
      url: https://splunkbase.splunk.com/app/742
      version: 10.0.1
fields:
    - ActivityID
    - CategoryString
    - Channel
    - Computer
    - Detection_Time
    - Engine_Version
    - EventCode
    - EventData_Xml
    - EventID
    - EventRecordID
    - Guid
    - ID
    - Image_File_Name
    - Inhertiance_Flags
    - Involved_File
    - Keywords
    - Level
    - Message
    - Name
    - Opcode
    - Parent_Commandline
    - Path
    - ProcessID
    - Process_Name
    - Product_Name
    - Product_Version
    - RecordNumber
    - RenderingInfo_Xml
    - RuleType
    - Security_intelligence_Version
    - SourceName
    - SubStatus
    - SystemTime
    - System_Props_Xml
    - Target_Commandline
    - Task
    - TaskCategory
    - ThreadID
    - Unused
    - User
    - UserID
    - Version
    - action
    - category
    - dvc
    - dvc_nt_host
    - event_id
    - eventtype
    - host
    - id
    - index
    - linecount
    - name
    - parent_process
    - process_name
    - punct
    - result
    - service
    - service_id
    - service_name
    - severity
    - severity_id
    - signature
    - signature_id
    - source
    - sourcetype
    - splunk_server
    - splunk_server_group
    - subject
    - tag
    - tag::action
    - tag::eventtype
    - timestamp
    - user_group_id
    - user_id
    - vendor_product
    - _bkt
    - _cd
    - _eventtype_color
    - _indextime
    - _pre_msg
    - _raw
    - _serial
    - _si
    - _sourcetype
    - _time
example_log: ''