Skip to content

eventlog-entry.md

Latest commit

 

History

History
30 lines (21 loc) · 848 Bytes

eventlog-entry.md

File metadata and controls

30 lines (21 loc) · 848 Bytes
Raw

eventlog entry

Schema ID: https://github.com/NextronSystems/jsonlog/thorlog/v3/windows-eventlog-entry | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: WindowsEventlogEntry

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
ENTRY entry object (string) ✅
TYPE type string ✅ eventlog entry

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "eventlog entry"

detection:
    selection:
        TYPE: 'eventlog entry'
    condition: selection

level: medium