Skip to content

knowledgedb-entry.md

Latest commit

 

History

History
34 lines (25 loc) · 1.03 KB

knowledgedb-entry.md

File metadata and controls

34 lines (25 loc) · 1.03 KB
Raw

KnowledgeDB entry

Schema ID: https://github.com/NextronSystems/jsonlog/thorlog/v3/knowledge-db-entry | JSON Schema: https://json-schema.org/draft/2020-12/schema | Definition: KnowledgeDBEntry

Fields

Field names are shown in UPPERCASE as used in Sigma rules. The lowercase JSON name is shown in parentheses for reference.

Sigma Field JSON Name Type Required Description Example Values
CREATED created string (date-time) ✅
DURATION duration integer ✅
ENTRY entry string ✅
PRIMARY_KEY primary_key integer ✅
STARTED started string (date-time) ✅
TYPE type string ✅

No nested fields in this type.

Sigma Rule Template

logsource:
    product: THOR
    service: "KnowledgeDB entry"

detection:
    selection:
        ENTRY|contains: 'suspicious_string'
    condition: selection

level: medium