Raccogli i log di Network Policy Server di Windows

Supportata in:

Google SecOps SIEM

Nota: questa funzionalità è coperta dai Termini delle Offerte pre-GA dei Termini di servizio specifici di Google Security Operations. Le funzionalità pre-GA potrebbero avere supporto limitato e le modifiche alle funzionalità pre-GA potrebbero non essere compatibili con altre versioni pre-GA. Per saperne di più, consulta le linee guida per i servizi di assistenza tecnica di Google SecOps e i Termini di servizio specifici di Google SecOps.
Se questa funzionalità non è visibile nel tuo ambiente, consulta Gestisci le funzionalità in anteprima o contatta l'amministratore di sistema.

Questo documento spiega come importare i log di Windows Network Policy Server (NPS) in Google Security Operations utilizzando Bindplane.

Windows Network Policy Server (NPS) è un server RADIUS Microsoft che genera log di autenticazione, autorizzazione e accounting per controllo dell'accesso alla rete. L'agente Bindplane raccoglie i file di log di accounting NPS e i log eventi esportati direttamente dal file system locale.

Prima di iniziare

Assicurati di soddisfare i seguenti prerequisiti:

• Un'istanza Google SecOps
• Windows Server 2016 o versioni successive con supporto del servizio observiq-otel-collector
• Se l'esecuzione avviene dietro un proxy, assicurati che le porte del firewall siano aperte in base ai requisiti dell'agente Bindplane
• Accesso amministrativo a Windows Server con il ruolo Network Policy Server installato

Ottieni le credenziali di Google SecOps per l'agente Bindplane

Per autenticare l'agente Bindplane in Google SecOps, scegli uno dei seguenti metodi:

• Nuovi deployment: utilizza l'API Chronicle (opzione 1).
• Deployment legacy: continua a utilizzare il file di autenticazione dell'acquisizione (Opzione 2) fino alla dismissione dell'API Ingestion il 20 luglio 2027.

Opzione 1: crea un account di servizio per l'API Chronicle (consigliata)

1. Accedi alla consoleGoogle Cloud e seleziona il progetto Google Cloud collegato alla tua istanza Google SecOps.
2. Vai a IAM e amministrazione > Service account.
3. Fai clic su Crea service account.
4. Fornisci i seguenti dettagli di configurazione:
   • Nome service account: inserisci un nome per l'account (ad esempio, bindplane-ingest).
   • Descrizione del service account: inserisci una descrizione (ad esempio, Bindplane agent log ingestion).
5. Fai clic su Crea e continua.
6. Nella sezione Concedi a questo account di servizio l'accesso al progetto, fai clic su Seleziona un ruolo e seleziona Editor Chronicle.
7. Fai clic su Continua e poi su Fine.
8. Fai clic sul account di servizio che hai creato, quindi vai alla scheda Chiavi.
9. Fai clic su Aggiungi chiave > Crea nuova chiave.
10. Seleziona JSON e fai clic su Crea. Il file della chiave viene scaricato sul tuo computer.
11. Salva il file della chiave come ingestion-auth.json nella directory del raccoglitore Bindplane (/opt/observiq-otel-collector/ingestion-auth.json su Linux o C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json su Windows) o aggiorna creds_file_path in config.yaml in modo che corrisponda al percorso in cui lo salvi.
12. Vai a IAM e amministrazione > Impostazioni e copia il numero di progetto. Ti servirà per la configurazione dell'esportatore.

Nota: la chiave JSON è una credenziale. Limita l'accesso al file sull'host Bindplane e ruota la chiave in base alle policy della tua organizzazione.

Opzione 2: scarica il file di autenticazione dell'acquisizione (legacy)

1. Accedi alla console Google SecOps.
2. Vai a Impostazioni SIEM > Agenti di raccolta.
3. Scarica il file di autenticazione dell'acquisizione.
4. Salva il file in modo sicuro sul sistema in cui verrà installato l'agente Bindplane.

Nota: questo file autentica l'agente nell'API Ingestion legacy (malachiteingestion-pa.googleapis.com), il cui fine del ciclo di vita è previsto da Google per il 20 luglio 2027. Pianifica di passare all'opzione 1 prima di questa data.

Ottieni l'ID cliente Google SecOps

1. Accedi alla console Google SecOps.
2. Vai a Impostazioni SIEM > Profilo.

3. Copia e salva l'ID cliente dalla sezione Dettagli organizzazione.

   Nota: l'ID cliente è necessario per configurare l'esportatore dell'agente Bindplane.

Installa l'agente Bindplane

Installa l'agente Bindplane sul sistema operativo Windows seguendo queste istruzioni.

Installazione di Windows

1. Apri Prompt dei comandi o PowerShell come amministratore.

2. Esegui questo comando:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

3. Attendi il completamento dell'installazione.

4. Verifica l'installazione eseguendo:

   sc query observiq-otel-collector
   

Il servizio dovrebbe essere visualizzato come RUNNING.

Risorse aggiuntive per l'installazione

Per ulteriori opzioni di installazione e risoluzione dei problemi, consulta la guida all'installazione dell'agente Bindplane.

Nota: la configurazione dell'esportatore dell'API Chronicle richiede Bindplane Collector v1.106.0 o versioni successive. I comandi precedenti installano l'ultima release. Se stai aggiornando un'installazione esistente, esegui l'upgrade dell'agente di raccolta prima di modificare la configurazione.

Configura l'agente Bindplane per importare i log e inviarli a Google SecOps

Individua il file di configurazione

• Windows:

  notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"
  

Modifica il file di configurazione

• Sostituisci l'intero contenuto di config.yaml con la seguente configurazione:

  receivers:
    filelog:
      include:
        - C:\Windows\System32\LogFiles\IN*.log
      start_at: beginning
  
  exporters:
    chronicle/windows_nps:
      protocol: https
      # Region of your instance, for example us, europe, asia-southeast1
      location: <LOCATION>
      # Project number of the Google Cloud project linked to the instance
      project: '<PROJECT_NUMBER>'
      compression: gzip
      creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
      customer_id: '<customer_id>'
      endpoint: chronicle.googleapis.com
      log_type: WINDOWS_NET_POLICY_SERVER
      raw_log_field: body
      ingestion_labels:
        env: production
  
  service:
    pipelines:
      logs/nps_to_chronicle:
        receivers:
          - filelog
        exporters:
          - chronicle/windows_nps
  

Parametri di configurazione

Sostituisci i seguenti segnaposto:

• Configurazione del destinatario:

  • filelog: il tipo di receiver per la raccolta dei file di log dal disco
  • include: elenco dei percorsi dei file da monitorare. Imposta questo valore sulla posizione dei file di log di contabilità NPS (ad esempio C:\Windows\System32\LogFiles\IN*.log) o dei log eventi esportati (ad esempio C:\Logs\nps\*.evtx).
  • start_at: impostato su beginning per leggere i log esistenti o su end per leggere solo le nuove voci

• Configurazione dell'esportatore:

  • windows_nps: nome descrittivo dell'esportatore
  • creds_file_path: percorso completo del file della chiave JSON del account di servizio (opzione 1):
    • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
  • <customer_id>: l'ID cliente del passaggio precedente
  • location: sostituisci <LOCATION> con la regione della tua istanza Google SecOps (ad esempio us, europe o asia-southeast1). L'esportatore aggiunge chronicle.googleapis.com come prefisso a questo valore. Per l'elenco completo, consulta Endpoint regionali.
  • project: sostituisci <PROJECT_NUMBER> con il numero di progetto da IAM e amministrazione > Impostazioni.
  • endpoint: mantieni l'impostazione chronicle.googleapis.com.
  • WINDOWS_NET_POLICY_SERVER: il tipo di log esattamente come appare in Chronicle
  • ingestion_labels: Etichette facoltative in formato YAML (ad esempio, env: production)

• Configurazione della pipeline:

  • nps_to_chronicle: nome descrittivo della pipeline

Esportatore API di importazione legacy

• Se utilizzi il file di autenticazione dell'importazione dell'opzione 2, sostituisci il blocco exporters con il seguente. Imposta creds_file_path sul percorso del file di autenticazione dell'acquisizione e, se l'istanza si trova al di fuori degli Stati Uniti, sostituisci malachiteingestion-pa.googleapis.com con il tuo endpoint regionale (ad esempio, europe-malachiteingestion-pa.googleapis.com).

  exporters:
    chronicle/windows_nps:
      compression: gzip
      creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
      customer_id: '<customer_id>'
      endpoint: malachiteingestion-pa.googleapis.com
      log_type: WINDOWS_NET_POLICY_SERVER
      raw_log_field: body
      ingestion_labels:
        env: production
  

Nota: questo strumento di esportazione smetterà di funzionare quando l'API Ingestion non sarà più disponibile il 20 luglio 2027.

Salva il file di configurazione

• Dopo la modifica, salva il file:
  • Windows: fai clic su File > Salva.

Riavvia l'agente Bindplane per applicare le modifiche

Per riavviare l'agente Bindplane in Windows:

1. Scegli una delle seguenti opzioni:

   • Prompt dei comandi o PowerShell come amministratore:

   net stop observiq-otel-collector && net start observiq-otel-collector
   

   • Console dei servizi:
     1. Premi Win+R, digita services.msc e premi Invio.
     2. Individua observIQ OpenTelemetry Collector.
     3. Fai clic con il tasto destro del mouse e seleziona Riavvia.

2. Verifica che il servizio sia in esecuzione:

   sc query observiq-otel-collector
   

3. Controlla i log per verificare la presenza di errori:

   type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
   

Configurare l'esportazione dei log NPS di Windows

Windows NPS genera due tipi di log: i file di log di accounting NPS (formato IAS) archiviati su disco e gli eventi relativi a NPS nel log eventi di Windows. Puoi raccogliere uno o entrambi i tipi di dati.

Opzione 1: raccogli i file di log di contabilità NPS (impostazione predefinita)

I file di log di contabilità NPS vengono archiviati per impostazione predefinita in C:\Windows\System32\LogFiles\` with filenames starting withIN(for example,IN2301.log.

1. Apri Server Manager > Network Policy Server.
2. Vai a Contabilità > Configura contabilità.
3. Verifica che l'opzione Log to a text file (local) (Registra in un file di testo (locale)) sia abilitata.
4. Prendi nota della directory dei file di log (impostazione predefinita: %systemroot%\system32\LogFiles).

5. Assicurati che il percorso include dell'agente Bindplane in config.yaml corrisponda alla posizione del file di log.

   Nota: i log di accounting NPS utilizzano il formato IAS o DTS. Il percorso include predefinito C:\Windows\System32\LogFiles\IN*.log corrisponde alla convenzione di denominazione standard dei log NPS.

Opzione 2: esporta i log degli eventi NPS

Gli eventi di autenticazione NPS (ID evento 6272-6280) vengono registrati nel log eventi di sicurezza di Windows.

1. Crea una directory in cui archiviare i file di log esportati:

   mkdir C:\Logs\nps
   

2. Esporta gli eventi di sicurezza relativi a NPS utilizzando wevtutil:

   wevtutil epl "Security" /q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID>=6272 and EventID<=6280)]]" C:\Logs\nps\nps-security.evtx
   

3. (Facoltativo) Pianifica esportazioni regolari utilizzando l'Utilità di pianificazione di Windows:

   $action = New-ScheduledTaskAction -Execute "wevtutil" -Argument 'epl "Security" /q:"*[System[Provider[@Name=''Microsoft-Windows-Security-Auditing''] and (EventID>=6272 and EventID<=6280)]]" C:\Logs\nps\nps-security.evtx /ow:true'
   $trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Hours 1) -Once -At (Get-Date)
   Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "ExportNPSLogs" -Description "Export Windows NPS logs for Bindplane agent"
   

4. Aggiorna il percorso dell'agente Bindplane include in config.yaml in modo che corrisponda a:

   include:
     - C:\Logs\nps\*.evtx
   

   Nota: il account di servizio dell'agente Bindplane deve disporre dell'accesso in lettura alla directory dei log.

Tabella di mappatura UDM

Campo log	mappatura UDM	Logica
EventID	about	Valori mappati (5 in totale, ad es. 4800, 4801 → session_about, 5137, 5141 → `token_about…)
SourceName	about	Valori mappati (6 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
about_host	about	Unita
about_token	about	Unita
jsonPayload_about	about	Unita
session_about	about	Unita
token_about	about	Unita
fqdn	about.administrative_domain	Mappata direttamente
param1	about.file.full_path	Mappata direttamente
DCDNSName	about.hostname	Mappata direttamente
LocalEMPrincipalName	about.hostname	Mappata direttamente
EventID	about.ip	Mappatura: 4908, 4964 → address
SourceName	about.ip	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
address	about.ip	Unita
EventID	about.labels	Valori mappati (15 in totale, ad es. 4625, 4776, 4794 → keywords_label, 4774, 4775 → `map…)
ImpersonationLevel_label	about.labels	Unita
RestrictedAdminMode_label	about.labels	Unita
SourceName	about.labels	Valori mappati (23 in totale, ad esempio `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec…)
additional_data_label	about.labels	Unita
audit_policy_changes_label	about.labels	Unita
ca_label	about.labels	Unita
category_label	about.labels	Unita
keywords_label	about.labels	Unita
labels0	about.labels	Unita
labels101	about.labels	Unita
labels202	about.labels	Unita
labels401	about.labels	Unita
level_label	about.labels	Unita
mapped_name_label	about.labels	Unita
mapping_by_label	about.labels	Unita
mapping_channel	about.labels	Unita
mapping_opcode	about.labels	Unita
system_keyword_label	about.labels	Unita
task_label	about.labels	Unita
thread_id_label	about.labels	Unita
value_is_near_0	about.labels	Mappato: true → labels101
value_is_near_1	about.labels	Mappatura: true → labels202
version_label	about.labels	Unita
param3	about.registry.registry_key	Mappata direttamente
EventID	about.resource.attribute.labels	Mappato: 4908, 4964 → label_for_resource_attribute
SourceName	about.resource.attribute.labels	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `l…
label_for_resource_attribute	about.resource.attribute.labels	Unita
ProviderName	about.resource.name	Mappata direttamente
ProviderKey	about.resource.product_object_id	Mappata direttamente
temp	about.resource.product_object_id	Mappata direttamente
Url	about.url	Mappata direttamente
cacheDenyUrls	about.url	Mappato direttamente
EventID	about.user.attribute.labels	Mappato: 4765, 4766 → about_user_label, 4908, 4964 → about_user_label, ` 4908, …
SourceName	about.user.attribute.labels	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
about_user_label	about.user.attribute.labels	Unita
label_for_user_attribute	about.user.attribute.labels	Unita
SourceUserName	about.user.userid	Mappata direttamente
about_user_windows_sid	about.user.windows_sid	Mappata direttamente
EventID	additiona.fields	Mappato: 4908, 4964 → function_label, 4104, 4105 → function_label
SourceName	additiona.fields	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `f…
function_label	additiona.fields	Unita
AccountAvailableKeys_label	additional.fields	Unita
AccountSupportedEncryptionTypes_label	additional.fields	Unita
ActiveProfile_label	additional.fields	Unita
AdvancedOptions_label	additional.fields	Unita
AppCorrelationID_label	additional.fields	Unita
AppId_label	additional.fields	Unita
AttributeSyntaxOID_label	additional.fields	Unita
AuditResult_label	additional.fields	Unita
AuditType_label	additional.fields	Unita
AuthProtocol_label	additional.fields	Unita
Binding_type_label	additional.fields	Unita
Cache_Control_label	additional.fields	Unita
ClaimsProvider_label	additional.fields	Unita
ClientAdvertizedEncryptionTypes_label	additional.fields	Unita
ClientCreationTime_label	additional.fields	Unita
CommandName_label	additional.fields	Unita
CommandType_label	additional.fields	Unita
ConfigAccessPolicy_label	additional.fields	Unita
ConfiguredNames_label	additional.fields	Unita
Connection_label	additional.fields	Unita
Content_Type_label	additional.fields	Unita
DCAvailableKeys_label	additional.fields	Unita
DCSupportedEncryptionTypes_label	additional.fields	Unita
DN_label	additional.fields	Unita
DSType_label	additional.fields	Unita
DetailSequence_label	additional.fields	Unita
DetailTotal_label	additional.fields	Unita
Details_label	additional.fields	Unita
DeviceAuth_label	additional.fields	Unita
DeviceId_label	additional.fields	Unita
DirectiveName_label	additional.fields	Unita
DisableIntegrityChecks_label	additional.fields	Unita
Endpoint_label	additional.fields	Unita
EngineVersion_label	additional.fields	Unita
ErrorCode_label	additional.fields	Unita
EventID	additional.fields	Valori mappati (420 totali, ad es. 4719 → additional_field_task_category, ` 4692, 4693, 4694… )
FQDN_label	additional.fields	Unita
FWLink_label	additional.fields	Unita
FailureType_label	additional.fields	Unita
FaultingApplicationPath_label	additional.fields	Unita
FaultingModulePath_label	additional.fields	Unita
FlightSigning_label	additional.fields	Unita
ForwardedIpAddress_label	additional.fields	Unita
GroupPolicyApplied_label	additional.fields	Unita
HandleId_label	additional.fields	Unita
HandleId_label_1	additional.fields	Unita
HostID_label	additional.fields	Unita
HostId_label	additional.fields	Unita
HostName_label	additional.fields	Unita
HostVersion_label	additional.fields	Unita
Host_label	additional.fields	Unita
HypervisorDebug_label	additional.fields	Unita
HypervisorLaunchType_label	additional.fields	Unita
HypervisorLoadOptions_label	additional.fields	Unita
ImpersonationLevel_label	additional.fields	Unita
IpAddress_label	additional.fields	Unita
KernelDebug_label	additional.fields	Unita
KeyLength_label	additional.fields	Unita
LmPackageName_label	additional.fields	Unita
LoadOptions_label	additional.fields	Unita
LogDroppedPacketsEnabled_label	additional.fields	Unita
LogSuccessfulConnectionsEnabled_label	additional.fields	Unita
MandatoryLabel_label	additional.fields	Unita
MessageNumber_label	additional.fields	Unita
MessageTotal_label	additional.fields	Unita
Message_label	additional.fields	Unita
MfaMethod_label	additional.fields	Unita
MfaPerformed_label	additional.fields	Unita
MulticastFlowsEnabled_label	additional.fields	Unita
NetworkIpAddress_label	additional.fields	Unita
NetworkLocation_label	additional.fields	Unita
NewEngineState_label	additional.fields	Unita
NewState_label	additional.fields	Unita
NotificationInterval_label	additional.fields	Unita
OAuthClientId_label	additional.fields	Unita
OAuthGrant_label	additional.fields	Unita
ObjectServer_label	additional.fields	Unita
OpCorrelationID_label	additional.fields	Unita
OperationMode_label	additional.fields	Unita
OperationType_label	additional.fields	Unita
Operation_label	additional.fields	Unita
PacketType_label	additional.fields	Unita
Payload_label	additional.fields	Unita
PipelineID_label	additional.fields	Unita
PipelineId_label	additional.fields	Unita
PreAuthEncryptionType_label	additional.fields	Unita
PreviousEngineState_label	additional.fields	Unita
PrimaryAuth_label	additional.fields	Unita
Product_Name_label	additional.fields	Unita
Product_Version_label	additional.fields	Unita
Profile_label	additional.fields	Unita
Profiles_label	additional.fields	Unita
ProxyIpAddress_label	additional.fields	Unita
ProxyServer_label	additional.fields	Unita
RelyingParty_label	additional.fields	Unita
RemoteAdminEnabled_label	additional.fields	Unita
RemoteEventLogging_label	additional.fields	Unita
RequestTicketHash_label	additional.fields	Unita
ResourceManager_label	additional.fields	Unita
ResponseTicketHash_label	additional.fields	Unita
RestrictedAdminMode_label	additional.fields	Unita
ReturnCode_label	additional.fields	Unita
RunspaceID_label	additional.fields	Unita
RunspaceId_label	additional.fields	Unita
SequenceNumber_label	additional.fields	Unita
Server_label	additional.fields	Unita
ServiceAvailableKeys_label	additional.fields	Unita
ServiceStartType_label	additional.fields	Unita
ServiceSupportedEncryptionTypes_label	additional.fields	Unita
ServiceType_label	additional.fields	Unita
SessionKeyEncryptionType_label	additional.fields	Unita
SkuId_label	additional.fields	Unita
SourceName	additional.fields	Valori mappati (564 in totale, ad esempio"Microsoft-Windows-Security-Auditing", "Microsoft Windows se… )
SsoBindingValidationLevel_label	additional.fields	Unita
StartType_label	additional.fields	Unita
SubjectLogonId_label	additional.fields	Unita
THostName_label	additional.fields	Unita
TargetLinkedLogonId_label	additional.fields	Unita
TestSigning_label	additional.fields	Unita
Ticket_type_label	additional.fields	Unita
TokenBindingProvidedId_label	additional.fields	Unita
TokenBindingReferredId_label	additional.fields	Unita
TokenElevationType_label	additional.fields	Unita
TransactionId_label	additional.fields	Unita
TransmittedServices_label	additional.fields	Unita
Trigger_label	additional.fields	Unita
UserAgentString_label	additional.fields	Unita
UserId_label	additional.fields	Unita
VirtualAccount_label	additional.fields	Unita
VsmLaunchType_label	additional.fields	Unita
X_MS_Endpoint_Absolute_Path_label1	additional.fields	Unita
acc_mask_label	additional.fields	Unita
access_mask_label	additional.fields	Unita
account_name_label	additional.fields	Unita
acct_authentic	additional.fields	Unita
acct_input_octets	additional.fields	Unita
acct_input_packets	additional.fields	Unita
acct_link_count	additional.fields	Unita
acct_output_octets	additional.fields	Unita
acct_output_packets	additional.fields	Unita
acct_session_time	additional.fields	Unita
acct_status_type	additional.fields	Unita
activity_id_label	additional.fields	Unita
add_label	additional.fields	Unita
add_labels202	additional.fields	Unita
addition_ObjectClass	additional.fields	Unita
additional_ClientAdvertizedEncryptionTypes	additional.fields	Unita
additional_ParameterBinding_Add-Type	additional.fields	Unita
additional_Requested_Operation_Desired_Access	additional.fields	Unita
additional_TargetDomainName	additional.fields	Unita
additional_The_SSPI_client_process_is_SYSTEM_PID	additional.fields	Unita
additional_access_mask	additional.fields	Unita
additional_data_label	additional.fields	Unita
additional_field	additional.fields	Unita
additional_field_subject_domain_name	additional.fields	Unita
additional_field_task_category	additional.fields	Unita
additional_information_label	additional.fields	Unita
additional_member_name	additional.fields	Unita
additional_user_data	additional.fields	Unita
attribute_label	additional.fields	Unita
attribute_ldap_display_name_label	additional.fields	Unita
attribute_selection_label	additional.fields	Unita
attributes_preventing_optimization_label	additional.fields	Unita
audit_policy_changes_label	additional.fields	Unita
audit_schema_version_label	additional.fields	Unita
authentication_type_label	additional.fields	Unita
backup_type_label	additional.fields	Unita
ca_label	additional.fields	Unita
cab_id_label	additional.fields	Unita
caller_identity_label	additional.fields	Unita
caller_user_name_label	additional.fields	Unita
category_label	additional.fields	Unita
certificate_identity_label	additional.fields	Unita
charset_label	additional.fields	Unita
check_field_server_names	additional.fields	Unita
class	additional.fields	Unita
class_type_label	additional.fields	Unita
clean_pages_modified_label	additional.fields	Unita
client_options1_label	additional.fields	Unita
client_options_label	additional.fields	Unita
client_request_id_label	additional.fields	Unita
connect_info	additional.fields	Unita
connect_options_label	additional.fields	Unita
content_length_label	additional.fields	Unita
data_1_label	additional.fields	Unita
data_2_label	additional.fields	Unita
data_3_label	additional.fields	Unita
dirty_pages_modified_label	additional.fields	Unita
disposition_label	additional.fields	Unita
domain_label	additional.fields	Unita
environment_label	additional.fields	Unita
event_data_d_word_val_label	additional.fields	Unita
event_data_method_label	additional.fields	Unita
event_data_p10_label	additional.fields	Unita
event_data_p11_label	additional.fields	Unita
event_data_p12_label	additional.fields	Unita
event_data_p13_label	additional.fields	Unita
event_data_p14_label	additional.fields	Unita
event_data_p15_label	additional.fields	Unita
event_data_p16_label	additional.fields	Unita
event_data_p17_label	additional.fields	Unita
event_data_p18_label	additional.fields	Unita
event_data_p19_label	additional.fields	Unita
event_data_p1_label	additional.fields	Unita
event_data_p20_label	additional.fields	Unita
event_data_p21_label	additional.fields	Unita
event_data_p22_label	additional.fields	Unita
event_data_p23_label	additional.fields	Unita
event_data_p24_label	additional.fields	Unita
event_data_p25_label	additional.fields	Unita
event_data_p26_label	additional.fields	Unita
event_data_p27_label	additional.fields	Unita
event_data_p28_label	additional.fields	Unita
event_data_p29_label	additional.fields	Unita
event_data_p2_label	additional.fields	Unita
event_data_p30_label	additional.fields	Unita
event_data_p31_label	additional.fields	Unita
event_data_p32_label	additional.fields	Unita
event_data_p33_label	additional.fields	Unita
event_data_p34_label	additional.fields	Unita
event_data_p35_label	additional.fields	Unita
event_data_p36_label	additional.fields	Unita
event_data_p37_label	additional.fields	Unita
event_data_p38_label	additional.fields	Unita
event_data_p39_label	additional.fields	Unita
event_data_p3_label	additional.fields	Unita
event_data_p40_label	additional.fields	Unita
event_data_p41_label	additional.fields	Unita
event_data_p42_label	additional.fields	Unita
event_data_p43_label	additional.fields	Unita
event_data_p44_label	additional.fields	Unita
event_data_p45_label	additional.fields	Unita
event_data_p46_label	additional.fields	Unita
event_data_p47_label	additional.fields	Unita
event_data_p48_label	additional.fields	Unita
event_data_p49_label	additional.fields	Unita
event_data_p4_label	additional.fields	Unita
event_data_p50_label	additional.fields	Unita
event_data_p51_label	additional.fields	Unita
event_data_p52_label	additional.fields	Unita
event_data_p53_label	additional.fields	Unita
event_data_p54_label	additional.fields	Unita
event_data_p55_label	additional.fields	Unita
event_data_p56_label	additional.fields	Unita
event_data_p57_label	additional.fields	Unita
event_data_p58_label	additional.fields	Unita
event_data_p59_label	additional.fields	Unita
event_data_p5_label	additional.fields	Unita
event_data_p60_label	additional.fields	Unita
event_data_p61_label	additional.fields	Unita
event_data_p62_label	additional.fields	Unita
event_data_p63_label	additional.fields	Unita
event_data_p64_label	additional.fields	Unita
event_data_p65_label	additional.fields	Unita
event_data_p66_label	additional.fields	Unita
event_data_p67_label	additional.fields	Unita
event_data_p68_label	additional.fields	Unita
event_data_p69_label	additional.fields	Unita
event_data_p6_label	additional.fields	Unita
event_data_p70_label	additional.fields	Unita
event_data_p71_label	additional.fields	Unita
event_data_p72_label	additional.fields	Unita
event_data_p73_label	additional.fields	Unita
event_data_p74_label	additional.fields	Unita
event_data_p75_label	additional.fields	Unita
event_data_p76_label	additional.fields	Unita
event_data_p77_label	additional.fields	Unita
event_data_p78_label	additional.fields	Unita
event_data_p79_label	additional.fields	Unita
event_data_p7_label	additional.fields	Unita
event_data_p80_label	additional.fields	Unita
event_data_p81_label	additional.fields	Unita
event_data_p82_label	additional.fields	Unita
event_data_p83_label	additional.fields	Unita
event_data_p84_label	additional.fields	Unita
event_data_p85_label	additional.fields	Unita
event_data_p86_label	additional.fields	Unita
event_data_p87_label	additional.fields	Unita
event_data_p88_label	additional.fields	Unita
event_data_p89_label	additional.fields	Unita
event_data_p8_label	additional.fields	Unita
event_data_p90_label	additional.fields	Unita
event_data_p91_label	additional.fields	Unita
event_data_p92_label	additional.fields	Unita
event_data_p9_label	additional.fields	Unita
event_data_param1_label	additional.fields	Unita
event_data_param2_label	additional.fields	Unita
event_data_param3_label	additional.fields	Unita
event_data_param4_label	additional.fields	Unita
event_data_param5_label	additional.fields	Unita
event_data_param6_label	additional.fields	Unita
event_data_param7_label	additional.fields	Unita
event_data_processing_mode_label	additional.fields	Unita
event_data_processing_time_in_milliseconds_label	additional.fields	Unita
event_data_stage_label	additional.fields	Unita
event_data_support_info1_label	additional.fields	Unita
event_data_support_info2_label	additional.fields	Unita
event_data_thumbprint_label	additional.fields	Unita
event_id_label	additional.fields	Unita
event_in_seq_label	additional.fields	Unita
event_time_label	additional.fields	Unita
exception_info_label	additional.fields	Unita
expensive_search_operations_label	additional.fields	Unita
failure_reason_label	additional.fields	Unita
framework_version_label	additional.fields	Unita
hashed_bucket_label	additional.fields	Unita
inefficient_search_operations_label	additional.fields	Unita
install_date_label	additional.fields	Unita
is_column_permission_label	additional.fields	Unita
is_dac_label	additional.fields	Unita
keywords_label	additional.fields	Unita
label01	additional.fields	Unita
label02	additional.fields	Unita
label03	additional.fields	Unita
label461	additional.fields	Unita
label462	additional.fields	Unita
label463	additional.fields	Unita
label46561	additional.fields	Unita
label46562	additional.fields	Unita
label46563	additional.fields	Unita
label46564	additional.fields	Unita
label46565	additional.fields	Unita
label46571	additional.fields	Unita
label46572	additional.fields	Unita
label47681	additional.fields	Unita
label47682	additional.fields	Unita
label501	additional.fields	Unita
label601	additional.fields	Unita
label_for_additional_fields	additional.fields	Unita
labels0	additional.fields	Unita
labels401	additional.fields	Unita
labels46411	additional.fields	Unita
labels46412	additional.fields	Unita
labels46413	additional.fields	Unita
labels46414	additional.fields	Unita
labels46415	additional.fields	Unita
labels46416	additional.fields	Unita
labels46417	additional.fields	Unita
level_label	additional.fields	Unita
logon_guid_label	additional.fields	Unita
logon_id_label	additional.fields	Unita
mapped_name_label	additional.fields	Unita
mapping_by_label	additional.fields	Unita
mapping_channel	additional.fields	Unita
mapping_opcode	additional.fields	Unita
method	additional.fields	Unita
method_executed_label	additional.fields	Unita
namespace_label	additional.fields	Unita
nas_port_type_label	additional.fields	Unita
network_information_label	additional.fields	Unita
new_obj_dn_label	additional.fields	Unita
new_target_user_name_label	additional.fields	Unita
number_of_search_operations_label	additional.fields	Unita
object_class_label	additional.fields	Unita
object_dn_label	additional.fields	Unita
operation_type_label	additional.fields	Unita
p10_label	additional.fields	Unita
p2_label	additional.fields	Unita
p3_label	additional.fields	Unita
p4_label	additional.fields	Unita
p5_label	additional.fields	Unita
p6_label	additional.fields	Unita
p7_label	additional.fields	Unita
p8_label	additional.fields	Unita
p9_label	additional.fields	Unita
package_label	additional.fields	Unita
packet_data_size_label	additional.fields	Unita
pages_preread_from_disk_label	additional.fields	Unita
pages_read_from_disk_label	additional.fields	Unita
pages_referenced_label	additional.fields	Unita
parent_id_label	additional.fields	Unita
payload_label	additional.fields	Unita
perm_consumer_label	additional.fields	Unita
permission_bitmask_label	additional.fields	Unita
platform_label	additional.fields	Unita
pooled_connection_label	additional.fields	Unita
problem_signature_label	additional.fields	Unita
protocol_seq_label	additional.fields	Unita
proxy_dns_name_label	additional.fields	Unita
query_string_label	additional.fields	Unita
reason_code	additional.fields	Unita
reason_code_labels	additional.fields	Unita
report_id_label	additional.fields	Unita
report_status_label	additional.fields	Unita
req_id_label	additional.fields	Unita
request_detail_label	additional.fields	Unita
request_id_label	additional.fields	Unita
request_path_label	additional.fields	Unita
requester_label	additional.fields	Unita
response_detail_label	additional.fields	Unita
response_label	additional.fields	Unita
returned_entries_label	additional.fields	Unita
search_scope_label	additional.fields	Unita
search_time_ms_label	additional.fields	Unita
sequence_group_id_label	additional.fields	Unita
sequence_number_label	additional.fields	Unita
session_label	additional.fields	Unita
sidtype_label	additional.fields	Unita
source_group_label	additional.fields	Unita
source_module_label	additional.fields	Unita
span_id_label	additional.fields	Unita
stage	additional.fields	Unita
starting_node_label	additional.fields	Unita
statement_label	additional.fields	Unita
subject_key_label	additional.fields	Unita
subject_label	additional.fields	Unita
subject_logon_id_label	additional.fields	Unita
subject_logon_id_label_1	additional.fields	Unita
subject_machine_name_label	additional.fields	Unita
subject_user_name_label	additional.fields	Unita
suppress_count_label	additional.fields	Unita
suppress_label	additional.fields	Unita
system_keyword_label	additional.fields	Unita
target_label	additional.fields	Unita
target_labels	additional.fields	Unita
target_logon_id_label	additional.fields	Unita
target_relying_party_label	additional.fields	Unita
target_user_id_label	additional.fields	Unita
temp_additional_event_category	additional.fields	Unita
temp_additional_event_type	additional.fields	Unita
temp_additional_insert_id	additional.fields	Unita
temp_additional_log_name	additional.fields	Unita
temp_additional_qualifiers	additional.fields	Unita
temp_additional_time_gen	additional.fields	Unita
temp_additional_time_written	additional.fields	Unita
temp_query	additional.fields	Unita
these_files_may_be_available_here_label	additional.fields	Unita
thread_id_label	additional.fields	Unita
through_proxy_label	additional.fields	Unita
ticket_options_label	additional.fields	Unita
time_interval_hours_label	additional.fields	Unita
token_@_xmlns_	additional.fields	Unita
token_subject_logon_id	additional.fields	Unita
trace_id_label	additional.fields	Unita
transaction_id_label	additional.fields	Unita
uf_type_label	additional.fields	Unita
uf_version_label	additional.fields	Unita
used_indexes_label	additional.fields	Unita
user_data_0x8000003F_@_xmlns__label	additional.fields	Unita
user_data_0x8000003F_process_id_label	additional.fields	Unita
user_data_0x8000003F_providers_in_host_label	additional.fields	Unita
user_data_0x8000003F_quota_name_label	additional.fields	Unita
user_data_0x8000003F_quota_threshold_label	additional.fields	Unita
user_data_0x8000003F_quota_value_label	additional.fields	Unita
user_defined_event_id_label	additional.fields	Unita
user_defined_information_label	additional.fields	Unita
user_id_label	additional.fields	Unita
value_is_near_1	additional.fields	Mappato: true → add_labels202
var_client_name	additional.fields	Unita
var_workstation_name	additional.fields	Unita
version_label	additional.fields	Unita
visited_entries_label	additional.fields	Unita
vsad_label	additional.fields	Unita
x_ms_adfs_proxy_client_ip_label	additional.fields	Unita
x_ms_client_application_label	additional.fields	Unita
x_ms_client_user_agent_label	additional.fields	Unita
x_ms_forwarded_client_ip_label	additional.fields	Unita
x_ms_proxy_label	additional.fields	Unita
xmlns_label1	additional.fields	Unita
LogonType	extensions.auth.auth_details	Rinominato/mappato
EventID	extensions.auth.mechanism	Mappato: 4908, 4964 → auth_mechanism1, 4908, 4964 → auth_mechanism, ` 1202,1203…
SourceName	extensions.auth.mechanism	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
auth_mechanism	extensions.auth.mechanism	Unita
auth_mechanism1	extensions.auth.mechanism	Unita
auth_type	extensions.auth.type	Rinominato/mappato
EventID	intermediary	Mapped: 4908, 4964 → intermediary_label, ` 8015, 8018, 8019, 8020, 8027, 8033, 8010, …
SourceName	intermediary	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `i…
intermediary_label	intermediary	Unita
ComputerName	intermediary.hostname	Mappata direttamente
HostName	intermediary.hostname	Mappata direttamente
Hostname	intermediary.hostname	Mappata direttamente
intermediary_ip	intermediary.ip	Unita
metadata_description	metadata.description	Mappato direttamente
Detection Time	metadata.event_timestamp	Analizzato come ISO8601
EventReceivedTime	metadata.event_timestamp	Analizzato come yyyy-MM-dd HH:mm:ss
EventTime	metadata.event_timestamp	Analizzato come ISO8601
NewTime	metadata.event_timestamp	Analizzato come ISO8601
PasswordLastSet	metadata.event_timestamp	Analizzato come M/dd/yyyy H:mm:ss A
PreviousTime	metadata.event_timestamp	Analizzato come ISO8601
ValidFrom	metadata.event_timestamp	Analizzato come ISO8601
ValidTo	metadata.event_timestamp	Analizzato come ISO8601
event_time	metadata.event_timestamp	Analizzato come MMM dd HH:mm:ss
event_timestamp	metadata.event_timestamp	Analizzato come yyyy-MM-dd HH:mm:ss
eventtime1	metadata.event_timestamp	Analizzato come UNIX_MS
receiveTimestamp	metadata.event_timestamp	Analizzato come yyyy-MM-ddTHH:mm:ssZ
syslog_ts	metadata.event_timestamp	Analizzato come yyyy-MM-ddTHH:mm:ss Z
EventID	metadata.event_type	Valori mappati (18 in totale, ad es. 4908, 4964 → STATUS_UPDATE, 4908, 4964 → `GENERIC_… )
SourceName	metadata.event_type	Valori mappati (9 in totale, ad esempio"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
event_type	metadata.event_type	Mappata direttamente
has_principal	metadata.event_type	Mappato: true → NETWORK_CONNECTION, true → STATUS_UPDATE
udm_event_type	metadata.event_type	Rinominate/mappate
ProviderGuid	metadata.product_deployment_id	Rinominate/mappate
EventID	metadata.product_event_type	Mappata direttamente
product_event_type	metadata.product_event_type	Mappata direttamente
RecordNumber	metadata.product_log_id	Rinominate/mappate
SourceName	metadata.product_name	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `M…
EventID	metadata.vendor_name	Mappato: 4908, 4964 → Microsoft
SourceName	metadata.vendor_name	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `M…
app_protocol	network.application_protocol	Rinominato/mappato
Direction	network.direction	Rinominato/mappato
EventID	network.dns.questions	Mappato: 4908, 4964 → questions, 1014, 3008 → questions
SourceName	network.dns.questions	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `q…
questions	network.dns.questions	Unita
http_method	network.http.method	Mappato direttamente
_userAgentString	network.http.parsed_user_agent	Rinominato/mappato
_userAgentString	network.http.user_agent	Mappata direttamente
ac-user-agent	network.http.user_agent	Mappata direttamente
ip_protocol_out	network.ip_protocol	Rinominato/mappato
AcctMultiSsnID	network.session_id	Mappata direttamente
SessionID	network.session_id	Mappata direttamente
SessionId	network.session_id	Mappata direttamente
SessionName	network.session_id	Rinominato/mappato
session_id	network.session_id	Mappata direttamente
CAName	network.tls.client.certificate.issuer	Mappata direttamente
Issuer	network.tls.client.certificate.issuer	Rinominato/mappato
LocalMMIssuingCA	network.tls.client.certificate.issuer	Mappata direttamente
CertificateHash	network.tls.client.certificate.md5	Mappata direttamente
SerialNumber	network.tls.client.certificate.serial	Mappata direttamente
client_certificate_serial	network.tls.client.certificate.serial	Rinominato/mappato
CertificateHash	network.tls.client.certificate.sha1	Mappata direttamente
client_certificate_sha1	network.tls.client.certificate.sha1	Rinominato/mappato
CertificateHash	network.tls.client.certificate.sha256	Mappata direttamente
client_certificate_subject	network.tls.client.certificate.subject	Rinominato/mappato
RemoteMMIssuingCA	network.tls.server.certificate.issuer	Mappata direttamente
server_certificate_subject	network.tls.server.certificate.subject	Rinominato/mappato
SourceModuleType	observer.application	Rinominate/mappate
IssuingKDC	observer.asset.asset_id	Mappata direttamente
EventID	observer.labels	Mappato: 4908, 4964 → verb_label, 4908, 4964 → source_module_label
SourceName	observer.labels	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
source_module_label	observer.labels	Unita
verb_label	observer.labels	Unita
AccountDomain	principal.administrative_domain	Rinominate/mappate
CallerDomainName	principal.administrative_domain	Rinominate/mappate
Domain	principal.administrative_domain	Rinominate/mappate
SubjectDomainName	principal.administrative_domain	Rinominate/mappate
administrative_domain	principal.administrative_domain	Mappata direttamente
principal_domain_name	principal.administrative_domain	Rinominato/mappato
principal_application	principal.application	Rinominate/mappate
src_application	principal.application	Rinominate/mappate
device-uid	principal.asset.asset_id	Mappata direttamente
EventID	principal.asset.attribute.labels	Valori mappati (7 in totale, ad es. 4908, 4964 → server_principal_id_label, 4908, 4964…)
SourceName	principal.asset.attribute.labels	Valori mappati (7 in totale, ad esempio"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
label_for_principal_asset	principal.asset.attribute.labels	Unita
server_instance_name_label	principal.asset.attribute.labels	Unita
server_principal_id_label	principal.asset.attribute.labels	Unita
server_principal_name_label	principal.asset.attribute.labels	Unita
server_principal_sid_label	principal.asset.attribute.labels	Unita
session_server_principal_name_label	principal.asset.attribute.labels	Unita
token_new	principal.asset.attribute.labels	Unita
hardware	principal.asset.hardware	Unita
Hostname	principal.asset.hostname	Mappata direttamente
auth_server_host	principal.asset.hostname	Mappata direttamente
hostname	principal.asset.hostname	Mappata direttamente
principal_asset_hostname	principal.asset.hostname	Rinominato/mappato
principal_hostname	principal.asset.hostname	Mappata direttamente
FramedIPAddress	principal.asset.ip	Unita
SourceName	principal.asset.ip	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `F…
calling_station_id	principal.asset.ip	Unita
src_ip	principal.asset.ip	Unita
var_domain_name	principal.asset.network_domain	Mappato direttamente
MachineInventory	principal.asset.platform_software.platform_version	Rinominato/mappato
device-platform-version	principal.asset.platform_software.platform_version	Mappata direttamente
platform_version	principal.asset.platform_software.platform_version	Rinominato/mappato
device-uid-global	principal.asset.product_object_id	Mappata direttamente
EventID	principal.asset.software	Mappatura: 4908, 4964 → software_version
SourceName	principal.asset.software	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `s…
software_version	principal.asset.software	Unita
ClientRealm	principal.domain.name	Mappata direttamente
Path	principal.file.full_path	Mappata direttamente
PrincipalFileName	principal.file.full_path	Rinominato/mappato
Hostname	principal.hostname	Mappata direttamente
auth_server_host	principal.hostname	Mappata direttamente
hostname	principal.hostname	Mappata direttamente
principal_asset_hostname	principal.hostname	Mappata direttamente
principal_hostname	principal.hostname	Mappato direttamente
EventID	principal.ip	Mappato: 4625, 4776, 4794 → temp_ip, 4908, 4964 → ip_address, 4908, 4964 → …
FramedIPAddress	principal.ip	Unita
SourceName	principal.ip	Valori mappati (5 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows secu…
calling_station_id	principal.ip	Unita
ip	principal.ip	Unita
ip_address	principal.ip	Unita
principal_ip	principal.ip	Unita
principal_ip1	principal.ip	Unita
src_ip	principal.ip	Unita
temp_ip	principal.ip	Unita
AdvancedOptions_label	principal.labels	Unita
ClientCreationTime_label	principal.labels	Unita
ConfigAccessPolicy_label	principal.labels	Unita
DisableIntegrityChecks_label	principal.labels	Unita
EventID	principal.labels	Valori mappati (28 in totale, ad esempio 4692, 4693, 4694, 4695, 4983, 4984 → "subject_logon_id_lab…
FlightSigning_label	principal.labels	Unita
HypervisorDebug_label	principal.labels	Unita
HypervisorLaunchType_label	principal.labels	Unita
HypervisorLoadOptions_label	principal.labels	Unita
KernelDebug_label	principal.labels	Unita
LoadOptions_label	principal.labels	Unita
RemoteEventLogging_label	principal.labels	Unita
SourceName	principal.labels	Valori mappati (36 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
SubjectLogonId_label	principal.labels	Unita
TestSigning_label	principal.labels	Unita
VsmLaunchType_label	principal.labels	Unita
acc_mask_label	principal.labels	Unita
account_name_label	principal.labels	Unita
caller_user_name_label	principal.labels	Unita
data_1_label	principal.labels	Unita
data_2_label	principal.labels	Unita
data_3_label	principal.labels	Unita
label01	principal.labels	Unita
label03	principal.labels	Unita
label461	principal.labels	Unita
label501	principal.labels	Unita
logon_id_label	principal.labels	Unita
method_executed_label	principal.labels	Unita
namespace_label	principal.labels	Unita
subject_logon_id_label	principal.labels	Unita
subject_machine_name_label	principal.labels	Unita
subject_user_name_label	principal.labels	Unita
user_id_label	principal.labels	Unita
var_client_name	principal.labels	Unita
var_workstation	principal.labels	Unita
var_workstation_name	principal.labels	Unita
CallingStationID	principal.mac	Mappatura: (([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2})$ → CallingStationID
EventID	principal.mac	Mappatura: 4908, 4964 → principal_mac
SourceName	principal.mac	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
calling_station_id	principal.mac	Unita
device-mac	principal.mac	Unita
mac	principal.mac	Unita
principal_mac	principal.mac	Unita
principal_port	principal.port	Rinominate/mappate
AccessMask	principal.process.access_mask	Rinominate/mappate
am	principal.process.access_mask	Rinominate/mappate
ParentCommandLine	principal.process.command_line	Rinominate/mappate
ProcessName	principal.process.command_line	Rinominate/mappate
principal_process_command_line	principal.process.command_line	Rinominate/mappate
task_arguments	principal.process.command_line	Rinominate/mappate
CallerProcessName	principal.process.file.full_path	Rinominate/mappate
ParentImage	principal.process.file.full_path	Rinominate/mappate
SourceImage	principal.process.file.full_path	Rinominate/mappate
principal_process_name	principal.process.file.full_path	Rinominate/mappate
task_command	principal.process.file.full_path	Rinominate/mappate
SourceName	principal.process.file.names	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
var_process_parent_name	principal.process.file.names	Unita
ParentProcessId	principal.process.parent_process.pid	Rinominate/mappate
principal_process_pid	principal.process.pid	Rinominate/mappate
process_id	principal.process.pid	Rinominate/mappate
ObjectPath	principal.registry.registry_key	Rinominate/mappate
EventID	principal.resource.attribute.permissions	Mappatura: 4659, 5140, 5145 → permissions
SourceName	principal.resource.attribute.permissions	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
permissions	principal.resource.attribute.permissions	Unita
principal_resource_product_object_id	principal.resource.product_object_id	Rinominato/mappato
EventID	principal.user.attribute.labels	Mappato: 4908, 4964 → label_for_principal_user, 4908, 4964 → user_label, ` 4908…
SourceName	principal.user.attribute.labels	Valori mappati (6 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
account_name_label	principal.user.attribute.labels	Unita
label_for_principal_user	principal.user.attribute.labels	Unita
sam_acc_label	principal.user.attribute.labels	Unita
sid_history_label	principal.user.attribute.labels	Unita
subject_user_sid_name_label	principal.user.attribute.labels	Unita
user_label	principal.user.attribute.labels	Unita
EventID	principal.user.attribute.roles	Valori mappati (20 in totale, ad es. 4908, 4964 → roles, ` 7000, 7011, 7022, 7023, 7024, 702… )
SourceName	principal.user.attribute.roles	Valori mappati (63 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
roles	principal.user.attribute.roles	Unita
Subject_Logon_GUID	principal.user.product_object_id	Mappato direttamente
principal_user_display_name	principal.user.user_display_name	Rinominato/mappato
AccountName	principal.user.userid	Rinominate/mappate
AccountToReset	principal.user.userid	Rinominate/mappate
CallerUserName	principal.user.userid	Rinominate/mappate
SubjectMachineName	principal.user.userid	Rinominate/mappate
SubjectUserName	principal.user.userid	Rinominate/mappate
principal_user_id	principal.user.userid	Rinominate/mappate
subject_machine_name	principal.user.userid	Rinominate/mappate
principal_user_windows_sid	principal.user.windows_sid	Rinominate/mappate
subject_machine_sid	principal.user.windows_sid	Mappato direttamente
EventID	security_result	Valori mappati (5 in totale, ad es. 4953, 4957, 4951, 4952, 4958 → security_result1, ` 4908, … )
SourceName	security_result	Valori mappati (11 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
category_details	security_result	Valori mappati (9 in totale, ad esempio "Security State Change", "Security System Extension", "System… )
label_security_result	security_result	Unita
security_result1	security_result	Unita
security_result2	security_result	Unita
security_result_1	security_result	Unita
security_result_2	security_result	Unita
security_result_3	security_result	Unita
security_result_4	security_result	Unita
security_result_5	security_result	Unita
KeyUserPath	security_result.about.file.full_path	Mappata direttamente
EventID	security_result.about.labels	Mappatura: 4625, 4776, 4794 → failure_reason_label, 4908, 4964 → `label_for_security…
SourceName	security_result.about.labels	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `f…
failure_reason_label	security_result.about.labels	Unita
label_for_security_result_about_label	security_result.about.labels	Unita
EventID	security_result.about.resource.attribute.labels	Valori mappati (14 in totale, ad es. 4908, 4964 → label, 4908, 4964 → label1, ` 4908,… )
SourceName	security_result.about.resource.attribute.labels	Valori mappati (29 in totale, ad esempio `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
TicketOptions_label	security_result.about.resource.attribute.labels	Unita
label	security_result.about.resource.attribute.labels	Unita
label1	security_result.about.resource.attribute.labels	Unita
label10	security_result.about.resource.attribute.labels	Unita
label11	security_result.about.resource.attribute.labels	Unita
label12	security_result.about.resource.attribute.labels	Unita
label13	security_result.about.resource.attribute.labels	Unita
label2	security_result.about.resource.attribute.labels	Unita
label3	security_result.about.resource.attribute.labels	Unita
label4	security_result.about.resource.attribute.labels	Unita
label5	security_result.about.resource.attribute.labels	Unita
label6	security_result.about.resource.attribute.labels	Unita
label7	security_result.about.resource.attribute.labels	Unita
label8	security_result.about.resource.attribute.labels	Unita
label9	security_result.about.resource.attribute.labels	Unita
security_result_about_resource_name	security_result.about.resource.name	Rinominato/mappato
EventID	security_result.action	Mappato: 4908, 4964 → action
SourceName	security_result.action	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
action	security_result.action	Unita
security_action	security_result.action	Unita
Action Name	security_result.action_details	Mappato direttamente
action_details	security_result.action_details	Rinominato/mappato
action_id	security_result.action_details	Mappata direttamente
EventID	security_result.category	Mappatura: 4908, 4964 → category
SourceName	security_result.category	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `c…
category	security_result.category	Unita
Category	security_result.category_details	Unita
CategoryId	security_result.category_details	Unita
CategoryName	security_result.category_details	Unita
EventID	security_result.category_details	Mappato: 4908, 4964 → Category, 4908, 4964 → CategoryName, ` 102, 103, 300, 301…
SourceName	security_result.category_details	Valori mappati (9 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
AccessReason	security_result.description	Mappato direttamente
AdditionalInfo	security_result.description	Rinominato/mappato
AuditPolicyChanges	security_result.description	Mappata direttamente
Data_2	security_result.description	Mappata direttamente
Error Description	security_result.description	Mappata direttamente
ErrorContext	security_result.description	Mappata direttamente
ErrorMessage	security_result.description	Mappata direttamente
Message	security_result.description	Mappata direttamente
ReasonForRejection	security_result.description	Rinominato/mappato
RootCause	security_result.description	Mappata direttamente
description	security_result.description	Rinominato/mappato
security_description	security_result.description	Mappata direttamente
status	security_result.description	Mappata direttamente
AdditionalInfo2_label	security_result.detection_fields	Unita
AppendData_or_AddSubdirectory_or_CreatePipeInstance_label	security_result.detection_fields	Unita
ApplicationDomain_label	security_result.detection_fields	Unita
ApplicationPath_label	security_result.detection_fields	Unita
ApplicationVirtualPath_label	security_result.detection_fields	Unita
AuthenticationType_label	security_result.detection_fields	Unita
CONTROL_label	security_result.detection_fields	Unita
CustomEventDetails_label	security_result.detection_fields	Unita
DAC_label	security_result.detection_fields	Unita
DELETE_label	security_result.detection_fields	Unita
ErrorCode_label	security_result.detection_fields	Unita
EventCode_label	security_result.detection_fields	Unita
EventDetailCode_label	security_result.detection_fields	Unita
EventID	security_result.detection_fields	Valori mappati (150 in totale, ad es. 5158,5159,5154,5153,5155 → labels0, ` 5158,5159,5154,51… )
EventId_label	security_result.detection_fields	Unita
EventOccurrence_label	security_result.detection_fields	Unita
EventSequence_label	security_result.detection_fields	Unita
FailureId_label	security_result.detection_fields	Unita
GPOList_label	security_result.detection_fields	Unita
IsAuthenticated_label	security_result.detection_fields	Unita
IsImpersonating_label	security_result.detection_fields	Unita
MasterKeyId_label	security_result.detection_fields	Unita
ReadAttributes_label	security_result.detection_fields	Unita
RecoveryKeyId_label	security_result.detection_fields	Unita
RequestPath_label	security_result.detection_fields	Unita
SecurityDescriptor_label	security_result.detection_fields	Unita
Sid_Filtering_label	security_result.detection_fields	Unita
SourceName	security_result.detection_fields	Valori mappati (357 in totale, ad esempio"Microsoft-Windows-Security-Auditing", "Microsoft Windows se… )
StackTrace_label	security_result.detection_fields	Unita
ThreadAccountName_label	security_result.detection_fields	Unita
ThreadId_label	security_result.detection_fields	Unita
TrustLevel_label	security_result.detection_fields	Unita
Trust_Attributes_label	security_result.detection_fields	Unita
Trust_Direction_label	security_result.detection_fields	Unita
Trust_Type_label	security_result.detection_fields	Unita
WriteAttributes_label	security_result.detection_fields	Unita
WriteData_or_AddFile_label	security_result.detection_fields	Unita
WriteEA_label	security_result.detection_fields	Unita
account_name_label	security_result.detection_fields	Unita
action_id_label	security_result.detection_fields	Unita
affected_rows_label	security_result.detection_fields	Unita
analysis_symbol_label	security_result.detection_fields	Unita
application_information_label	security_result.detection_fields	Unita
application_name_label	security_result.detection_fields	Unita
audit_event_label	security_result.detection_fields	Unita
audit_schema_version_label	security_result.detection_fields	Unita
cert_issuer_name_label	security_result.detection_fields	Unita
cert_serial_number_label	security_result.detection_fields	Unita
cert_thumbprint_label	security_result.detection_fields	Unita
class_type_label	security_result.detection_fields	Unita
client_ip_label	security_result.detection_fields	Unita
client_name_label	security_result.detection_fields	Unita
client_name_session_id_label	security_result.detection_fields	Unita
client_tls_version_label	security_result.detection_fields	Unita
client_tls_version_name_label	security_result.detection_fields	Unita
connection_id_label	security_result.detection_fields	Unita
database_name_label	security_result.detection_fields	Unita
database_principal_id_label	security_result.detection_fields	Unita
database_principal_name_label	security_result.detection_fields	Unita
database_transaction_id_label	security_result.detection_fields	Unita
detect_field	security_result.detection_fields	Unita
detection_fields	security_result.detection_fields	Unita
detection_label	security_result.detection_fields	Unita
device_guid_label	security_result.detection_fields	Unita
duration_milliseconds_label	security_result.detection_fields	Unita
error_label	security_result.detection_fields	Unita
event_detail_code_label	security_result.detection_fields	Unita
event_id_label	security_result.detection_fields	Unita
event_message_label	security_result.detection_fields	Unita
event_name_label	security_result.detection_fields	Unita
event_occurrence_label	security_result.detection_fields	Unita
event_sequence_label	security_result.detection_fields	Unita
event_time_label	security_result.detection_fields	Unita
event_time_utc_label	security_result.detection_fields	Unita
exce_label	security_result.detection_fields	Unita
exception_information_label	security_result.detection_fields	Unita
external_policy_permissions_checked_label	security_result.detection_fields	Unita
failure_status_label	security_result.detection_fields	Unita
host_name_label	security_result.detection_fields	Unita
is_column_permission_label	security_result.detection_fields	Unita
is_impersonating_label	security_result.detection_fields	Unita
is_local_secondary_replica_label	security_result.detection_fields	Unita
label	security_result.detection_fields	Unita
label_for_security_result_detection	security_result.detection_fields	Unita
labels0	security_result.detection_fields	Unita
labels1	security_result.detection_fields	Unita
labels2	security_result.detection_fields	Unita
labels3	security_result.detection_fields	Unita
ledger_start_sequence_number_label	security_result.detection_fields	Unita
machine_name_label	security_result.detection_fields	Unita
nas_port_field	security_result.detection_fields	Unita
network_protocol_label	security_result.detection_fields	Unita
object_id_label	security_result.detection_fields	Unita
object_name_label	security_result.detection_fields	Unita
obo_middle_tier_app_id_label	security_result.detection_fields	Unita
permission_bitmask_label	security_result.detection_fields	Unita
proxy_policy_name	security_result.detection_fields	Unita
req_url_label	security_result.detection_fields	Unita
response_rows_label	security_result.detection_fields	Unita
response_ticket_label	security_result.detection_fields	Unita
schema_name_label	security_result.detection_fields	Unita
sec_error_label	security_result.detection_fields	Unita
security_detection1	security_result.detection_fields	Unita
security_detection2	security_result.detection_fields	Unita
security_detection3	security_result.detection_fields	Unita
security_detection4	security_result.detection_fields	Unita
sequence_group_id_label	security_result.detection_fields	Unita
sequence_number_label	security_result.detection_fields	Unita
server_instance_name_label	security_result.detection_fields	Unita
server_principal_id_label	security_result.detection_fields	Unita
server_principal_name_label	security_result.detection_fields	Unita
server_principal_sid_label	security_result.detection_fields	Unita
session_id_label	security_result.detection_fields	Unita
session_server_principal_name_label	security_result.detection_fields	Unita
statement_label	security_result.detection_fields	Unita
succeeded_label	security_result.detection_fields	Unita
target_database_principal_id_label	security_result.detection_fields	Unita
target_database_principal_name_label	security_result.detection_fields	Unita
target_server_principal_id_label	security_result.detection_fields	Unita
target_server_principal_name_label	security_result.detection_fields	Unita
target_server_principal_sid_label	security_result.detection_fields	Unita
transaction_id_label	security_result.detection_fields	Unita
type_label	security_result.detection_fields	Unita
user_defined_event_id_label	security_result.detection_fields	Unita
user_defined_information_label	security_result.detection_fields	Unita
var_Action_ID	security_result.detection_fields	Unita
var_Additional_Actions_ID	security_result.detection_fields	Unita
var_Additional_Actions_String	security_result.detection_fields	Unita
var_Category_ID	security_result.detection_fields	Unita
var_DetectionOrigin	security_result.detection_fields	Unita
var_DetectionSource	security_result.detection_fields	Unita
var_DetectionType	security_result.detection_fields	Unita
var_Detection_ID	security_result.detection_fields	Unita
var_EngineVersion	security_result.detection_fields	Unita
var_Error_Code	security_result.detection_fields	Unita
var_Execution_ID	security_result.detection_fields	Unita
var_Execution_Name	security_result.detection_fields	Unita
var_Origin_ID	security_result.detection_fields	Unita
var_Post_Clean_Status	security_result.detection_fields	Unita
var_Pre_Execution_Status	security_result.detection_fields	Unita
var_SecurityintelligenceVersion	security_result.detection_fields	Unita
var_SeverityName	security_result.detection_fields	Unita
var_Severity_ID	security_result.detection_fields	Unita
var_Source_ID	security_result.detection_fields	Unita
var_State	security_result.detection_fields	Unita
var_Status_Code	security_result.detection_fields	Unita
var_Type_ID	security_result.detection_fields	Unita
var_process_information	security_result.detection_fields	Unita
var_process_name	security_result.detection_fields	Unita
var_request_information	security_result.detection_fields	Unita
var_stack_trace	security_result.detection_fields	Unita
var_thread_account_name	security_result.detection_fields	Unita
Priority	security_result.priority_details	Rinominate/mappate
RuleId	security_result.rule_id	Rinominate/mappate
EventID	security_result.rule_labels	Mapped: 4908, 4964 → Title_label, 4908, 4964 → `label_for_security_result_rule_l…
SourceName	security_result.rule_labels	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `T…
Title_label	security_result.rule_labels	Unita
label_for_security_result_rule_label	security_result.rule_labels	Unita
EventID	security_result.rule_name	Mappata direttamente
connection_req_policy	security_result.rule_name	Mappata direttamente
Severity	security_result.severity	Rinominato/mappato
BlockReasonErrorCode	security_result.summary	Mappata direttamente
CorruptionActionState	security_result.summary	Mappata direttamente
CrashOnAuditFailValue	security_result.summary	Mappata direttamente
Error	security_result.summary	Mappata direttamente
ErrorCode	security_result.summary	Mappata direttamente
FailureReason	security_result.summary	Mappata direttamente
FinalStatus	security_result.summary	Mappata direttamente
QueryResults	security_result.summary	Mappata direttamente
Reason	security_result.summary	Mappata direttamente
Status	security_result.summary	Mappata direttamente
Win32Error	security_result.summary	Mappata direttamente
error	security_result.summary	Mappata direttamente
hr	security_result.summary	Mappata direttamente
param1	security_result.summary	Mappata direttamente
sec_summary	security_result.summary	Mappata direttamente
security_summary	security_result.summary	Mappata direttamente
status	security_result.summary	Mappata direttamente
summary	security_result.summary	Rinominato/mappato
ThreatID	security_result.threat_id	Mappata direttamente
ThreatName	security_result.threat_name	Mappata direttamente
src_path	src.file.full_path	Rinominato/mappato
CallerComputerName	src.hostname	Mappato direttamente
EventID	src.ip	Mapped: 4908, 4964 → varclientip, ` 1162, 1311, 1535, 1566, 1644, 1865, 1925, 2085, 2…
SourceName	src.ip	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
varclientip	src.ip	Unita
varclientport	src.port	Rinominate/mappate
Service	src.resource.name	Rinominate/mappate
SourceDRA	src.resource.name	Mappata direttamente
SourceHandleId	src.resource.name	Rinominato/mappato
EventID	target	Mappatura: 4908, 4964 → clsid_labels, 10001, 10002, 10100 → clsid_labels
SourceName	target	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `c…
clsid_labels	target	Unita
DomainName	target.administrative_domain	Rinominato/mappato
ServerRealm	target.administrative_domain	Mappata direttamente
TargetDomainName	target.administrative_domain	Rinominato/mappato
subject_domain_name	target.administrative_domain	Rinominate/mappate
target_domain_name	target.administrative_domain	Rinominate/mappate
ServiceName	target.application	Mappata direttamente
Targetname	target.application	Mappata direttamente
event_source	target.application	Mappata direttamente
target_application	target.application	Rinominato/mappato
UserData.InstallDeviceID.DeviceInstanceID	target.asset.asset_id	Mappato direttamente
EventID	target.asset.attribute.labels	Valori mappati (10 in totale, ad es. 4741, 4742 → dns_host_label, 4908, 4964 → `user_dat… )
SourceName	target.asset.attribute.labels	Valori mappati (14 in totale, ad esempio"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
dns_host_label	target.asset.attribute.labels	Unita
label_for_target_asset	target.asset.attribute.labels	Unita
target_server_principal_id_label	target.asset.attribute.labels	Unita
target_server_principal_name_label	target.asset.attribute.labels	Unita
target_server_principal_sid_label	target.asset.attribute.labels	Unita
token_new	target.asset.attribute.labels	Unita
user_data_install_device_id_is_driver_oem_label	target.asset.attribute.labels	Unita
user_data_install_device_id_reboot_option_label	target.asset.attribute.labels	Unita
user_data_install_device_id_setup_class_label	target.asset.attribute.labels	Unita
user_data_install_device_id_upgrade_device_label	target.asset.attribute.labels	Unita
AccountName	target.asset.hostname	Mappata direttamente
NodeName	target.asset.hostname	Mappata direttamente
client_name	target.asset.hostname	Mappata direttamente
target_hostname	target.asset.hostname	Mappata direttamente
ClientIPAddress	target.asset.ip	Unita
NASIPAddress	target.asset.ip	Unita
SourceName	target.asset.ip	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `N…
called_station_id	target.asset.ip	Unita
client_ip	target.asset.ip	Unita
nas_ip	target.asset.ip	Unita
UserData.InstallDeviceID.DeviceInstanceID	target.asset_id	Mappata direttamente
Data_1	target.domain.name	Mappata direttamente
TargetName	target.domain.name	Mappata direttamente
TargetRealm	target.domain.name	Mappata direttamente
param2	target.domain.name	Mappata direttamente
AutoBackup.BackupPath	target.file.full_path	Rinominato/mappato
BackupFileName	target.file.full_path	Rinominate/mappate
FileName	target.file.full_path	Rinominate/mappate
FilePath	target.file.full_path	Rinominate/mappate
KeyFilePath	target.file.full_path	Rinominate/mappate
KeyUserPath	target.file.full_path	Rinominate/mappate
Namespace	target.file.full_path	Rinominate/mappate
PublishURLs	target.file.full_path	Rinominate/mappate
ServiceFileName	target.file.full_path	Rinominate/mappate
ShareLocalPath	target.file.full_path	Rinominate/mappate
target_file_name	target.file.full_path	Rinominate/mappate
MD5	target.file.md5	Rinominato/mappato
EventID	target.file.names	Mapped: ` 5049, 5140 , 5145, 5142, 5143, 5144, 4698, 4702, 4699, 4700, 4701, 4946, 4690, 4…
RelativeTargetName	target.file.names	Unita
ScriptName	target.file.names	Unita
SourceName	target.file.names	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `R…
SHA1	target.file.sha1	Rinominato/mappato
SHA256	target.file.sha256	Rinominate/mappate
NewSize	target.file.size	Rinominate/mappate
target_file_size	target.file.size	Rinominato/mappato
EventID	target.group.attribute.labels	Mappato: 4908, 4964 → label_for_target_group
SourceName	target.group.attribute.labels	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `l…
label_for_target_group	target.group.attribute.labels	Unita
EventID	target.group.attribute.permissions	Mappato: ` 4656, 4704, 4672, 4731, 4720, 4723, 4726, 4728, 4729, 4730, 4732, 4733, 4734, 47…
SourceName	target.group.attribute.permissions	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
privilege_list	target.group.attribute.permissions	Unita
target_group_display_name	target.group.group_display_name	Rinominate/mappate
target_group_product_object_id	target.group.product_object_id	Rinominate/mappate
target_group_windows_sid	target.group.windows_sid	Rinominate/mappate
AccountName	target.hostname	Mappata direttamente
client_name	target.hostname	Mappata direttamente
target_asset_hostname	target.hostname	Mappata direttamente
target_hostname	target.hostname	Rinominato/mappato
ClientIPAddress	target.ip	Unita
EventID	target.ip	Mappato: 4908, 4964 → target_ip
NASIPAddress	target.ip	Unita
SourceName	target.ip	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
called_station_id	target.ip	Unita
client_ip	target.ip	Unita
nas_ip	target.ip	Unita
target_ip	target.ip	Unita
var_valid_ip	target.ip	Unita
ActiveProfile_label	target.labels	Unita
AppId_label	target.labels	Unita
CommandName_label	target.labels	Unita
ConfiguredNames_label	target.labels	Unita
DN_label	target.labels	Unita
DSType_label	target.labels	Unita
DirectiveName_label	target.labels	Unita
EngineVersion_label	target.labels	Unita
EventID	target.labels	Valori mappati (35 in totale, ad es. 4907 , 4817, 4715 → ObjectServer_label, ` 4907 , 4817, 4… )
FQDN_label	target.labels	Unita
HandleId_label	target.labels	Unita
HostId_label	target.labels	Unita
HostVersion_label	target.labels	Unita
KeyLength_label	target.labels	Unita
LmPackageName_label	target.labels	Unita
MandatoryLabel_label	target.labels	Unita
NewState_label	target.labels	Unita
NotificationInterval_label	target.labels	Unita
ObjectServer_label	target.labels	Unita
Operation_label	target.labels	Unita
PipelineId_label	target.labels	Unita
Profiles_label	target.labels	Unita
ResourceManager_label	target.labels	Unita
ReturnCode_label	target.labels	Unita
RunspaceId_label	target.labels	Unita
ServiceStartType_label	target.labels	Unita
ServiceType_label	target.labels	Unita
SkuId_label	target.labels	Unita
SourceName	target.labels	Valori mappati (77 in totale, ad esempio"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
TargetLinkedLogonId_label	target.labels	Unita
TokenElevationType_label	target.labels	Unita
TransactionId_label	target.labels	Unita
TransmittedServices_label	target.labels	Unita
Trigger_label	target.labels	Unita
VirtualAccount_label	target.labels	Unita
client_friendly_name_label	target.labels	Unita
event_in_seq_label	target.labels	Unita
label02	target.labels	Unita
label462	target.labels	Unita
label463	target.labels	Unita
label46561	target.labels	Unita
label46562	target.labels	Unita
label46563	target.labels	Unita
label46564	target.labels	Unita
label46565	target.labels	Unita
label46571	target.labels	Unita
label46572	target.labels	Unita
label47681	target.labels	Unita
label47682	target.labels	Unita
label501	target.labels	Unita
label601	target.labels	Unita
labels46411	target.labels	Unita
labels46412	target.labels	Unita
labels46413	target.labels	Unita
labels46414	target.labels	Unita
labels46415	target.labels	Unita
labels46416	target.labels	Unita
labels46417	target.labels	Unita
nas_port_type	target.labels	Unita
new_target_user_name_label	target.labels	Unita
object_class_label	target.labels	Unita
object_dn_label	target.labels	Unita
target_label	target.labels	Unita
target_labels	target.labels	Unita
target_logon_id_label	target.labels	Unita
target_user_id_label	target.labels	Unita
EventID	target.mac	Mappato: 4908, 4964 → target_mac
NASIdentifier	target.mac	Mappatura: (([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2})$ → NASIdentifier
SourceName	target.mac	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `t…
mac_address	target.mac	Unita
target_mac	target.mac	Unita
PeerPrivateAddress	target.nat_ip	Unita
SourceName	target.nat_ip	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `P…
NASPort	target.nat_port	Rinominate/mappate
var_http_method	target.network.http.method	Mappata direttamente
target_platform_version	target.platform_version	Rinominato/mappato
nas_port	target.port	Rinominate/mappate
targetport	target.port	Rinominate/mappate
CommandLine	target.process.command_line	Rinominate/mappate
target_process_command_line	target.process.command_line	Rinominate/mappate
ImagePath	target.process.file.full_path	Rinominate/mappate
NewProcessName	target.process.file.full_path	Rinominate/mappate
TargetProcessName	target.process.file.full_path	Rinominate/mappate
target_process_file_full_path	target.process.file.full_path	Rinominate/mappate
MD5	target.process.file.md5	Mappato direttamente
SourceName	target.process.file.names	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
var_process_file_name	target.process.file.names	Unita
SHA1	target.process.file.sha1	Mappata direttamente
SHA256	target.process.file.sha256	Mappata direttamente
target_parent_process_command_line	target.process.parent_process.command_line	Rinominato/mappato
target_parent_process_file_full_path	target.process.parent_process.file.full_path	Rinominate/mappate
target_parent_process_pid	target.process.parent_process.pid	Rinominate/mappate
TargetProcessId	target.process.pid	Rinominate/mappate
target_process_pid	target.process.pid	Rinominate/mappate
EventOriginId	target.process.product_specific_process_id	Mappata direttamente
ObjectName	target.registry.registry_key	Mappata direttamente
ObjectVirtualPath	target.registry.registry_key	Rinominato/mappato
target_registry_key	target.registry.registry_key	Rinominate/mappate
NewValue	target.registry.registry_value_data	Rinominate/mappate
target_registry_registry_value_data	target.registry.registry_value_data	Rinominate/mappate
ObjectValueName	target.registry.registry_value_name	Rinominate/mappate
registry_value	target.registry.registry_value_name	Rinominate/mappate
target_registry_registry_value_name	target.registry.registry_value_name	Rinominate/mappate
AlgorithmName_label	target.resource.attribute.labels	Unita
ClassId_label	target.resource.attribute.labels	Unita
ClassName_label	target.resource.attribute.labels	Unita
CompatibleIds_label	target.resource.attribute.labels	Unita
DomainBehaviorVersion_label	target.resource.attribute.labels	Unita
ErrorCode_label	target.resource.attribute.labels	Unita
EventID	target.resource.attribute.labels	Valori mappati (101 in totale, ad es. 4907 , 4817, 4715 → label0, 4907 , 4817, 4715 → `la… )
ForceLogoff_label	target.resource.attribute.labels	Unita
HandleID_label	target.resource.attribute.labels	Unita
HardwareIds_label	target.resource.attribute.labels	Unita
KeyType_label	target.resource.attribute.labels	Unita
LocationInformation_label	target.resource.attribute.labels	Unita
LockoutDuration_label	target.resource.attribute.labels	Unita
LockoutObservationWindow_label	target.resource.attribute.labels	Unita
LockoutThreshold_label	target.resource.attribute.labels	Unita
MachineAccountQuota_label	target.resource.attribute.labels	Unita
MaxPasswordAge_label	target.resource.attribute.labels	Unita
MinPasswordAge_label	target.resource.attribute.labels	Unita
MinPasswordLength_label	target.resource.attribute.labels	Unita
MixedDomainMode_label	target.resource.attribute.labels	Unita
ModifiedObjectProperties_label	target.resource.attribute.labels	Unita
ObjectIdentifyingProperties_label	target.resource.attribute.labels	Unita
ObjectProperties_label	target.resource.attribute.labels	Unita
ObjectServer_label	target.resource.attribute.labels	Unita
OemInformation_label	target.resource.attribute.labels	Unita
PasswordHistoryLength_label	target.resource.attribute.labels	Unita
PasswordProperties_label	target.resource.attribute.labels	Unita
ProfileChanged_label	target.resource.attribute.labels	Unita
ProfileUsed_label	target.resource.attribute.labels	Unita
ProviderName_label	target.resource.attribute.labels	Unita
PuaCount_label	target.resource.attribute.labels	Unita
ResourceAttributes_label	target.resource.attribute.labels	Unita
SettingValue_label	target.resource.attribute.labels	Unita
SourceName	target.resource.attribute.labels	Valori mappati (120 totali, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows se… )
TemplateContent_label	target.resource.attribute.labels	Unita
TemplateDSObjectFQDN_label	target.resource.attribute.labels	Unita
TemplateSchemaVersion_label	target.resource.attribute.labels	Unita
TemplateVersion_label	target.resource.attribute.labels	Unita
TransactionId_label	target.resource.attribute.labels	Unita
database_principal_id_label	target.resource.attribute.labels	Unita
database_principal_name_label	target.resource.attribute.labels	Unita
entry_type_label	target.resource.attribute.labels	Unita
label0	target.resource.attribute.labels	Unita
label00	target.resource.attribute.labels	Unita
label01	target.resource.attribute.labels	Unita
label02	target.resource.attribute.labels	Unita
label03	target.resource.attribute.labels	Unita
label04	target.resource.attribute.labels	Unita
label05	target.resource.attribute.labels	Unita
label06	target.resource.attribute.labels	Unita
label07	target.resource.attribute.labels	Unita
label08	target.resource.attribute.labels	Unita
label09	target.resource.attribute.labels	Unita
label1	target.resource.attribute.labels	Unita
label2	target.resource.attribute.labels	Unita
label3	target.resource.attribute.labels	Unita
label4	target.resource.attribute.labels	Unita
label4681	target.resource.attribute.labels	Unita
label4682	target.resource.attribute.labels	Unita
label4683	target.resource.attribute.labels	Unita
label4684	target.resource.attribute.labels	Unita
label5	target.resource.attribute.labels	Unita
label6	target.resource.attribute.labels	Unita
label_SessionStateChangeTrigger_Enabled	target.resource.attribute.labels	Unita
label_SessionStateChangeTrigger_StateChange	target.resource.attribute.labels	Unita
label_for_target_resource	target.resource.attribute.labels	Unita
labels0	target.resource.attribute.labels	Unita
labels1	target.resource.attribute.labels	Unita
labels10	target.resource.attribute.labels	Unita
labels11	target.resource.attribute.labels	Unita
labels12	target.resource.attribute.labels	Unita
labels13	target.resource.attribute.labels	Unita
labels14	target.resource.attribute.labels	Unita
labels15	target.resource.attribute.labels	Unita
labels16	target.resource.attribute.labels	Unita
labels17	target.resource.attribute.labels	Unita
labels19	target.resource.attribute.labels	Unita
labels2	target.resource.attribute.labels	Unita
labels21	target.resource.attribute.labels	Unita
labels26	target.resource.attribute.labels	Unita
labels3	target.resource.attribute.labels	Unita
labels35	target.resource.attribute.labels	Unita
labels4	target.resource.attribute.labels	Unita
labels41	target.resource.attribute.labels	Unita
labels5	target.resource.attribute.labels	Unita
labels6	target.resource.attribute.labels	Unita
labels7	target.resource.attribute.labels	Unita
labels8	target.resource.attribute.labels	Unita
labels9	target.resource.attribute.labels	Unita
nas_port_label	target.resource.attribute.labels	Unita
netbios_name_label	target.resource.attribute.labels	Unita
object_id_label	target.resource.attribute.labels	Unita
object_name_label	target.resource.attribute.labels	Unita
operation_id_label	target.resource.attribute.labels	Unita
schema_name_label	target.resource.attribute.labels	Unita
target_database_principal_id_label	target.resource.attribute.labels	Unita
target_database_principal_name_label	target.resource.attribute.labels	Unita
top_level_name_label	target.resource.attribute.labels	Unita
uac_label	target.resource.attribute.labels	Unita
user_data_install_device_id_@_xmlns__label	target.resource.attribute.labels	Unita
user_data_install_device_id_driver_description_label	target.resource.attribute.labels	Unita
user_data_install_device_id_driver_provider_label	target.resource.attribute.labels	Unita
user_data_install_device_id_driver_version_label	target.resource.attribute.labels	Unita
user_data_install_device_id_install_status_label	target.resource.attribute.labels	Unita
volume_label	target.resource.attribute.labels	Unita
EventID	target.resource.attribute.permissions	Mappatura: 4663, 4656, 4659 → permissions, 4908, 4964 → permissions
SourceName	target.resource.attribute.permissions	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
permissions	target.resource.attribute.permissions	Unita
DeviceId	target.resource.id	Rinominato/mappato
ContextName	target.resource.name	Mappata direttamente
DestinationDRA	target.resource.name	Mappata direttamente
DfsNamespace	target.resource.name	Rinominato/mappato
DomainPolicyChanged	target.resource.name	Rinominate/mappate
ExtensionName	target.resource.name	Rinominate/mappate
HiveName	target.resource.name	Rinominate/mappate
SecurityPackageName	target.resource.name	Rinominate/mappate
TicketOptions	target.resource.name	Mappata direttamente
attribute_value	target.resource.name	Rinominato/mappato
target_resource_name	target.resource.name	Rinominate/mappate
updateTitle	target.resource.name	Rinominate/mappate
ObjectServer	target.resource.parent	Rinominate/mappate
AppInstance	target.resource.product_object_id	Rinominate/mappate
AuthenticationSetId	target.resource.product_object_id	Rinominate/mappate
ConnectionSecurityRuleId	target.resource.product_object_id	Rinominate/mappate
CryptographicSetId	target.resource.product_object_id	Rinominate/mappate
DeviceId	target.resource.product_object_id	Mappata direttamente
ExtensionId	target.resource.product_object_id	Rinominato/mappato
FilterId	target.resource.product_object_id	Rinominate/mappate
IpSecSecurityAssociationId	target.resource.product_object_id	Rinominate/mappate
ObjectGUID	target.resource.product_object_id	Rinominate/mappate
PuaPolicyId	target.resource.product_object_id	Rinominate/mappate
TargetJobId	target.resource.product_object_id	Rinominate/mappate
TemplateOID	target.resource.product_object_id	Rinominate/mappate
target_resource_product_object_id	target.resource.product_object_id	Rinominate/mappate
updateGuid	target.resource.product_object_id	Rinominate/mappate
val_instance_id	target.resource.product_object_id	Mappata direttamente
KeyType	target.resource.resource_subtype	Rinominato/mappato
ObjectType	target.resource.resource_subtype	Mappata direttamente
TicketEncryptionType	target.resource.resource_subtype	Mappata direttamente
resource_subtype	target.resource.resource_subtype	Rinominato/mappato
EventID	target.resource.resource_type	Mappatura: 4908, 4964 → SETTING, 4908, 4964 → TASK
SourceName	target.resource.resource_type	Valori mappati (6 in totale, ad es. "Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
resource_type	target.resource.resource_type	Rinominato/mappato
EventID	target.resource.type	Mappatura: 4908, 4964 → DATABASE
SourceName	target.resource.type	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `D…
SourceName	target.resource_ancestors	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `r…
resource_ancestors	target.resource_ancestors	Unita
SubscriptionManagerAddress	target.url	Rinominate/mappate
target_url	target.url	Rinominate/mappate
fileLength	target.url_metadata.last_http_response_content_length	Rinominate/mappate
EventID	target.user.attribute.labels	Mappato: 4908, 4964 → label_for_target_user, 4908, 4964 → user_label1
MembershipExpirationTime_label	target.user.attribute.labels	Unita
SourceName	target.user.attribute.labels	Valori mappati (7 in totale, ad esempio"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
TargetOutboundDomainName_label	target.user.attribute.labels	Unita
label_for_target_user	target.user.attribute.labels	Unita
target_group_membership_name_label	target.user.attribute.labels	Unita
target_user_sid_name_label	target.user.attribute.labels	Unita
user_att	target.user.attribute.labels	Unita
user_label1	target.user.attribute.labels	Unita
EventID	target.user.attribute.permissions	Mapped: ` 4656, 4704, 4672, 4731, 4720, 4723, 4726, 4728, 4729, 4730, 4732, 4733, 4734, 47…
SourceName	target.user.attribute.permissions	Mappato: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
access_granted	target.user.attribute.permissions	Unita
access_removed_list	target.user.attribute.permissions	Unita
privilege_list	target.user.attribute.permissions	Unita
EventID	target.user.group_identifiers	Mappatura: 4908, 4964 → new_sid
SourceName	target.user.group_identifiers	Mappatura: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `i…
input_sid	target.user.group_identifiers	Unita
new_sid	target.user.group_identifiers	Unita
DisplayName	target.user.user_display_name	Rinominato/mappato
FullName	target.user.user_display_name	Mappata direttamente
target_user_display_name	target.user.user_display_name	Rinominato/mappato
DetectionUser	target.user.userid	Mappata direttamente
NewTargetUserName	target.user.userid	Rinominato/mappato
UserName	target.user.userid	Mappata direttamente
subject_user_name	target.user.userid	Rinominato/mappato
target_user_id	target.user.userid	Rinominate/mappate
subject_user_sid	target.user.windows_sid	Mappata direttamente
target_user_windows_sid	target.user.windows_sid	Rinominate/mappate
N/D	metadata.event_type	Costante: STATUS_UPDATE
N/D	metadata.product_name	Costante: Microsoft-Windows-Security-Auditing
N/D	metadata.vendor_name	Costante: Microsoft
N/D	principal.asset.platform_software.platform	Costante: WINDOWS
N/D	target.resource.resource_type	Costante: BACKEND_SERVICE
N/D	target.resource.type	Costante: DATABASE

Log delle modifiche

Visualizza il log delle modifiche per questo parser

Hai bisogno di ulteriore assistenza? Ricevi risposte dai membri della community e dai professionisti di Google SecOps.