Windows 네트워크 정책 서버 로그 수집

다음에서 지원:

이 문서에서는 Bindplane을 사용하여 Windows 네트워크 정책 서버(NPS) 로그를 Google Security Operations로 수집하는 방법을 설명합니다.

Windows 네트워크 정책 서버(NPS)는 네트워크 액세스 제어를 위한 인증, 승인, 계정 로그를 생성하는 Microsoft RADIUS 서버입니다. Bindplane 에이전트는 로컬 파일 시스템에서 직접 NPS 계정 로그 파일과 내보낸 이벤트 로그를 수집합니다.

시작하기 전에

다음 기본 요건이 충족되었는지 확인합니다.

  • Google SecOps 인스턴스
  • observiq-otel-collector 서비스 지원이 포함된 Windows Server 2016 이상
  • 프록시 뒤에서 실행하는 경우 Bindplane 에이전트 요구사항에 따라 방화벽 포트가 열려 있는지 확인합니다.
  • 네트워크 정책 서버 역할이 설치된 Windows Server에 대한 관리 액세스 권한

Bindplane 에이전트의 Google SecOps 사용자 인증 정보 가져오기

Google SecOps에 Bindplane 에이전트를 인증하려면 다음 방법 중 하나를 선택합니다.

  • 새 배포: Chronicle API를 사용합니다(옵션 1).
  • 기존 배포: 2027년 7월 20일에 Ingestion API가 중단될 때까지 데이터 수집 인증 파일(옵션 2)을 계속 사용합니다.
  1. Google Cloud 콘솔에 로그인하고 Google SecOps 인스턴스에 연결된 Google Cloud 프로젝트를 선택합니다.
  2. IAM 및 관리자 > 서비스 계정으로 이동합니다.
  3. 서비스 계정 만들기를 클릭합니다.
  4. 다음 구성 세부정보를 제공합니다.
    • 서비스 계정 이름: 계정 이름을 입력합니다(예: bindplane-ingest).
    • 서비스 계정 설명: 설명을 입력합니다(예: Bindplane agent log ingestion).
  5. 만들고 계속하기를 클릭합니다.
  6. 이 서비스 계정에 프로젝트에 대한 액세스 권한 부여 섹션에서 역할 선택을 클릭하고 Chronicle 편집자를 선택합니다.
  7. 계속을 클릭한 다음 완료를 클릭합니다.
  8. 만든 서비스 계정을 클릭한 다음 키 탭으로 이동합니다.
  9. 키 추가 > 새 키 만들기를 클릭합니다.
  10. JSON을 선택하고 만들기를 클릭합니다. 키 파일이 컴퓨터에 다운로드됩니다.
  11. 키 파일을 Bindplane 수집기 디렉터리(Linux의 경우 /opt/observiq-otel-collector/ingestion-auth.json, Windows의 경우 C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json)에 ingestion-auth.json로 저장하거나 config.yaml의 creds_file_path를 업데이트하여 저장한 경로와 일치시킵니다.
  12. IAM 및 관리자 > 설정으로 이동하여 프로젝트 번호를 복사합니다. 내보내기 도구 구성에 필요합니다.

옵션 2: 데이터 수집 인증 파일 다운로드(기존)

  1. Google SecOps 콘솔에 로그인합니다.
  2. 설정 > 데이터 관리 > 수집 에이전트로 이동합니다. SIEM 전용 플랫폼을 사용하는 경우 설정 > 수집 에이전트로 이동합니다.
  3. 데이터 수집 인증 파일을 다운로드합니다.
  4. Bindplane 에이전트가 설치될 시스템에 파일을 안전하게 저장합니다.

Google SecOps 고객 ID 가져오기

  1. Google SecOps 콘솔에 로그인합니다.
  2. 설정 > 관리 > 프로필로 이동합니다. SIEM 전용 플랫폼을 사용하는 경우 설정 > 프로필로 이동합니다.

  3. 조직 세부정보 섹션에서 고객 ID를 복사하여 저장합니다.

Bindplane 에이전트 설치

다음 안내에 따라 Windows 운영체제에 Bindplane 에이전트를 설치합니다.

Windows 설치

  1. 명령 프롬프트 또는 PowerShell을 관리자로 엽니다.

  2. 다음 명령어를 실행합니다.

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

  3. 설치가 완료될 때까지 기다립니다.

  4. 다음을 실행하여 설치를 확인합니다.

    sc query observiq-otel-collector

서비스가 RUNNING으로 표시됩니다.

추가 설치 리소스

추가 설치 옵션 및 문제 해결은 Bindplane 에이전트 설치 가이드를 참조하세요.

로그를 수집하고 Google SecOps로 전송하도록 BindPlane 에이전트 구성

구성 파일 찾기

  • Windows:

    notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

구성 파일 설정

  • config.yaml의 전체 콘텐츠를 다음 구성으로 바꿉니다.

    receivers:
  filelog:
    include:
      - C:\Windows\System32\LogFiles\IN*.log
    start_at: beginning

exporters:
  chronicle/windows_nps:
    protocol: https
    # Region of your instance, for example us, europe, asia-southeast1
    location: <LOCATION>
    # Project number of the Google Cloud project linked to the instance
    project: '<PROJECT_NUMBER>'
    compression: gzip
    creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
    customer_id: '<customer_id>'
    endpoint: chronicle.googleapis.com
    log_type: WINDOWS_NET_POLICY_SERVER
    raw_log_field: body
    ingestion_labels:
      env: production

service:
  pipelines:
    logs/nps_to_chronicle:
      receivers:
        - filelog
      exporters:
        - chronicle/windows_nps

구성 매개변수

다음 자리표시자를 바꿉니다.

  • 수신자 구성:

    • filelog: 디스크에서 로그 파일을 수집하는 수신자 유형
    • include: 모니터링할 파일 경로 목록입니다. NPS 계정 로그 파일(예: C:\Windows\System32\LogFiles\IN*.log) 또는 내보낸 이벤트 로그(예: C:\Logs\nps\*.evtx)의 위치로 설정합니다.
    • start_at: 기존 로그를 읽으려면 beginning로 설정하고 새 항목만 읽으려면 end로 설정합니다.

  • 내보내기 도구 구성:

    • windows_nps: 내보내기 도구의 설명이 포함된 이름
    • creds_file_path: 서비스 계정 JSON 키 파일의 전체 경로(옵션 1):
      • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
    • <customer_id>: 이전 단계의 고객 ID
    • location: <LOCATION>을 Google SecOps 인스턴스의 리전으로 바꿉니다(예: us, europe 또는 asia-southeast1). 내보내기 도구는 이 값으로 chronicle.googleapis.com에 프리픽스를 추가합니다. 전체 목록은 리전 엔드포인트를 참조하세요.
    • project: <PROJECT_NUMBER>를 IAM 및 관리자 > 설정의 프로젝트 번호로 바꿉니다.
    • endpoint: chronicle.googleapis.com로 설정된 상태로 유지합니다.
    • WINDOWS_NET_POLICY_SERVER: Chronicle에 표시되는 로그 유형
    • ingestion_labels: YAML 형식의 선택적 라벨(예: env: production)

  • 파이프라인 구성:

    • nps_to_chronicle: 파이프라인을 설명하는 이름

기존 수집 API 내보내기 도구

  • 옵션 2의 데이터 수집 인증 파일을 사용하는 경우 exporters 블록을 다음으로 바꿉니다. creds_file_path를 데이터 수집 인증 파일의 경로로 설정하고 인스턴스가 미국 외부에 있는 경우 malachiteingestion-pa.googleapis.com를 리전 엔드포인트(예: europe-malachiteingestion-pa.googleapis.com)로 바꿉니다.

    exporters:
  chronicle/windows_nps:
    compression: gzip
    creds_file_path: 'C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json'
    customer_id: '<customer_id>'
    endpoint: malachiteingestion-pa.googleapis.com
    log_type: WINDOWS_NET_POLICY_SERVER
    raw_log_field: body
    ingestion_labels:
      env: production

구성 파일 저장

  • 수정 후 파일을 저장합니다.
    • Windows: 파일 > 저장을 클릭합니다.

Bindplane 에이전트를 다시 시작하여 변경사항을 적용합니다.

Windows에서 Bindplane 에이전트를 다시 시작하려면 다음 안내를 따르세요.

  1. 다음 옵션 중 하나를 선택합니다.

    • 관리자 권한으로 명령 프롬프트 또는 PowerShell을 실행합니다.
    net stop observiq-otel-collector && net start observiq-otel-collector
    • 서비스 콘솔:
      1. Win+R를 누르고 services.msc를 입력한 다음 Enter 키를 누릅니다.
      2. observIQ OpenTelemetry Collector를 찾습니다.
      3. 마우스 오른쪽 버튼으로 클릭하고 다시 시작을 선택합니다.

  2. 서비스가 실행 중인지 확인합니다.

    sc query observiq-otel-collector

  3. 로그에서 오류를 확인합니다.

    type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

Windows NPS 로그 내보내기 구성

Windows NPS는 디스크에 저장된 NPS 계정 로그 파일(IAS 형식)과 Windows 이벤트 로그의 NPS 관련 이벤트라는 두 가지 유형의 로그를 생성합니다. 둘 중 하나 또는 둘 다 수집할 수 있습니다.

옵션 1: NPS 계정 로그 파일 수집(기본값)

NPS 회계 로그 파일은 기본적으로 C:\Windows\System32\LogFiles\` with filenames starting withIN(for example,IN2301.log`에 저장됩니다.

  1. 서버 관리자 > 네트워크 정책 서버를 엽니다.
  2. 회계 > 회계 구성으로 이동합니다.
  3. 텍스트 파일에 로깅(로컬)이 사용 설정되어 있는지 확인합니다.
  4. 로그 파일 디렉터리(기본값: %systemroot%\system32\LogFiles)를 기록해 둡니다.

  5. config.yaml의 BindPlane 에이전트 include 경로가 로그 파일 위치와 일치하는지 확인합니다.

옵션 2: NPS 이벤트 로그 내보내기

NPS 인증 이벤트(이벤트 ID 6272~6280)는 Windows 보안 이벤트 로그에 기록됩니다.

  1. 내보낸 로그 파일을 저장할 디렉터리를 만듭니다.

    mkdir C:\Logs\nps

  2. wevtutil를 사용하여 NPS 관련 보안 관련 활동 내보내기:

    wevtutil epl "Security" /q:"*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID>=6272 and EventID<=6280)]]" C:\Logs\nps\nps-security.evtx

  3. (선택사항) Windows 작업 스케줄러를 사용하여 정기 내보내기 예약:

    $action = New-ScheduledTaskAction -Execute "wevtutil" -Argument 'epl "Security" /q:"*[System[Provider[@Name=''Microsoft-Windows-Security-Auditing''] and (EventID>=6272 and EventID<=6280)]]" C:\Logs\nps\nps-security.evtx /ow:true'
$trigger = New-ScheduledTaskTrigger -RepetitionInterval (New-TimeSpan -Hours 1) -Once -At (Get-Date)
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "ExportNPSLogs" -Description "Export Windows NPS logs for Bindplane agent"

  4. config.yaml의 BindPlane 에이전트 include 경로를 일치하도록 업데이트합니다.

    include:
  - C:\Logs\nps\*.evtx

UDM 매핑 테이블

로그 필드 UDM 매핑 로직
EventID about 매핑된 값(총 5개, 예: 4800, 4801 → session_about, 5137, 5141 → `token_about…)
SourceName about 매핑된 값(총 6개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
about_host about 병합됨
about_token about 병합됨
jsonPayload_about about 병합됨
session_about about 병합됨
token_about about 병합됨
fqdn about.administrative_domain 직접 매핑됨
param1 about.file.full_path 직접 매핑됨
DCDNSName about.hostname 직접 매핑됨
LocalEMPrincipalName about.hostname 직접 매핑됨
EventID about.ip 매핑됨: 4908, 4964 → address
SourceName about.ip 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
address about.ip 병합됨
EventID about.labels 매핑된 값(총 15개, 예: 4625, 4776, 4794 → keywords_label, 4774, 4775 → `map…)
ImpersonationLevel_label about.labels 병합됨
RestrictedAdminMode_label about.labels 병합됨
SourceName about.labels 매핑된 값(총 23개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec…)
additional_data_label about.labels 병합됨
audit_policy_changes_label about.labels 병합됨
ca_label about.labels 병합됨
category_label about.labels 병합됨
keywords_label about.labels 병합됨
labels0 about.labels 병합됨
labels101 about.labels 병합됨
labels202 about.labels 병합됨
labels401 about.labels 병합됨
level_label about.labels 병합됨
mapped_name_label about.labels 병합됨
mapping_by_label about.labels 병합됨
mapping_channel about.labels 병합됨
mapping_opcode about.labels 병합됨
system_keyword_label about.labels 병합됨
task_label about.labels 병합됨
thread_id_label about.labels 병합됨
value_is_near_0 about.labels 매핑됨: true → labels101
value_is_near_1 about.labels 매핑됨: true → labels202
version_label about.labels 병합됨
param3 about.registry.registry_key 직접 매핑됨
EventID about.resource.attribute.labels 매핑됨: 4908, 4964 → label_for_resource_attribute
SourceName about.resource.attribute.labels 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `l…
label_for_resource_attribute about.resource.attribute.labels 병합됨
ProviderName about.resource.name 직접 매핑됨
ProviderKey about.resource.product_object_id 직접 매핑됨
temp about.resource.product_object_id 직접 매핑됨
Url about.url 직접 매핑됨
cacheDenyUrls about.url 직접 매핑됨
EventID about.user.attribute.labels 매핑됨: 4765, 4766 → about_user_label, 4908, 4964 → about_user_label, ` 4908, …
SourceName about.user.attribute.labels 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
about_user_label about.user.attribute.labels 병합됨
label_for_user_attribute about.user.attribute.labels 병합됨
SourceUserName about.user.userid 직접 매핑됨
about_user_windows_sid about.user.windows_sid 직접 매핑됨
EventID additiona.fields 매핑됨: 4908, 4964 → function_label, 4104, 4105 → function_label
SourceName additiona.fields 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `f…
function_label additiona.fields 병합됨
AccountAvailableKeys_label additional.fields 병합됨
AccountSupportedEncryptionTypes_label additional.fields 병합됨
ActiveProfile_label additional.fields 병합됨
AdvancedOptions_label additional.fields 병합됨
AppCorrelationID_label additional.fields 병합됨
AppId_label additional.fields 병합됨
AttributeSyntaxOID_label additional.fields 병합됨
AuditResult_label additional.fields 병합됨
AuditType_label additional.fields 병합됨
AuthProtocol_label additional.fields 병합됨
Binding_type_label additional.fields 병합됨
Cache_Control_label additional.fields 병합됨
ClaimsProvider_label additional.fields 병합됨
ClientAdvertizedEncryptionTypes_label additional.fields 병합됨
ClientCreationTime_label additional.fields 병합됨
CommandName_label additional.fields 병합됨
CommandType_label additional.fields 병합됨
ConfigAccessPolicy_label additional.fields 병합됨
ConfiguredNames_label additional.fields 병합됨
Connection_label additional.fields 병합됨
Content_Type_label additional.fields 병합됨
DCAvailableKeys_label additional.fields 병합됨
DCSupportedEncryptionTypes_label additional.fields 병합됨
DN_label additional.fields 병합됨
DSType_label additional.fields 병합됨
DetailSequence_label additional.fields 병합됨
DetailTotal_label additional.fields 병합됨
Details_label additional.fields 병합됨
DeviceAuth_label additional.fields 병합됨
DeviceId_label additional.fields 병합됨
DirectiveName_label additional.fields 병합됨
DisableIntegrityChecks_label additional.fields 병합됨
Endpoint_label additional.fields 병합됨
EngineVersion_label additional.fields 병합됨
ErrorCode_label additional.fields 병합됨
EventID additional.fields 매핑된 값(총 420개, 예: 4719 → additional_field_task_category, ` 4692, 4693, 4694… )
FQDN_label additional.fields 병합됨
FWLink_label additional.fields 병합됨
FailureType_label additional.fields 병합됨
FaultingApplicationPath_label additional.fields 병합됨
FaultingModulePath_label additional.fields 병합됨
FlightSigning_label additional.fields 병합됨
ForwardedIpAddress_label additional.fields 병합됨
GroupPolicyApplied_label additional.fields 병합됨
HandleId_label additional.fields 병합됨
HandleId_label_1 additional.fields 병합됨
HostID_label additional.fields 병합됨
HostId_label additional.fields 병합됨
HostName_label additional.fields 병합됨
HostVersion_label additional.fields 병합됨
Host_label additional.fields 병합됨
HypervisorDebug_label additional.fields 병합됨
HypervisorLaunchType_label additional.fields 병합됨
HypervisorLoadOptions_label additional.fields 병합됨
ImpersonationLevel_label additional.fields 병합됨
IpAddress_label additional.fields 병합됨
KernelDebug_label additional.fields 병합됨
KeyLength_label additional.fields 병합됨
LmPackageName_label additional.fields 병합됨
LoadOptions_label additional.fields 병합됨
LogDroppedPacketsEnabled_label additional.fields 병합됨
LogSuccessfulConnectionsEnabled_label additional.fields 병합됨
MandatoryLabel_label additional.fields 병합됨
MessageNumber_label additional.fields 병합됨
MessageTotal_label additional.fields 병합됨
Message_label additional.fields 병합됨
MfaMethod_label additional.fields 병합됨
MfaPerformed_label additional.fields 병합됨
MulticastFlowsEnabled_label additional.fields 병합됨
NetworkIpAddress_label additional.fields 병합됨
NetworkLocation_label additional.fields 병합됨
NewEngineState_label additional.fields 병합됨
NewState_label additional.fields 병합됨
NotificationInterval_label additional.fields 병합됨
OAuthClientId_label additional.fields 병합됨
OAuthGrant_label additional.fields 병합됨
ObjectServer_label additional.fields 병합됨
OpCorrelationID_label additional.fields 병합됨
OperationMode_label additional.fields 병합됨
OperationType_label additional.fields 병합됨
Operation_label additional.fields 병합됨
PacketType_label additional.fields 병합됨
Payload_label additional.fields 병합됨
PipelineID_label additional.fields 병합됨
PipelineId_label additional.fields 병합됨
PreAuthEncryptionType_label additional.fields 병합됨
PreviousEngineState_label additional.fields 병합됨
PrimaryAuth_label additional.fields 병합됨
Product_Name_label additional.fields 병합됨
Product_Version_label additional.fields 병합됨
Profile_label additional.fields 병합됨
Profiles_label additional.fields 병합됨
ProxyIpAddress_label additional.fields 병합됨
ProxyServer_label additional.fields 병합됨
RelyingParty_label additional.fields 병합됨
RemoteAdminEnabled_label additional.fields 병합됨
RemoteEventLogging_label additional.fields 병합됨
RequestTicketHash_label additional.fields 병합됨
ResourceManager_label additional.fields 병합됨
ResponseTicketHash_label additional.fields 병합됨
RestrictedAdminMode_label additional.fields 병합됨
ReturnCode_label additional.fields 병합됨
RunspaceID_label additional.fields 병합됨
RunspaceId_label additional.fields 병합됨
SequenceNumber_label additional.fields 병합됨
Server_label additional.fields 병합됨
ServiceAvailableKeys_label additional.fields 병합됨
ServiceStartType_label additional.fields 병합됨
ServiceSupportedEncryptionTypes_label additional.fields 병합됨
ServiceType_label additional.fields 병합됨
SessionKeyEncryptionType_label additional.fields 병합됨
SkuId_label additional.fields 병합됨
SourceName additional.fields 매핑된 값(총 564개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows se… )
SsoBindingValidationLevel_label additional.fields 병합됨
StartType_label additional.fields 병합됨
SubjectLogonId_label additional.fields 병합됨
THostName_label additional.fields 병합됨
TargetLinkedLogonId_label additional.fields 병합됨
TestSigning_label additional.fields 병합됨
Ticket_type_label additional.fields 병합됨
TokenBindingProvidedId_label additional.fields 병합됨
TokenBindingReferredId_label additional.fields 병합됨
TokenElevationType_label additional.fields 병합됨
TransactionId_label additional.fields 병합됨
TransmittedServices_label additional.fields 병합됨
Trigger_label additional.fields 병합됨
UserAgentString_label additional.fields 병합됨
UserId_label additional.fields 병합됨
VirtualAccount_label additional.fields 병합됨
VsmLaunchType_label additional.fields 병합됨
X_MS_Endpoint_Absolute_Path_label1 additional.fields 병합됨
acc_mask_label additional.fields 병합됨
access_mask_label additional.fields 병합됨
account_name_label additional.fields 병합됨
acct_authentic additional.fields 병합됨
acct_input_octets additional.fields 병합됨
acct_input_packets additional.fields 병합됨
acct_link_count additional.fields 병합됨
acct_output_octets additional.fields 병합됨
acct_output_packets additional.fields 병합됨
acct_session_time additional.fields 병합됨
acct_status_type additional.fields 병합됨
activity_id_label additional.fields 병합됨
add_label additional.fields 병합됨
add_labels202 additional.fields 병합됨
addition_ObjectClass additional.fields 병합됨
additional_ClientAdvertizedEncryptionTypes additional.fields 병합됨
additional_ParameterBinding_Add-Type additional.fields 병합됨
additional_Requested_Operation_Desired_Access additional.fields 병합됨
additional_TargetDomainName additional.fields 병합됨
additional_The_SSPI_client_process_is_SYSTEM_PID additional.fields 병합됨
additional_access_mask additional.fields 병합됨
additional_data_label additional.fields 병합됨
additional_field additional.fields 병합됨
additional_field_subject_domain_name additional.fields 병합됨
additional_field_task_category additional.fields 병합됨
additional_information_label additional.fields 병합됨
additional_member_name additional.fields 병합됨
additional_user_data additional.fields 병합됨
attribute_label additional.fields 병합됨
attribute_ldap_display_name_label additional.fields 병합됨
attribute_selection_label additional.fields 병합됨
attributes_preventing_optimization_label additional.fields 병합됨
audit_policy_changes_label additional.fields 병합됨
audit_schema_version_label additional.fields 병합됨
authentication_type_label additional.fields 병합됨
backup_type_label additional.fields 병합됨
ca_label additional.fields 병합됨
cab_id_label additional.fields 병합됨
caller_identity_label additional.fields 병합됨
caller_user_name_label additional.fields 병합됨
category_label additional.fields 병합됨
certificate_identity_label additional.fields 병합됨
charset_label additional.fields 병합됨
check_field_server_names additional.fields 병합됨
class additional.fields 병합됨
class_type_label additional.fields 병합됨
clean_pages_modified_label additional.fields 병합됨
client_options1_label additional.fields 병합됨
client_options_label additional.fields 병합됨
client_request_id_label additional.fields 병합됨
connect_info additional.fields 병합됨
connect_options_label additional.fields 병합됨
content_length_label additional.fields 병합됨
data_1_label additional.fields 병합됨
data_2_label additional.fields 병합됨
data_3_label additional.fields 병합됨
dirty_pages_modified_label additional.fields 병합됨
disposition_label additional.fields 병합됨
domain_label additional.fields 병합됨
environment_label additional.fields 병합됨
event_data_d_word_val_label additional.fields 병합됨
event_data_method_label additional.fields 병합됨
event_data_p10_label additional.fields 병합됨
event_data_p11_label additional.fields 병합됨
event_data_p12_label additional.fields 병합됨
event_data_p13_label additional.fields 병합됨
event_data_p14_label additional.fields 병합됨
event_data_p15_label additional.fields 병합됨
event_data_p16_label additional.fields 병합됨
event_data_p17_label additional.fields 병합됨
event_data_p18_label additional.fields 병합됨
event_data_p19_label additional.fields 병합됨
event_data_p1_label additional.fields 병합됨
event_data_p20_label additional.fields 병합됨
event_data_p21_label additional.fields 병합됨
event_data_p22_label additional.fields 병합됨
event_data_p23_label additional.fields 병합됨
event_data_p24_label additional.fields 병합됨
event_data_p25_label additional.fields 병합됨
event_data_p26_label additional.fields 병합됨
event_data_p27_label additional.fields 병합됨
event_data_p28_label additional.fields 병합됨
event_data_p29_label additional.fields 병합됨
event_data_p2_label additional.fields 병합됨
event_data_p30_label additional.fields 병합됨
event_data_p31_label additional.fields 병합됨
event_data_p32_label additional.fields 병합됨
event_data_p33_label additional.fields 병합됨
event_data_p34_label additional.fields 병합됨
event_data_p35_label additional.fields 병합됨
event_data_p36_label additional.fields 병합됨
event_data_p37_label additional.fields 병합됨
event_data_p38_label additional.fields 병합됨
event_data_p39_label additional.fields 병합됨
event_data_p3_label additional.fields 병합됨
event_data_p40_label additional.fields 병합됨
event_data_p41_label additional.fields 병합됨
event_data_p42_label additional.fields 병합됨
event_data_p43_label additional.fields 병합됨
event_data_p44_label additional.fields 병합됨
event_data_p45_label additional.fields 병합됨
event_data_p46_label additional.fields 병합됨
event_data_p47_label additional.fields 병합됨
event_data_p48_label additional.fields 병합됨
event_data_p49_label additional.fields 병합됨
event_data_p4_label additional.fields 병합됨
event_data_p50_label additional.fields 병합됨
event_data_p51_label additional.fields 병합됨
event_data_p52_label additional.fields 병합됨
event_data_p53_label additional.fields 병합됨
event_data_p54_label additional.fields 병합됨
event_data_p55_label additional.fields 병합됨
event_data_p56_label additional.fields 병합됨
event_data_p57_label additional.fields 병합됨
event_data_p58_label additional.fields 병합됨
event_data_p59_label additional.fields 병합됨
event_data_p5_label additional.fields 병합됨
event_data_p60_label additional.fields 병합됨
event_data_p61_label additional.fields 병합됨
event_data_p62_label additional.fields 병합됨
event_data_p63_label additional.fields 병합됨
event_data_p64_label additional.fields 병합됨
event_data_p65_label additional.fields 병합됨
event_data_p66_label additional.fields 병합됨
event_data_p67_label additional.fields 병합됨
event_data_p68_label additional.fields 병합됨
event_data_p69_label additional.fields 병합됨
event_data_p6_label additional.fields 병합됨
event_data_p70_label additional.fields 병합됨
event_data_p71_label additional.fields 병합됨
event_data_p72_label additional.fields 병합됨
event_data_p73_label additional.fields 병합됨
event_data_p74_label additional.fields 병합됨
event_data_p75_label additional.fields 병합됨
event_data_p76_label additional.fields 병합됨
event_data_p77_label additional.fields 병합됨
event_data_p78_label additional.fields 병합됨
event_data_p79_label additional.fields 병합됨
event_data_p7_label additional.fields 병합됨
event_data_p80_label additional.fields 병합됨
event_data_p81_label additional.fields 병합됨
event_data_p82_label additional.fields 병합됨
event_data_p83_label additional.fields 병합됨
event_data_p84_label additional.fields 병합됨
event_data_p85_label additional.fields 병합됨
event_data_p86_label additional.fields 병합됨
event_data_p87_label additional.fields 병합됨
event_data_p88_label additional.fields 병합됨
event_data_p89_label additional.fields 병합됨
event_data_p8_label additional.fields 병합됨
event_data_p90_label additional.fields 병합됨
event_data_p91_label additional.fields 병합됨
event_data_p92_label additional.fields 병합됨
event_data_p9_label additional.fields 병합됨
event_data_param1_label additional.fields 병합됨
event_data_param2_label additional.fields 병합됨
event_data_param3_label additional.fields 병합됨
event_data_param4_label additional.fields 병합됨
event_data_param5_label additional.fields 병합됨
event_data_param6_label additional.fields 병합됨
event_data_param7_label additional.fields 병합됨
event_data_processing_mode_label additional.fields 병합됨
event_data_processing_time_in_milliseconds_label additional.fields 병합됨
event_data_stage_label additional.fields 병합됨
event_data_support_info1_label additional.fields 병합됨
event_data_support_info2_label additional.fields 병합됨
event_data_thumbprint_label additional.fields 병합됨
event_id_label additional.fields 병합됨
event_in_seq_label additional.fields 병합됨
event_time_label additional.fields 병합됨
exception_info_label additional.fields 병합됨
expensive_search_operations_label additional.fields 병합됨
failure_reason_label additional.fields 병합됨
framework_version_label additional.fields 병합됨
hashed_bucket_label additional.fields 병합됨
inefficient_search_operations_label additional.fields 병합됨
install_date_label additional.fields 병합됨
is_column_permission_label additional.fields 병합됨
is_dac_label additional.fields 병합됨
keywords_label additional.fields 병합됨
label01 additional.fields 병합됨
label02 additional.fields 병합됨
label03 additional.fields 병합됨
label461 additional.fields 병합됨
label462 additional.fields 병합됨
label463 additional.fields 병합됨
label46561 additional.fields 병합됨
label46562 additional.fields 병합됨
label46563 additional.fields 병합됨
label46564 additional.fields 병합됨
label46565 additional.fields 병합됨
label46571 additional.fields 병합됨
label46572 additional.fields 병합됨
label47681 additional.fields 병합됨
label47682 additional.fields 병합됨
label501 additional.fields 병합됨
label601 additional.fields 병합됨
label_for_additional_fields additional.fields 병합됨
labels0 additional.fields 병합됨
labels401 additional.fields 병합됨
labels46411 additional.fields 병합됨
labels46412 additional.fields 병합됨
labels46413 additional.fields 병합됨
labels46414 additional.fields 병합됨
labels46415 additional.fields 병합됨
labels46416 additional.fields 병합됨
labels46417 additional.fields 병합됨
level_label additional.fields 병합됨
logon_guid_label additional.fields 병합됨
logon_id_label additional.fields 병합됨
mapped_name_label additional.fields 병합됨
mapping_by_label additional.fields 병합됨
mapping_channel additional.fields 병합됨
mapping_opcode additional.fields 병합됨
method additional.fields 병합됨
method_executed_label additional.fields 병합됨
namespace_label additional.fields 병합됨
nas_port_type_label additional.fields 병합됨
network_information_label additional.fields 병합됨
new_obj_dn_label additional.fields 병합됨
new_target_user_name_label additional.fields 병합됨
number_of_search_operations_label additional.fields 병합됨
object_class_label additional.fields 병합됨
object_dn_label additional.fields 병합됨
operation_type_label additional.fields 병합됨
p10_label additional.fields 병합됨
p2_label additional.fields 병합됨
p3_label additional.fields 병합됨
p4_label additional.fields 병합됨
p5_label additional.fields 병합됨
p6_label additional.fields 병합됨
p7_label additional.fields 병합됨
p8_label additional.fields 병합됨
p9_label additional.fields 병합됨
package_label additional.fields 병합됨
packet_data_size_label additional.fields 병합됨
pages_preread_from_disk_label additional.fields 병합됨
pages_read_from_disk_label additional.fields 병합됨
pages_referenced_label additional.fields 병합됨
parent_id_label additional.fields 병합됨
payload_label additional.fields 병합됨
perm_consumer_label additional.fields 병합됨
permission_bitmask_label additional.fields 병합됨
platform_label additional.fields 병합됨
pooled_connection_label additional.fields 병합됨
problem_signature_label additional.fields 병합됨
protocol_seq_label additional.fields 병합됨
proxy_dns_name_label additional.fields 병합됨
query_string_label additional.fields 병합됨
reason_code additional.fields 병합됨
reason_code_labels additional.fields 병합됨
report_id_label additional.fields 병합됨
report_status_label additional.fields 병합됨
req_id_label additional.fields 병합됨
request_detail_label additional.fields 병합됨
request_id_label additional.fields 병합됨
request_path_label additional.fields 병합됨
requester_label additional.fields 병합됨
response_detail_label additional.fields 병합됨
response_label additional.fields 병합됨
returned_entries_label additional.fields 병합됨
search_scope_label additional.fields 병합됨
search_time_ms_label additional.fields 병합됨
sequence_group_id_label additional.fields 병합됨
sequence_number_label additional.fields 병합됨
session_label additional.fields 병합됨
sidtype_label additional.fields 병합됨
source_group_label additional.fields 병합됨
source_module_label additional.fields 병합됨
span_id_label additional.fields 병합됨
stage additional.fields 병합됨
starting_node_label additional.fields 병합됨
statement_label additional.fields 병합됨
subject_key_label additional.fields 병합됨
subject_label additional.fields 병합됨
subject_logon_id_label additional.fields 병합됨
subject_logon_id_label_1 additional.fields 병합됨
subject_machine_name_label additional.fields 병합됨
subject_user_name_label additional.fields 병합됨
suppress_count_label additional.fields 병합됨
suppress_label additional.fields 병합됨
system_keyword_label additional.fields 병합됨
target_label additional.fields 병합됨
target_labels additional.fields 병합됨
target_logon_id_label additional.fields 병합됨
target_relying_party_label additional.fields 병합됨
target_user_id_label additional.fields 병합됨
temp_additional_event_category additional.fields 병합됨
temp_additional_event_type additional.fields 병합됨
temp_additional_insert_id additional.fields 병합됨
temp_additional_log_name additional.fields 병합됨
temp_additional_qualifiers additional.fields 병합됨
temp_additional_time_gen additional.fields 병합됨
temp_additional_time_written additional.fields 병합됨
temp_query additional.fields 병합됨
these_files_may_be_available_here_label additional.fields 병합됨
thread_id_label additional.fields 병합됨
through_proxy_label additional.fields 병합됨
ticket_options_label additional.fields 병합됨
time_interval_hours_label additional.fields 병합됨
token_@_xmlns_ additional.fields 병합됨
token_subject_logon_id additional.fields 병합됨
trace_id_label additional.fields 병합됨
transaction_id_label additional.fields 병합됨
uf_type_label additional.fields 병합됨
uf_version_label additional.fields 병합됨
used_indexes_label additional.fields 병합됨
user_data_0x8000003F_@_xmlns__label additional.fields 병합됨
user_data_0x8000003F_process_id_label additional.fields 병합됨
user_data_0x8000003F_providers_in_host_label additional.fields 병합됨
user_data_0x8000003F_quota_name_label additional.fields 병합됨
user_data_0x8000003F_quota_threshold_label additional.fields 병합됨
user_data_0x8000003F_quota_value_label additional.fields 병합됨
user_defined_event_id_label additional.fields 병합됨
user_defined_information_label additional.fields 병합됨
user_id_label additional.fields 병합됨
value_is_near_1 additional.fields 매핑됨: true → add_labels202
var_client_name additional.fields 병합됨
var_workstation_name additional.fields 병합됨
version_label additional.fields 병합됨
visited_entries_label additional.fields 병합됨
vsad_label additional.fields 병합됨
x_ms_adfs_proxy_client_ip_label additional.fields 병합됨
x_ms_client_application_label additional.fields 병합됨
x_ms_client_user_agent_label additional.fields 병합됨
x_ms_forwarded_client_ip_label additional.fields 병합됨
x_ms_proxy_label additional.fields 병합됨
xmlns_label1 additional.fields 병합됨
LogonType extensions.auth.auth_details 이름 변경/매핑됨
EventID extensions.auth.mechanism 매핑됨: 4908, 4964 → auth_mechanism1, 4908, 4964 → auth_mechanism, ` 1202,1203…
SourceName extensions.auth.mechanism 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
auth_mechanism extensions.auth.mechanism 병합됨
auth_mechanism1 extensions.auth.mechanism 병합됨
auth_type extensions.auth.type 이름 변경/매핑됨
EventID intermediary 매핑됨: 4908, 4964 → intermediary_label, ` 8015, 8018, 8019, 8020, 8027, 8033, 8010, …
SourceName intermediary 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `i…
intermediary_label intermediary 병합됨
ComputerName intermediary.hostname 직접 매핑됨
HostName intermediary.hostname 직접 매핑됨
Hostname intermediary.hostname 직접 매핑됨
intermediary_ip intermediary.ip 병합됨
metadata_description metadata.description 직접 매핑됨
Detection Time metadata.event_timestamp ISO8601(으)로 파싱됨
EventReceivedTime metadata.event_timestamp yyyy-MM-dd HH:mm:ss(으)로 파싱됨
EventTime metadata.event_timestamp ISO8601(으)로 파싱됨
NewTime metadata.event_timestamp ISO8601(으)로 파싱됨
PasswordLastSet metadata.event_timestamp M/dd/yyyy H:mm:ss A(으)로 파싱됨
PreviousTime metadata.event_timestamp ISO8601(으)로 파싱됨
ValidFrom metadata.event_timestamp ISO8601(으)로 파싱됨
ValidTo metadata.event_timestamp ISO8601(으)로 파싱됨
event_time metadata.event_timestamp MMM dd HH:mm:ss(으)로 파싱됨
event_timestamp metadata.event_timestamp yyyy-MM-dd HH:mm:ss(으)로 파싱됨
eventtime1 metadata.event_timestamp UNIX_MS(으)로 파싱됨
receiveTimestamp metadata.event_timestamp yyyy-MM-ddTHH:mm:ssZ(으)로 파싱됨
syslog_ts metadata.event_timestamp yyyy-MM-ddTHH:mm:ss Z(으)로 파싱됨
EventID metadata.event_type 매핑된 값(총 18개, 예: 4908, 4964 → STATUS_UPDATE, 4908, 4964 → `GENERIC_… )
SourceName metadata.event_type 매핑된 값(총 9개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
event_type metadata.event_type 직접 매핑됨
has_principal metadata.event_type 매핑됨: true → NETWORK_CONNECTION, true → STATUS_UPDATE
udm_event_type metadata.event_type 이름 변경/매핑됨
ProviderGuid metadata.product_deployment_id 이름 변경/매핑됨
EventID metadata.product_event_type 직접 매핑됨
product_event_type metadata.product_event_type 직접 매핑됨
RecordNumber metadata.product_log_id 이름 변경/매핑됨
SourceName metadata.product_name 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `M…
EventID metadata.vendor_name 매핑됨: 4908, 4964 → Microsoft
SourceName metadata.vendor_name 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `M…
app_protocol network.application_protocol 이름 변경/매핑됨
Direction network.direction 이름 변경/매핑됨
EventID network.dns.questions 매핑됨: 4908, 4964 → questions, 1014, 3008 → questions
SourceName network.dns.questions 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `q…
questions network.dns.questions 병합됨
http_method network.http.method 직접 매핑됨
_userAgentString network.http.parsed_user_agent 이름 변경/매핑됨
_userAgentString network.http.user_agent 직접 매핑됨
ac-user-agent network.http.user_agent 직접 매핑됨
ip_protocol_out network.ip_protocol 이름 변경/매핑됨
AcctMultiSsnID network.session_id 직접 매핑됨
SessionID network.session_id 직접 매핑됨
SessionId network.session_id 직접 매핑됨
SessionName network.session_id 이름 변경/매핑됨
session_id network.session_id 직접 매핑됨
CAName network.tls.client.certificate.issuer 직접 매핑됨
Issuer network.tls.client.certificate.issuer 이름 변경/매핑됨
LocalMMIssuingCA network.tls.client.certificate.issuer 직접 매핑됨
CertificateHash network.tls.client.certificate.md5 직접 매핑됨
SerialNumber network.tls.client.certificate.serial 직접 매핑됨
client_certificate_serial network.tls.client.certificate.serial 이름 변경/매핑됨
CertificateHash network.tls.client.certificate.sha1 직접 매핑됨
client_certificate_sha1 network.tls.client.certificate.sha1 이름 변경/매핑됨
CertificateHash network.tls.client.certificate.sha256 직접 매핑됨
client_certificate_subject network.tls.client.certificate.subject 이름 변경/매핑됨
RemoteMMIssuingCA network.tls.server.certificate.issuer 직접 매핑됨
server_certificate_subject network.tls.server.certificate.subject 이름 변경/매핑됨
SourceModuleType observer.application 이름 변경/매핑됨
IssuingKDC observer.asset.asset_id 직접 매핑됨
EventID observer.labels 매핑됨: 4908, 4964 → verb_label, 4908, 4964 → source_module_label
SourceName observer.labels 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
source_module_label observer.labels 병합됨
verb_label observer.labels 병합됨
AccountDomain principal.administrative_domain 이름 변경/매핑됨
CallerDomainName principal.administrative_domain 이름 변경/매핑됨
Domain principal.administrative_domain 이름 변경/매핑됨
SubjectDomainName principal.administrative_domain 이름 변경/매핑됨
administrative_domain principal.administrative_domain 직접 매핑됨
principal_domain_name principal.administrative_domain 이름 변경/매핑됨
principal_application principal.application 이름 변경/매핑됨
src_application principal.application 이름 변경/매핑됨
device-uid principal.asset.asset_id 직접 매핑됨
EventID principal.asset.attribute.labels 매핑된 값(총 7개, 예: 4908, 4964 → server_principal_id_label, 4908, 4964 … )
SourceName principal.asset.attribute.labels 매핑된 값(총 7개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
label_for_principal_asset principal.asset.attribute.labels 병합됨
server_instance_name_label principal.asset.attribute.labels 병합됨
server_principal_id_label principal.asset.attribute.labels 병합됨
server_principal_name_label principal.asset.attribute.labels 병합됨
server_principal_sid_label principal.asset.attribute.labels 병합됨
session_server_principal_name_label principal.asset.attribute.labels 병합됨
token_new principal.asset.attribute.labels 병합됨
hardware principal.asset.hardware 병합됨
Hostname principal.asset.hostname 직접 매핑됨
auth_server_host principal.asset.hostname 직접 매핑됨
hostname principal.asset.hostname 직접 매핑됨
principal_asset_hostname principal.asset.hostname 이름 변경/매핑됨
principal_hostname principal.asset.hostname 직접 매핑됨
FramedIPAddress principal.asset.ip 병합됨
SourceName principal.asset.ip 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `F…
calling_station_id principal.asset.ip 병합됨
src_ip principal.asset.ip 병합됨
var_domain_name principal.asset.network_domain 직접 매핑됨
MachineInventory principal.asset.platform_software.platform_version 이름 변경/매핑됨
device-platform-version principal.asset.platform_software.platform_version 직접 매핑됨
platform_version principal.asset.platform_software.platform_version 이름 변경/매핑됨
device-uid-global principal.asset.product_object_id 직접 매핑됨
EventID principal.asset.software 매핑됨: 4908, 4964 → software_version
SourceName principal.asset.software 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `s…
software_version principal.asset.software 병합됨
ClientRealm principal.domain.name 직접 매핑됨
Path principal.file.full_path 직접 매핑됨
PrincipalFileName principal.file.full_path 이름 변경/매핑됨
Hostname principal.hostname 직접 매핑됨
auth_server_host principal.hostname 직접 매핑됨
hostname principal.hostname 직접 매핑됨
principal_asset_hostname principal.hostname 직접 매핑됨
principal_hostname principal.hostname 직접 매핑됨
EventID principal.ip 매핑됨: 4625, 4776, 4794 → temp_ip, 4908, 4964 → ip_address, 4908, 4964 → …
FramedIPAddress principal.ip 병합됨
SourceName principal.ip 매핑된 값(총 5개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu…
calling_station_id principal.ip 병합됨
ip principal.ip 병합됨
ip_address principal.ip 병합됨
principal_ip principal.ip 병합됨
principal_ip1 principal.ip 병합됨
src_ip principal.ip 병합됨
temp_ip principal.ip 병합됨
AdvancedOptions_label principal.labels 병합됨
ClientCreationTime_label principal.labels 병합됨
ConfigAccessPolicy_label principal.labels 병합됨
DisableIntegrityChecks_label principal.labels 병합됨
EventID principal.labels 매핑된 값(총 28개, 예: 4692, 4693, 4694, 4695, 4983, 4984 → `subject_logon_id_lab…
FlightSigning_label principal.labels 병합됨
HypervisorDebug_label principal.labels 병합됨
HypervisorLaunchType_label principal.labels 병합됨
HypervisorLoadOptions_label principal.labels 병합됨
KernelDebug_label principal.labels 병합됨
LoadOptions_label principal.labels 병합됨
RemoteEventLogging_label principal.labels 병합됨
SourceName principal.labels 매핑된 값(총 36개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
SubjectLogonId_label principal.labels 병합됨
TestSigning_label principal.labels 병합됨
VsmLaunchType_label principal.labels 병합됨
acc_mask_label principal.labels 병합됨
account_name_label principal.labels 병합됨
caller_user_name_label principal.labels 병합됨
data_1_label principal.labels 병합됨
data_2_label principal.labels 병합됨
data_3_label principal.labels 병합됨
label01 principal.labels 병합됨
label03 principal.labels 병합됨
label461 principal.labels 병합됨
label501 principal.labels 병합됨
logon_id_label principal.labels 병합됨
method_executed_label principal.labels 병합됨
namespace_label principal.labels 병합됨
subject_logon_id_label principal.labels 병합됨
subject_machine_name_label principal.labels 병합됨
subject_user_name_label principal.labels 병합됨
user_id_label principal.labels 병합됨
var_client_name principal.labels 병합됨
var_workstation principal.labels 병합됨
var_workstation_name principal.labels 병합됨
CallingStationID principal.mac 매핑됨: (([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2})$ → CallingStationID
EventID principal.mac 매핑됨: 4908, 4964 → principal_mac
SourceName principal.mac 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
calling_station_id principal.mac 병합됨
device-mac principal.mac 병합됨
mac principal.mac 병합됨
principal_mac principal.mac 병합됨
principal_port principal.port 이름 변경/매핑됨
AccessMask principal.process.access_mask 이름 변경/매핑됨
am principal.process.access_mask 이름 변경/매핑됨
ParentCommandLine principal.process.command_line 이름 변경/매핑됨
ProcessName principal.process.command_line 이름 변경/매핑됨
principal_process_command_line principal.process.command_line 이름 변경/매핑됨
task_arguments principal.process.command_line 이름 변경/매핑됨
CallerProcessName principal.process.file.full_path 이름 변경/매핑됨
ParentImage principal.process.file.full_path 이름 변경/매핑됨
SourceImage principal.process.file.full_path 이름 변경/매핑됨
principal_process_name principal.process.file.full_path 이름 변경/매핑됨
task_command principal.process.file.full_path 이름 변경/매핑됨
SourceName principal.process.file.names 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
var_process_parent_name principal.process.file.names 병합됨
ParentProcessId principal.process.parent_process.pid 이름 변경/매핑됨
principal_process_pid principal.process.pid 이름 변경/매핑됨
process_id principal.process.pid 이름 변경/매핑됨
ObjectPath principal.registry.registry_key 이름 변경/매핑됨
EventID principal.resource.attribute.permissions 매핑됨: 4659, 5140, 5145 → permissions
SourceName principal.resource.attribute.permissions 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
permissions principal.resource.attribute.permissions 병합됨
principal_resource_product_object_id principal.resource.product_object_id 이름 변경/매핑됨
EventID principal.user.attribute.labels 매핑됨: 4908, 4964 → label_for_principal_user, 4908, 4964 → user_label, ` 4908…
SourceName principal.user.attribute.labels 매핑된 값(총 6개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
account_name_label principal.user.attribute.labels 병합됨
label_for_principal_user principal.user.attribute.labels 병합됨
sam_acc_label principal.user.attribute.labels 병합됨
sid_history_label principal.user.attribute.labels 병합됨
subject_user_sid_name_label principal.user.attribute.labels 병합됨
user_label principal.user.attribute.labels 병합됨
EventID principal.user.attribute.roles 매핑된 값(총 20개, 예: 4908, 4964 → roles, ` 7000, 7011, 7022, 7023, 7024, 702… )
SourceName principal.user.attribute.roles 매핑된 값(총 63개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
roles principal.user.attribute.roles 병합됨
Subject_Logon_GUID principal.user.product_object_id 직접 매핑됨
principal_user_display_name principal.user.user_display_name 이름 변경/매핑됨
AccountName principal.user.userid 이름 변경/매핑됨
AccountToReset principal.user.userid 이름 변경/매핑됨
CallerUserName principal.user.userid 이름 변경/매핑됨
SubjectMachineName principal.user.userid 이름 변경/매핑됨
SubjectUserName principal.user.userid 이름 변경/매핑됨
principal_user_id principal.user.userid 이름 변경/매핑됨
subject_machine_name principal.user.userid 이름 변경/매핑됨
principal_user_windows_sid principal.user.windows_sid 이름 변경/매핑됨
subject_machine_sid principal.user.windows_sid 직접 매핑됨
EventID security_result 매핑된 값(총 5개, 예: 4953, 4957, 4951, 4952, 4958 → security_result1, ` 4908, … )
SourceName security_result 매핑된 값(총 11개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
category_details security_result 매핑된 값(총 9개, 예: ` "Security State Change", "Security System Extension", "System… )
label_security_result security_result 병합됨
security_result1 security_result 병합됨
security_result2 security_result 병합됨
security_result_1 security_result 병합됨
security_result_2 security_result 병합됨
security_result_3 security_result 병합됨
security_result_4 security_result 병합됨
security_result_5 security_result 병합됨
KeyUserPath security_result.about.file.full_path 직접 매핑됨
EventID security_result.about.labels 매핑됨: 4625, 4776, 4794 → failure_reason_label, 4908, 4964 → `label_for_security…
SourceName security_result.about.labels 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `f…
failure_reason_label security_result.about.labels 병합됨
label_for_security_result_about_label security_result.about.labels 병합됨
EventID security_result.about.resource.attribute.labels 매핑된 값(총 14개, 예: 4908, 4964 → label, 4908, 4964 → label1, ` 4908,… )
SourceName security_result.about.resource.attribute.labels 매핑된 값(총 29개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
TicketOptions_label security_result.about.resource.attribute.labels 병합됨
label security_result.about.resource.attribute.labels 병합됨
label1 security_result.about.resource.attribute.labels 병합됨
label10 security_result.about.resource.attribute.labels 병합됨
label11 security_result.about.resource.attribute.labels 병합됨
label12 security_result.about.resource.attribute.labels 병합됨
label13 security_result.about.resource.attribute.labels 병합됨
label2 security_result.about.resource.attribute.labels 병합됨
label3 security_result.about.resource.attribute.labels 병합됨
label4 security_result.about.resource.attribute.labels 병합됨
label5 security_result.about.resource.attribute.labels 병합됨
label6 security_result.about.resource.attribute.labels 병합됨
label7 security_result.about.resource.attribute.labels 병합됨
label8 security_result.about.resource.attribute.labels 병합됨
label9 security_result.about.resource.attribute.labels 병합됨
security_result_about_resource_name security_result.about.resource.name 이름 변경/매핑됨
EventID security_result.action 매핑됨: 4908, 4964 → action
SourceName security_result.action 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
action security_result.action 병합됨
security_action security_result.action 병합됨
Action Name security_result.action_details 직접 매핑됨
action_details security_result.action_details 이름 변경/매핑됨
action_id security_result.action_details 직접 매핑됨
EventID security_result.category 매핑됨: 4908, 4964 → category
SourceName security_result.category 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `c…
category security_result.category 병합됨
Category security_result.category_details 병합됨
CategoryId security_result.category_details 병합됨
CategoryName security_result.category_details 병합됨
EventID security_result.category_details 매핑됨: 4908, 4964 → Category, 4908, 4964 → CategoryName, ` 102, 103, 300, 301…
SourceName security_result.category_details 매핑된 값(총 9개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
AccessReason security_result.description 직접 매핑됨
AdditionalInfo security_result.description 이름 변경/매핑됨
AuditPolicyChanges security_result.description 직접 매핑됨
Data_2 security_result.description 직접 매핑됨
Error Description security_result.description 직접 매핑됨
ErrorContext security_result.description 직접 매핑됨
ErrorMessage security_result.description 직접 매핑됨
Message security_result.description 직접 매핑됨
ReasonForRejection security_result.description 이름 변경/매핑됨
RootCause security_result.description 직접 매핑됨
description security_result.description 이름 변경/매핑됨
security_description security_result.description 직접 매핑됨
status security_result.description 직접 매핑됨
AdditionalInfo2_label security_result.detection_fields 병합됨
AppendData_or_AddSubdirectory_or_CreatePipeInstance_label security_result.detection_fields 병합됨
ApplicationDomain_label security_result.detection_fields 병합됨
ApplicationPath_label security_result.detection_fields 병합됨
ApplicationVirtualPath_label security_result.detection_fields 병합됨
AuthenticationType_label security_result.detection_fields 병합됨
CONTROL_label security_result.detection_fields 병합됨
CustomEventDetails_label security_result.detection_fields 병합됨
DAC_label security_result.detection_fields 병합됨
DELETE_label security_result.detection_fields 병합됨
ErrorCode_label security_result.detection_fields 병합됨
EventCode_label security_result.detection_fields 병합됨
EventDetailCode_label security_result.detection_fields 병합됨
EventID security_result.detection_fields 매핑된 값(총 150개, 예: 5158,5159,5154,5153,5155 → labels0, ` 5158,5159,5154,51… )
EventId_label security_result.detection_fields 병합됨
EventOccurrence_label security_result.detection_fields 병합됨
EventSequence_label security_result.detection_fields 병합됨
FailureId_label security_result.detection_fields 병합됨
GPOList_label security_result.detection_fields 병합됨
IsAuthenticated_label security_result.detection_fields 병합됨
IsImpersonating_label security_result.detection_fields 병합됨
MasterKeyId_label security_result.detection_fields 병합됨
ReadAttributes_label security_result.detection_fields 병합됨
RecoveryKeyId_label security_result.detection_fields 병합됨
RequestPath_label security_result.detection_fields 병합됨
SecurityDescriptor_label security_result.detection_fields 병합됨
Sid_Filtering_label security_result.detection_fields 병합됨
SourceName security_result.detection_fields 매핑된 값(총 357개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows se… )
StackTrace_label security_result.detection_fields 병합됨
ThreadAccountName_label security_result.detection_fields 병합됨
ThreadId_label security_result.detection_fields 병합됨
TrustLevel_label security_result.detection_fields 병합됨
Trust_Attributes_label security_result.detection_fields 병합됨
Trust_Direction_label security_result.detection_fields 병합됨
Trust_Type_label security_result.detection_fields 병합됨
WriteAttributes_label security_result.detection_fields 병합됨
WriteData_or_AddFile_label security_result.detection_fields 병합됨
WriteEA_label security_result.detection_fields 병합됨
account_name_label security_result.detection_fields 병합됨
action_id_label security_result.detection_fields 병합됨
affected_rows_label security_result.detection_fields 병합됨
analysis_symbol_label security_result.detection_fields 병합됨
application_information_label security_result.detection_fields 병합됨
application_name_label security_result.detection_fields 병합됨
audit_event_label security_result.detection_fields 병합됨
audit_schema_version_label security_result.detection_fields 병합됨
cert_issuer_name_label security_result.detection_fields 병합됨
cert_serial_number_label security_result.detection_fields 병합됨
cert_thumbprint_label security_result.detection_fields 병합됨
class_type_label security_result.detection_fields 병합됨
client_ip_label security_result.detection_fields 병합됨
client_name_label security_result.detection_fields 병합됨
client_name_session_id_label security_result.detection_fields 병합됨
client_tls_version_label security_result.detection_fields 병합됨
client_tls_version_name_label security_result.detection_fields 병합됨
connection_id_label security_result.detection_fields 병합됨
database_name_label security_result.detection_fields 병합됨
database_principal_id_label security_result.detection_fields 병합됨
database_principal_name_label security_result.detection_fields 병합됨
database_transaction_id_label security_result.detection_fields 병합됨
detect_field security_result.detection_fields 병합됨
detection_fields security_result.detection_fields 병합됨
detection_label security_result.detection_fields 병합됨
device_guid_label security_result.detection_fields 병합됨
duration_milliseconds_label security_result.detection_fields 병합됨
error_label security_result.detection_fields 병합됨
event_detail_code_label security_result.detection_fields 병합됨
event_id_label security_result.detection_fields 병합됨
event_message_label security_result.detection_fields 병합됨
event_name_label security_result.detection_fields 병합됨
event_occurrence_label security_result.detection_fields 병합됨
event_sequence_label security_result.detection_fields 병합됨
event_time_label security_result.detection_fields 병합됨
event_time_utc_label security_result.detection_fields 병합됨
exce_label security_result.detection_fields 병합됨
exception_information_label security_result.detection_fields 병합됨
external_policy_permissions_checked_label security_result.detection_fields 병합됨
failure_status_label security_result.detection_fields 병합됨
host_name_label security_result.detection_fields 병합됨
is_column_permission_label security_result.detection_fields 병합됨
is_impersonating_label security_result.detection_fields 병합됨
is_local_secondary_replica_label security_result.detection_fields 병합됨
label security_result.detection_fields 병합됨
label_for_security_result_detection security_result.detection_fields 병합됨
labels0 security_result.detection_fields 병합됨
labels1 security_result.detection_fields 병합됨
labels2 security_result.detection_fields 병합됨
labels3 security_result.detection_fields 병합됨
ledger_start_sequence_number_label security_result.detection_fields 병합됨
machine_name_label security_result.detection_fields 병합됨
nas_port_field security_result.detection_fields 병합됨
network_protocol_label security_result.detection_fields 병합됨
object_id_label security_result.detection_fields 병합됨
object_name_label security_result.detection_fields 병합됨
obo_middle_tier_app_id_label security_result.detection_fields 병합됨
permission_bitmask_label security_result.detection_fields 병합됨
proxy_policy_name security_result.detection_fields 병합됨
req_url_label security_result.detection_fields 병합됨
response_rows_label security_result.detection_fields 병합됨
response_ticket_label security_result.detection_fields 병합됨
schema_name_label security_result.detection_fields 병합됨
sec_error_label security_result.detection_fields 병합됨
security_detection1 security_result.detection_fields 병합됨
security_detection2 security_result.detection_fields 병합됨
security_detection3 security_result.detection_fields 병합됨
security_detection4 security_result.detection_fields 병합됨
sequence_group_id_label security_result.detection_fields 병합됨
sequence_number_label security_result.detection_fields 병합됨
server_instance_name_label security_result.detection_fields 병합됨
server_principal_id_label security_result.detection_fields 병합됨
server_principal_name_label security_result.detection_fields 병합됨
server_principal_sid_label security_result.detection_fields 병합됨
session_id_label security_result.detection_fields 병합됨
session_server_principal_name_label security_result.detection_fields 병합됨
statement_label security_result.detection_fields 병합됨
succeeded_label security_result.detection_fields 병합됨
target_database_principal_id_label security_result.detection_fields 병합됨
target_database_principal_name_label security_result.detection_fields 병합됨
target_server_principal_id_label security_result.detection_fields 병합됨
target_server_principal_name_label security_result.detection_fields 병합됨
target_server_principal_sid_label security_result.detection_fields 병합됨
transaction_id_label security_result.detection_fields 병합됨
type_label security_result.detection_fields 병합됨
user_defined_event_id_label security_result.detection_fields 병합됨
user_defined_information_label security_result.detection_fields 병합됨
var_Action_ID security_result.detection_fields 병합됨
var_Additional_Actions_ID security_result.detection_fields 병합됨
var_Additional_Actions_String security_result.detection_fields 병합됨
var_Category_ID security_result.detection_fields 병합됨
var_DetectionOrigin security_result.detection_fields 병합됨
var_DetectionSource security_result.detection_fields 병합됨
var_DetectionType security_result.detection_fields 병합됨
var_Detection_ID security_result.detection_fields 병합됨
var_EngineVersion security_result.detection_fields 병합됨
var_Error_Code security_result.detection_fields 병합됨
var_Execution_ID security_result.detection_fields 병합됨
var_Execution_Name security_result.detection_fields 병합됨
var_Origin_ID security_result.detection_fields 병합됨
var_Post_Clean_Status security_result.detection_fields 병합됨
var_Pre_Execution_Status security_result.detection_fields 병합됨
var_SecurityintelligenceVersion security_result.detection_fields 병합됨
var_SeverityName security_result.detection_fields 병합됨
var_Severity_ID security_result.detection_fields 병합됨
var_Source_ID security_result.detection_fields 병합됨
var_State security_result.detection_fields 병합됨
var_Status_Code security_result.detection_fields 병합됨
var_Type_ID security_result.detection_fields 병합됨
var_process_information security_result.detection_fields 병합됨
var_process_name security_result.detection_fields 병합됨
var_request_information security_result.detection_fields 병합됨
var_stack_trace security_result.detection_fields 병합됨
var_thread_account_name security_result.detection_fields 병합됨
Priority security_result.priority_details 이름 변경/매핑됨
RuleId security_result.rule_id 이름 변경/매핑됨
EventID security_result.rule_labels 매핑됨: 4908, 4964 → Title_label, 4908, 4964 → `label_for_security_result_rule_l…
SourceName security_result.rule_labels 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `T…
Title_label security_result.rule_labels 병합됨
label_for_security_result_rule_label security_result.rule_labels 병합됨
EventID security_result.rule_name 직접 매핑됨
connection_req_policy security_result.rule_name 직접 매핑됨
Severity security_result.severity 이름 변경/매핑됨
BlockReasonErrorCode security_result.summary 직접 매핑됨
CorruptionActionState security_result.summary 직접 매핑됨
CrashOnAuditFailValue security_result.summary 직접 매핑됨
Error security_result.summary 직접 매핑됨
ErrorCode security_result.summary 직접 매핑됨
FailureReason security_result.summary 직접 매핑됨
FinalStatus security_result.summary 직접 매핑됨
QueryResults security_result.summary 직접 매핑됨
Reason security_result.summary 직접 매핑됨
Status security_result.summary 직접 매핑됨
Win32Error security_result.summary 직접 매핑됨
error security_result.summary 직접 매핑됨
hr security_result.summary 직접 매핑됨
param1 security_result.summary 직접 매핑됨
sec_summary security_result.summary 직접 매핑됨
security_summary security_result.summary 직접 매핑됨
status security_result.summary 직접 매핑됨
summary security_result.summary 이름 변경/매핑됨
ThreatID security_result.threat_id 직접 매핑됨
ThreatName security_result.threat_name 직접 매핑됨
src_path src.file.full_path 이름 변경/매핑됨
CallerComputerName src.hostname 직접 매핑됨
EventID src.ip 매핑됨: 4908, 4964 → varclientip, ` 1162, 1311, 1535, 1566, 1644, 1865, 1925, 2085, 2…
SourceName src.ip 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
varclientip src.ip 병합됨
varclientport src.port 이름 변경/매핑됨
Service src.resource.name 이름 변경/매핑됨
SourceDRA src.resource.name 직접 매핑됨
SourceHandleId src.resource.name 이름 변경/매핑됨
EventID target 매핑됨: 4908, 4964 → clsid_labels, 10001, 10002, 10100 → clsid_labels
SourceName target 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `c…
clsid_labels target 병합됨
DomainName target.administrative_domain 이름 변경/매핑됨
ServerRealm target.administrative_domain 직접 매핑됨
TargetDomainName target.administrative_domain 이름 변경/매핑됨
subject_domain_name target.administrative_domain 이름 변경/매핑됨
target_domain_name target.administrative_domain 이름 변경/매핑됨
ServiceName target.application 직접 매핑됨
Targetname target.application 직접 매핑됨
event_source target.application 직접 매핑됨
target_application target.application 이름 변경/매핑됨
UserData.InstallDeviceID.DeviceInstanceID target.asset.asset_id 직접 매핑됨
EventID target.asset.attribute.labels 매핑된 값(총 10개, 예: 4741, 4742 → dns_host_label, 4908, 4964 → `user_dat… )
SourceName target.asset.attribute.labels 매핑된 값(총 14개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
dns_host_label target.asset.attribute.labels 병합됨
label_for_target_asset target.asset.attribute.labels 병합됨
target_server_principal_id_label target.asset.attribute.labels 병합됨
target_server_principal_name_label target.asset.attribute.labels 병합됨
target_server_principal_sid_label target.asset.attribute.labels 병합됨
token_new target.asset.attribute.labels 병합됨
user_data_install_device_id_is_driver_oem_label target.asset.attribute.labels 병합됨
user_data_install_device_id_reboot_option_label target.asset.attribute.labels 병합됨
user_data_install_device_id_setup_class_label target.asset.attribute.labels 병합됨
user_data_install_device_id_upgrade_device_label target.asset.attribute.labels 병합됨
AccountName target.asset.hostname 직접 매핑됨
NodeName target.asset.hostname 직접 매핑됨
client_name target.asset.hostname 직접 매핑됨
target_hostname target.asset.hostname 직접 매핑됨
ClientIPAddress target.asset.ip 병합됨
NASIPAddress target.asset.ip 병합됨
SourceName target.asset.ip 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `N…
called_station_id target.asset.ip 병합됨
client_ip target.asset.ip 병합됨
nas_ip target.asset.ip 병합됨
UserData.InstallDeviceID.DeviceInstanceID target.asset_id 직접 매핑됨
Data_1 target.domain.name 직접 매핑됨
TargetName target.domain.name 직접 매핑됨
TargetRealm target.domain.name 직접 매핑됨
param2 target.domain.name 직접 매핑됨
AutoBackup.BackupPath target.file.full_path 이름 변경/매핑됨
BackupFileName target.file.full_path 이름 변경/매핑됨
FileName target.file.full_path 이름 변경/매핑됨
FilePath target.file.full_path 이름 변경/매핑됨
KeyFilePath target.file.full_path 이름 변경/매핑됨
KeyUserPath target.file.full_path 이름 변경/매핑됨
Namespace target.file.full_path 이름 변경/매핑됨
PublishURLs target.file.full_path 이름 변경/매핑됨
ServiceFileName target.file.full_path 이름 변경/매핑됨
ShareLocalPath target.file.full_path 이름 변경/매핑됨
target_file_name target.file.full_path 이름 변경/매핑됨
MD5 target.file.md5 이름 변경/매핑됨
EventID target.file.names 매핑됨: ` 5049, 5140 , 5145, 5142, 5143, 5144, 4698, 4702, 4699, 4700, 4701, 4946, 4690, 4…
RelativeTargetName target.file.names 병합됨
ScriptName target.file.names 병합됨
SourceName target.file.names 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `R…
SHA1 target.file.sha1 이름 변경/매핑됨
SHA256 target.file.sha256 이름 변경/매핑됨
NewSize target.file.size 이름 변경/매핑됨
target_file_size target.file.size 이름 변경/매핑됨
EventID target.group.attribute.labels 매핑됨: 4908, 4964 → label_for_target_group
SourceName target.group.attribute.labels 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `l…
label_for_target_group target.group.attribute.labels 병합됨
EventID target.group.attribute.permissions 매핑됨: ` 4656, 4704, 4672, 4731, 4720, 4723, 4726, 4728, 4729, 4730, 4732, 4733, 4734, 47…
SourceName target.group.attribute.permissions 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
privilege_list target.group.attribute.permissions 병합됨
target_group_display_name target.group.group_display_name 이름 변경/매핑됨
target_group_product_object_id target.group.product_object_id 이름 변경/매핑됨
target_group_windows_sid target.group.windows_sid 이름 변경/매핑됨
AccountName target.hostname 직접 매핑됨
client_name target.hostname 직접 매핑됨
target_asset_hostname target.hostname 직접 매핑됨
target_hostname target.hostname 이름 변경/매핑됨
ClientIPAddress target.ip 병합됨
EventID target.ip 매핑됨: 4908, 4964 → target_ip
NASIPAddress target.ip 병합됨
SourceName target.ip 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
called_station_id target.ip 병합됨
client_ip target.ip 병합됨
nas_ip target.ip 병합됨
target_ip target.ip 병합됨
var_valid_ip target.ip 병합됨
ActiveProfile_label target.labels 병합됨
AppId_label target.labels 병합됨
CommandName_label target.labels 병합됨
ConfiguredNames_label target.labels 병합됨
DN_label target.labels 병합됨
DSType_label target.labels 병합됨
DirectiveName_label target.labels 병합됨
EngineVersion_label target.labels 병합됨
EventID target.labels 매핑된 값(총 35개, 예: 4907 , 4817, 4715 → ObjectServer_label, ` 4907 , 4817, 4… )
FQDN_label target.labels 병합됨
HandleId_label target.labels 병합됨
HostId_label target.labels 병합됨
HostVersion_label target.labels 병합됨
KeyLength_label target.labels 병합됨
LmPackageName_label target.labels 병합됨
MandatoryLabel_label target.labels 병합됨
NewState_label target.labels 병합됨
NotificationInterval_label target.labels 병합됨
ObjectServer_label target.labels 병합됨
Operation_label target.labels 병합됨
PipelineId_label target.labels 병합됨
Profiles_label target.labels 병합됨
ResourceManager_label target.labels 병합됨
ReturnCode_label target.labels 병합됨
RunspaceId_label target.labels 병합됨
ServiceStartType_label target.labels 병합됨
ServiceType_label target.labels 병합됨
SkuId_label target.labels 병합됨
SourceName target.labels 매핑된 값(총 77개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows sec… )
TargetLinkedLogonId_label target.labels 병합됨
TokenElevationType_label target.labels 병합됨
TransactionId_label target.labels 병합됨
TransmittedServices_label target.labels 병합됨
Trigger_label target.labels 병합됨
VirtualAccount_label target.labels 병합됨
client_friendly_name_label target.labels 병합됨
event_in_seq_label target.labels 병합됨
label02 target.labels 병합됨
label462 target.labels 병합됨
label463 target.labels 병합됨
label46561 target.labels 병합됨
label46562 target.labels 병합됨
label46563 target.labels 병합됨
label46564 target.labels 병합됨
label46565 target.labels 병합됨
label46571 target.labels 병합됨
label46572 target.labels 병합됨
label47681 target.labels 병합됨
label47682 target.labels 병합됨
label501 target.labels 병합됨
label601 target.labels 병합됨
labels46411 target.labels 병합됨
labels46412 target.labels 병합됨
labels46413 target.labels 병합됨
labels46414 target.labels 병합됨
labels46415 target.labels 병합됨
labels46416 target.labels 병합됨
labels46417 target.labels 병합됨
nas_port_type target.labels 병합됨
new_target_user_name_label target.labels 병합됨
object_class_label target.labels 병합됨
object_dn_label target.labels 병합됨
target_label target.labels 병합됨
target_labels target.labels 병합됨
target_logon_id_label target.labels 병합됨
target_user_id_label target.labels 병합됨
EventID target.mac 매핑됨: 4908, 4964 → target_mac
NASIdentifier target.mac 매핑됨: (([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2})$ → NASIdentifier
SourceName target.mac 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `t…
mac_address target.mac 병합됨
target_mac target.mac 병합됨
PeerPrivateAddress target.nat_ip 병합됨
SourceName target.nat_ip 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `P…
NASPort target.nat_port 이름 변경/매핑됨
var_http_method target.network.http.method 직접 매핑됨
target_platform_version target.platform_version 이름 변경/매핑됨
nas_port target.port 이름 변경/매핑됨
targetport target.port 이름 변경/매핑됨
CommandLine target.process.command_line 이름 변경/매핑됨
target_process_command_line target.process.command_line 이름 변경/매핑됨
ImagePath target.process.file.full_path 이름 변경/매핑됨
NewProcessName target.process.file.full_path 이름 변경/매핑됨
TargetProcessName target.process.file.full_path 이름 변경/매핑됨
target_process_file_full_path target.process.file.full_path 이름 변경/매핑됨
MD5 target.process.file.md5 직접 매핑됨
SourceName target.process.file.names 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `v…
var_process_file_name target.process.file.names 병합됨
SHA1 target.process.file.sha1 직접 매핑됨
SHA256 target.process.file.sha256 직접 매핑됨
target_parent_process_command_line target.process.parent_process.command_line 이름 변경/매핑됨
target_parent_process_file_full_path target.process.parent_process.file.full_path 이름 변경/매핑됨
target_parent_process_pid target.process.parent_process.pid 이름 변경/매핑됨
TargetProcessId target.process.pid 이름 변경/매핑됨
target_process_pid target.process.pid 이름 변경/매핑됨
EventOriginId target.process.product_specific_process_id 직접 매핑됨
ObjectName target.registry.registry_key 직접 매핑됨
ObjectVirtualPath target.registry.registry_key 이름 변경/매핑됨
target_registry_key target.registry.registry_key 이름 변경/매핑됨
NewValue target.registry.registry_value_data 이름 변경/매핑됨
target_registry_registry_value_data target.registry.registry_value_data 이름 변경/매핑됨
ObjectValueName target.registry.registry_value_name 이름 변경/매핑됨
registry_value target.registry.registry_value_name 이름 변경/매핑됨
target_registry_registry_value_name target.registry.registry_value_name 이름 변경/매핑됨
AlgorithmName_label target.resource.attribute.labels 병합됨
ClassId_label target.resource.attribute.labels 병합됨
ClassName_label target.resource.attribute.labels 병합됨
CompatibleIds_label target.resource.attribute.labels 병합됨
DomainBehaviorVersion_label target.resource.attribute.labels 병합됨
ErrorCode_label target.resource.attribute.labels 병합됨
EventID target.resource.attribute.labels 매핑된 값(총 101개, 예: 4907 , 4817, 4715 → label0, 4907 , 4817, 4715 → `la… )
ForceLogoff_label target.resource.attribute.labels 병합됨
HandleID_label target.resource.attribute.labels 병합됨
HardwareIds_label target.resource.attribute.labels 병합됨
KeyType_label target.resource.attribute.labels 병합됨
LocationInformation_label target.resource.attribute.labels 병합됨
LockoutDuration_label target.resource.attribute.labels 병합됨
LockoutObservationWindow_label target.resource.attribute.labels 병합됨
LockoutThreshold_label target.resource.attribute.labels 병합됨
MachineAccountQuota_label target.resource.attribute.labels 병합됨
MaxPasswordAge_label target.resource.attribute.labels 병합됨
MinPasswordAge_label target.resource.attribute.labels 병합됨
MinPasswordLength_label target.resource.attribute.labels 병합됨
MixedDomainMode_label target.resource.attribute.labels 병합됨
ModifiedObjectProperties_label target.resource.attribute.labels 병합됨
ObjectIdentifyingProperties_label target.resource.attribute.labels 병합됨
ObjectProperties_label target.resource.attribute.labels 병합됨
ObjectServer_label target.resource.attribute.labels 병합됨
OemInformation_label target.resource.attribute.labels 병합됨
PasswordHistoryLength_label target.resource.attribute.labels 병합됨
PasswordProperties_label target.resource.attribute.labels 병합됨
ProfileChanged_label target.resource.attribute.labels 병합됨
ProfileUsed_label target.resource.attribute.labels 병합됨
ProviderName_label target.resource.attribute.labels 병합됨
PuaCount_label target.resource.attribute.labels 병합됨
ResourceAttributes_label target.resource.attribute.labels 병합됨
SettingValue_label target.resource.attribute.labels 병합됨
SourceName target.resource.attribute.labels 매핑된 값(총 120개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows se… )
TemplateContent_label target.resource.attribute.labels 병합됨
TemplateDSObjectFQDN_label target.resource.attribute.labels 병합됨
TemplateSchemaVersion_label target.resource.attribute.labels 병합됨
TemplateVersion_label target.resource.attribute.labels 병합됨
TransactionId_label target.resource.attribute.labels 병합됨
database_principal_id_label target.resource.attribute.labels 병합됨
database_principal_name_label target.resource.attribute.labels 병합됨
entry_type_label target.resource.attribute.labels 병합됨
label0 target.resource.attribute.labels 병합됨
label00 target.resource.attribute.labels 병합됨
label01 target.resource.attribute.labels 병합됨
label02 target.resource.attribute.labels 병합됨
label03 target.resource.attribute.labels 병합됨
label04 target.resource.attribute.labels 병합됨
label05 target.resource.attribute.labels 병합됨
label06 target.resource.attribute.labels 병합됨
label07 target.resource.attribute.labels 병합됨
label08 target.resource.attribute.labels 병합됨
label09 target.resource.attribute.labels 병합됨
label1 target.resource.attribute.labels 병합됨
label2 target.resource.attribute.labels 병합됨
label3 target.resource.attribute.labels 병합됨
label4 target.resource.attribute.labels 병합됨
label4681 target.resource.attribute.labels 병합됨
label4682 target.resource.attribute.labels 병합됨
label4683 target.resource.attribute.labels 병합됨
label4684 target.resource.attribute.labels 병합됨
label5 target.resource.attribute.labels 병합됨
label6 target.resource.attribute.labels 병합됨
label_SessionStateChangeTrigger_Enabled target.resource.attribute.labels 병합됨
label_SessionStateChangeTrigger_StateChange target.resource.attribute.labels 병합됨
label_for_target_resource target.resource.attribute.labels 병합됨
labels0 target.resource.attribute.labels 병합됨
labels1 target.resource.attribute.labels 병합됨
labels10 target.resource.attribute.labels 병합됨
labels11 target.resource.attribute.labels 병합됨
labels12 target.resource.attribute.labels 병합됨
labels13 target.resource.attribute.labels 병합됨
labels14 target.resource.attribute.labels 병합됨
labels15 target.resource.attribute.labels 병합됨
labels16 target.resource.attribute.labels 병합됨
labels17 target.resource.attribute.labels 병합됨
labels19 target.resource.attribute.labels 병합됨
labels2 target.resource.attribute.labels 병합됨
labels21 target.resource.attribute.labels 병합됨
labels26 target.resource.attribute.labels 병합됨
labels3 target.resource.attribute.labels 병합됨
labels35 target.resource.attribute.labels 병합됨
labels4 target.resource.attribute.labels 병합됨
labels41 target.resource.attribute.labels 병합됨
labels5 target.resource.attribute.labels 병합됨
labels6 target.resource.attribute.labels 병합됨
labels7 target.resource.attribute.labels 병합됨
labels8 target.resource.attribute.labels 병합됨
labels9 target.resource.attribute.labels 병합됨
nas_port_label target.resource.attribute.labels 병합됨
netbios_name_label target.resource.attribute.labels 병합됨
object_id_label target.resource.attribute.labels 병합됨
object_name_label target.resource.attribute.labels 병합됨
operation_id_label target.resource.attribute.labels 병합됨
schema_name_label target.resource.attribute.labels 병합됨
target_database_principal_id_label target.resource.attribute.labels 병합됨
target_database_principal_name_label target.resource.attribute.labels 병합됨
top_level_name_label target.resource.attribute.labels 병합됨
uac_label target.resource.attribute.labels 병합됨
user_data_install_device_id_@_xmlns__label target.resource.attribute.labels 병합됨
user_data_install_device_id_driver_description_label target.resource.attribute.labels 병합됨
user_data_install_device_id_driver_provider_label target.resource.attribute.labels 병합됨
user_data_install_device_id_driver_version_label target.resource.attribute.labels 병합됨
user_data_install_device_id_install_status_label target.resource.attribute.labels 병합됨
volume_label target.resource.attribute.labels 병합됨
EventID target.resource.attribute.permissions 매핑됨: 4663, 4656, 4659 → permissions, 4908, 4964 → permissions
SourceName target.resource.attribute.permissions 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `p…
permissions target.resource.attribute.permissions 병합됨
DeviceId target.resource.id 이름 변경/매핑됨
ContextName target.resource.name 직접 매핑됨
DestinationDRA target.resource.name 직접 매핑됨
DfsNamespace target.resource.name 이름 변경/매핑됨
DomainPolicyChanged target.resource.name 이름 변경/매핑됨
ExtensionName target.resource.name 이름 변경/매핑됨
HiveName target.resource.name 이름 변경/매핑됨
SecurityPackageName target.resource.name 이름 변경/매핑됨
TicketOptions target.resource.name 직접 매핑됨
attribute_value target.resource.name 이름 변경/매핑됨
target_resource_name target.resource.name 이름 변경/매핑됨
updateTitle target.resource.name 이름 변경/매핑됨
ObjectServer target.resource.parent 이름 변경/매핑됨
AppInstance target.resource.product_object_id 이름 변경/매핑됨
AuthenticationSetId target.resource.product_object_id 이름 변경/매핑됨
ConnectionSecurityRuleId target.resource.product_object_id 이름 변경/매핑됨
CryptographicSetId target.resource.product_object_id 이름 변경/매핑됨
DeviceId target.resource.product_object_id 직접 매핑됨
ExtensionId target.resource.product_object_id 이름 변경/매핑됨
FilterId target.resource.product_object_id 이름 변경/매핑됨
IpSecSecurityAssociationId target.resource.product_object_id 이름 변경/매핑됨
ObjectGUID target.resource.product_object_id 이름 변경/매핑됨
PuaPolicyId target.resource.product_object_id 이름 변경/매핑됨
TargetJobId target.resource.product_object_id 이름 변경/매핑됨
TemplateOID target.resource.product_object_id 이름 변경/매핑됨
target_resource_product_object_id target.resource.product_object_id 이름 변경/매핑됨
updateGuid target.resource.product_object_id 이름 변경/매핑됨
val_instance_id target.resource.product_object_id 직접 매핑됨
KeyType target.resource.resource_subtype 이름 변경/매핑됨
ObjectType target.resource.resource_subtype 직접 매핑됨
TicketEncryptionType target.resource.resource_subtype 직접 매핑됨
resource_subtype target.resource.resource_subtype 이름 변경/매핑됨
EventID target.resource.resource_type 매핑됨: 4908, 4964 → SETTING, 4908, 4964 → TASK
SourceName target.resource.resource_type 매핑된 값(총 6개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
resource_type target.resource.resource_type 이름 변경/매핑됨
EventID target.resource.type 매핑됨: 4908, 4964 → DATABASE
SourceName target.resource.type 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `D…
SourceName target.resource_ancestors 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `r…
resource_ancestors target.resource_ancestors 병합됨
SubscriptionManagerAddress target.url 이름 변경/매핑됨
target_url target.url 이름 변경/매핑됨
fileLength target.url_metadata.last_http_response_content_length 이름 변경/매핑됨
EventID target.user.attribute.labels 매핑됨: 4908, 4964 → label_for_target_user, 4908, 4964 → user_label1
MembershipExpirationTime_label target.user.attribute.labels 병합됨
SourceName target.user.attribute.labels 매핑된 값(총 7개, 예: `"Microsoft-Windows-Security-Auditing", "Microsoft Windows secu… )
TargetOutboundDomainName_label target.user.attribute.labels 병합됨
label_for_target_user target.user.attribute.labels 병합됨
target_group_membership_name_label target.user.attribute.labels 병합됨
target_user_sid_name_label target.user.attribute.labels 병합됨
user_att target.user.attribute.labels 병합됨
user_label1 target.user.attribute.labels 병합됨
EventID target.user.attribute.permissions 매핑됨: ` 4656, 4704, 4672, 4731, 4720, 4723, 4726, 4728, 4729, 4730, 4732, 4733, 4734, 47…
SourceName target.user.attribute.permissions 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `a…
access_granted target.user.attribute.permissions 병합됨
access_removed_list target.user.attribute.permissions 병합됨
privilege_list target.user.attribute.permissions 병합됨
EventID target.user.group_identifiers 매핑됨: 4908, 4964 → new_sid
SourceName target.user.group_identifiers 매핑됨: "Microsoft-Windows-Security-Auditing", "Microsoft Windows security auditing." → `i…
input_sid target.user.group_identifiers 병합됨
new_sid target.user.group_identifiers 병합됨
DisplayName target.user.user_display_name 이름 변경/매핑됨
FullName target.user.user_display_name 직접 매핑됨
target_user_display_name target.user.user_display_name 이름 변경/매핑됨
DetectionUser target.user.userid 직접 매핑됨
NewTargetUserName target.user.userid 이름 변경/매핑됨
UserName target.user.userid 직접 매핑됨
subject_user_name target.user.userid 이름 변경/매핑됨
target_user_id target.user.userid 이름 변경/매핑됨
subject_user_sid target.user.windows_sid 직접 매핑됨
target_user_windows_sid target.user.windows_sid 이름 변경/매핑됨
해당 사항 없음 metadata.event_type 상수: STATUS_UPDATE
해당 사항 없음 metadata.product_name 상수: Microsoft-Windows-Security-Auditing
해당 사항 없음 metadata.vendor_name 상수: Microsoft
해당 사항 없음 principal.asset.platform_software.platform 상수: WINDOWS
해당 사항 없음 target.resource.resource_type 상수: BACKEND_SERVICE
해당 사항 없음 target.resource.type 상수: DATABASE

변경 로그

이 파서의 변경 로그 보기

도움이 더 필요하신가요? 커뮤니티 회원 및 Google SecOps 전문가에게 문의하여 답변을 받으세요.