trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update DC Auditing GPO and Add Packer Script for ENA

Browse Source
This commit is contained in:
Chris Long
2020-05-03 17:12:05 -07:00
parent c8514a49a4
commit aeecd1b756
15 changed files with 37 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
Vagrant/resources/splunk_server/props.conf
View File

@@ -24,5 +24,4 @@ TRUNCATE = 0
TRANSFORMS-null = setnull
[WinEventLog]
TRANSFORMS-null = osqueryd_wineventlog_null
TRANSFORMS-null = autoruns_wineventlog_null

5
Vagrant/resources/splunk_server/transforms.conf
View File

@@ -19,11 +19,6 @@ REGEX = Error\scasting
DEST_KEY = queue
FORMAT = nullQueue
[osqueryd_wineventlog_null]
REGEX = "Process_Name=C:\\Program Files\\osquery\\osqueryd\\osqueryd.exe"
DEST_KEY = queue
FORMAT = nullQueue
[autoruns_wineventlog_null]
REGEX = "Script\sName\s=\sC\:\\Program Files\\AutorunsToWinEventLog\\AutorunsToWinEventLog.ps1"
DEST_KEY = queue