##Below fields extractions have been moved from [XmlWinEventLog:Microsoft-Windows-Sysmon/Operational]
[source::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational]
#SEDCMD-pwd_rule1 = s/ -pw ([^\s\<])+/ -pw ***MASK***/g
REPORT-sysmon = sysmon-eventid,sysmon-version,sysmon-level,sysmon-task,sysmon-opcode,sysmon-keywords,sysmon-created,sysmon-record,sysmon-correlation,sysmon-channel,sysmon-computer,sysmon-sid,sysmon-data,sysmon-md5,sysmon-sha1,sysmon-sha256,sysmon-imphash,sysmon-hashes,sysmon-filename,sysmon-registry,sysmon-dns-record-data,sysmon-dns-ip-data

FIELDALIAS-src_ip = SourceIp AS src_ip
FIELDALIAS-src_host = SourceHostname AS src_host
EVAL-src = if(isnotnull(SourceHostname),SourceHostname,SourceIp)
FIELDALIAS-src_port = SourcePort AS src_port
FIELDALIAS-app = Image AS app
FIELDALIAS-dest_ip = DestinationIp AS dest_ip
FIELDALIAS-dest_host = DestinationHostname AS dest_host
EVAL-dest = case(EventCode=="3" AND isnotnull(DestinationHostname),DestinationHostname,EventCode=="3",DestinationIp,EventCode=="1" OR EventCode == "11" OR EventCode == "12" OR EventCode == "13" OR EventCode == "14", Computer)
FIELDALIAS-dest_port = DestinationPort AS dest_port
EVAL-direction = if(Initiated=="true","outbound","inbound")
FIELDALIAS-dvc = Computer AS dvc
FIELDALIAS-transport = Protocol AS transport
EVAL-protocol = if(Initiated=="true",DestinationPortName,SourcePortName)
FIELDALIAS-session_id = ProcessGuid AS session_id
EVAL-vendor_product = "Microsoft Sysmon"
FIELDALIAS-cmdline = CommandLine AS cmdline

#Common fieldnames for Registry, Process, FileSystem Node in Endpoint Datamodel
EVAL-action = case(EventCode=="1","allowed",EventCode=="12" AND EventType=="CreateKey","created",EventCode=="12" AND (EventType=="DeleteKey" OR EventType=="DeleteValue") ,"deleted",EventCode=="13" AND EventType=="SetValue","modified",EventCode=="11" AND EventDescription=="File Created","created")

#Ports Node
EVAL-creation_time = case(EventCode=="3",UtcTime)
EVAL-state = case(EventCode=="3", "listening")

#Processes Node
EVAL-parent_process_exec = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18", replace(ParentImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"")
FIELDALIAS-parent_process_id = ParentProcessId AS parent_process_id
FIELDALIAS-parent_process_guid = ParentProcessGuid AS parent_process_guid
FIELDALIAS-parent_process_path = ParentImage AS parent_process_path
FIELDALIAS-process_current_directory = CurrentDirectory AS process_current_directory
EVAL-process_exec = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18" OR EventCode="22", replace(Image,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),EventCode=="6","System",EventCode=="8" OR EventCode=="10",replace(SourceImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"")
FIELDALIAS-process_hash = Hashes AS process_hash
FIELDALIAS-process_guid = ProcessGuid AS process_guid
FIELDALIAS-process_id = ProcessId AS process_id
FIELDALIAS-process_integrity_level = IntegrityLevel AS process_integrity_level
FIELDALIAS-process_path = Image AS process_path
FIELDALIAS-user_id = UserID AS user_id
REPORT-user_for_sysmon = User_as_user
FIELDALIAS-parent_process = ParentCommandLine AS parent_process
EVAL-parent_process_name = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18", replace(ParentImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"")
FIELDALIAS-process = CommandLine AS process
EVAL-process_name = case(EventCode=="1" OR EventCode=="2" OR EventCode=="3" OR EventCode=="5" OR EventCode=="7" OR EventCode=="9" OR EventCode=="11" OR EventCode=="12" OR EventCode=="13" OR EventCode=="14" OR EventCode=="15" OR EventCode=="17" OR EventCode=="18" OR EventCode="22", replace(Image,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),EventCode=="6","System",EventCode=="8" OR EventCode=="10",replace(SourceImage,"(.*\\\)(?=.*(\.\w*)$|(\w+)$)",""),1==1,"")

#Filesystem Node
FIELDALIAS-file_path = TargetFilename AS file_path
FIELDALIAS-file_create_time = CreationUtcTime AS file_create_time

#Fields for ChangeAnalysis DM (old field names)
EVAL-object_category = case(EventCode=="11" OR EventCode=="2", "file", EventCode=="12" OR EventCode=="13" OR EventCode="14", "registry", EventCode=="19" OR EventCode=="20" OR EventCode="21", "wmi")
EVAL-object_path = case(EventCode=="12" OR EventCode=="13", TargetObject, EventCode=="14", NewName)
LOOKUP-eventcode = eventcode EventCode OUTPUTNEW EventDescription EventDescription AS signature
FIELDALIAS-signature_id = EventCode AS signature_id
FIELDALIAS-eventid = EventCode AS EventID

#Registry Node
EVAL-registry_path = case(EventCode=="12" OR EventCode=="13" OR EventCode=="14", TargetObject)
EVAL-registry_value_name = case(EventCode=="13", Details)
EVAL-registry_key_name = case(EventCode=="12" OR EventCode=="13" OR EventCode=="14",replace(TargetObject,".+\\\\",""))

#DNS Node
FIELDALIAS-query = QueryName AS query
FIELDALIAS-replycode = QueryStatus AS reply_code_id