Details
| ID | Microsoft_Windows_Sysmon_ModelingRule |
|---|---|
| From Version | 8.4.0 |
Schema
microsoft_sysmon_raw
| Field | Type | Array? |
|---|---|---|
channel |
string | — |
computer_name |
string | — |
event_action |
string | — |
event_data |
string | — |
event_id |
int | — |
host_name |
string | — |
log_level |
string | — |
message |
string | — |
opcode |
string | — |
process_pid |
int | — |
process_thread_id |
int | — |
provider_guid |
string | — |
provider_name |
string | — |
record_id |
int | — |
task |
int | — |
time_created |
datetime | — |
user |
string | — |