Microsoft Windows Sysmon Parsing Rule

Parsing Rule

Microsoft Sysmon

Details

IDMicrosoft_Windows_Sysmon_ParsingRule
From Version8.4.0

Rules (XQL)

[INGEST:vendor="microsoft", product="windows", target_dataset="microsoft_sysmon_raw", no_hit=drop]
filter to_string(time_created) ~= ".*\d{2}:\d{2}:\d{2}.*" AND provider_name = "Microsoft-Windows-Sysmon"
| alter _time = time_created;