Import from old repository
This commit is contained in:
Stefan
@@ -0,0 +1 @@
|
||||
This folder will contain additional files that contain filter criteria, tagging files, etc.
|
||||
@@ -0,0 +1,329 @@
|
||||
{
|
||||
"title": "Plaso",
|
||||
"services": {
|
||||
"query": {
|
||||
"idQueue": [
|
||||
1,
|
||||
2,
|
||||
3,
|
||||
4
|
||||
],
|
||||
"list": {
|
||||
"0": {
|
||||
"query": "*",
|
||||
"alias": "",
|
||||
"color": "#7EB26D",
|
||||
"id": 0,
|
||||
"pin": false,
|
||||
"type": "lucene"
|
||||
}
|
||||
},
|
||||
"ids": [
|
||||
0
|
||||
]
|
||||
},
|
||||
"filter": {
|
||||
"idQueue": [
|
||||
0,
|
||||
1,
|
||||
2
|
||||
],
|
||||
"list": {},
|
||||
"ids": []
|
||||
}
|
||||
},
|
||||
"rows": [
|
||||
{
|
||||
"title": "Histogram",
|
||||
"height": "200px",
|
||||
"editable": true,
|
||||
"collapse": false,
|
||||
"collapsable": true,
|
||||
"panels": [
|
||||
{
|
||||
"span": 12,
|
||||
"editable": true,
|
||||
"type": "histogram",
|
||||
"loadingEditor": false,
|
||||
"mode": "count",
|
||||
"time_field": "datetime",
|
||||
"queries": {
|
||||
"mode": "all",
|
||||
"ids": [
|
||||
0
|
||||
]
|
||||
},
|
||||
"value_field": null,
|
||||
"auto_int": true,
|
||||
"resolution": 100,
|
||||
"interval": "1y",
|
||||
"intervals": [
|
||||
"auto",
|
||||
"1s",
|
||||
"1m",
|
||||
"5m",
|
||||
"10m",
|
||||
"30m",
|
||||
"1h",
|
||||
"3h",
|
||||
"12h",
|
||||
"1d",
|
||||
"1w",
|
||||
"1M",
|
||||
"1y"
|
||||
],
|
||||
"fill": 0,
|
||||
"linewidth": 3,
|
||||
"timezone": "browser",
|
||||
"spyable": true,
|
||||
"zoomlinks": true,
|
||||
"bars": true,
|
||||
"stack": true,
|
||||
"points": false,
|
||||
"lines": false,
|
||||
"legend": true,
|
||||
"x-axis": true,
|
||||
"y-axis": true,
|
||||
"percentage": false,
|
||||
"interactive": true,
|
||||
"options": true,
|
||||
"tooltip": {
|
||||
"value_type": "cumulative",
|
||||
"query_as_alias": false
|
||||
},
|
||||
"title": "Histogram"
|
||||
}
|
||||
],
|
||||
"notice": false
|
||||
},
|
||||
{
|
||||
"title": "Graph",
|
||||
"height": "250px",
|
||||
"editable": true,
|
||||
"collapse": false,
|
||||
"collapsable": true,
|
||||
"panels": [
|
||||
{
|
||||
"error": false,
|
||||
"span": 4,
|
||||
"editable": true,
|
||||
"type": "terms",
|
||||
"loadingEditor": false,
|
||||
"queries": {
|
||||
"mode": "selected",
|
||||
"ids": [
|
||||
0
|
||||
]
|
||||
},
|
||||
"field": "source_short",
|
||||
"exclude": [],
|
||||
"missing": true,
|
||||
"other": true,
|
||||
"size": 10,
|
||||
"order": "count",
|
||||
"style": {
|
||||
"font-size": "10pt"
|
||||
},
|
||||
"donut": false,
|
||||
"tilt": false,
|
||||
"labels": true,
|
||||
"arrangement": "horizontal",
|
||||
"chart": "bar",
|
||||
"counter_pos": "below",
|
||||
"spyable": true,
|
||||
"title": "Source Distribution"
|
||||
},
|
||||
{
|
||||
"error": false,
|
||||
"span": 4,
|
||||
"editable": true,
|
||||
"type": "terms",
|
||||
"loadingEditor": false,
|
||||
"queries": {
|
||||
"mode": "selected",
|
||||
"ids": []
|
||||
},
|
||||
"field": "parser",
|
||||
"exclude": [],
|
||||
"missing": true,
|
||||
"other": true,
|
||||
"size": 10,
|
||||
"order": "count",
|
||||
"style": {
|
||||
"font-size": "10pt"
|
||||
},
|
||||
"donut": false,
|
||||
"tilt": false,
|
||||
"labels": true,
|
||||
"arrangement": "horizontal",
|
||||
"chart": "table",
|
||||
"counter_pos": "above",
|
||||
"spyable": true,
|
||||
"title": "Parser Count"
|
||||
},
|
||||
{
|
||||
"error": false,
|
||||
"span": 4,
|
||||
"editable": true,
|
||||
"type": "terms",
|
||||
"loadingEditor": false,
|
||||
"queries": {
|
||||
"mode": "selected",
|
||||
"ids": []
|
||||
},
|
||||
"field": "hostname",
|
||||
"exclude": [],
|
||||
"missing": true,
|
||||
"other": true,
|
||||
"size": 10,
|
||||
"order": "count",
|
||||
"style": {
|
||||
"font-size": "10pt"
|
||||
},
|
||||
"donut": false,
|
||||
"tilt": false,
|
||||
"labels": true,
|
||||
"arrangement": "horizontal",
|
||||
"chart": "bar",
|
||||
"counter_pos": "above",
|
||||
"spyable": true,
|
||||
"title": "Hosts"
|
||||
}
|
||||
],
|
||||
"notice": false
|
||||
},
|
||||
{
|
||||
"title": "Events",
|
||||
"height": "650px",
|
||||
"editable": true,
|
||||
"collapse": false,
|
||||
"collapsable": true,
|
||||
"panels": [
|
||||
{
|
||||
"error": false,
|
||||
"span": 12,
|
||||
"editable": true,
|
||||
"group": [
|
||||
"default"
|
||||
],
|
||||
"type": "table",
|
||||
"size": 100,
|
||||
"pages": 5,
|
||||
"offset": 0,
|
||||
"sort": [
|
||||
"datetime",
|
||||
"desc"
|
||||
],
|
||||
"style": {
|
||||
"font-size": "9pt"
|
||||
},
|
||||
"overflow": "min-height",
|
||||
"fields": [
|
||||
"datetime",
|
||||
"timestamp_desc",
|
||||
"hostname",
|
||||
"username",
|
||||
"source_short",
|
||||
"source_long",
|
||||
"message",
|
||||
"tag",
|
||||
"display_name"
|
||||
],
|
||||
"highlight": [],
|
||||
"sortable": true,
|
||||
"header": true,
|
||||
"paging": true,
|
||||
"spyable": true,
|
||||
"queries": {
|
||||
"mode": "all",
|
||||
"ids": [
|
||||
0
|
||||
]
|
||||
},
|
||||
"field_list": true,
|
||||
"status": "Stable",
|
||||
"trimFactor": 300,
|
||||
"normTimes": true,
|
||||
"title": "Documents",
|
||||
"all_fields": false
|
||||
}
|
||||
],
|
||||
"notice": false
|
||||
}
|
||||
],
|
||||
"editable": true,
|
||||
"index": {
|
||||
"interval": "none",
|
||||
"pattern": "[logstash-]YYYY.MM.DD",
|
||||
"default": "_all"
|
||||
},
|
||||
"style": "light",
|
||||
"failover": false,
|
||||
"panel_hints": true,
|
||||
"loader": {
|
||||
"save_gist": false,
|
||||
"save_elasticsearch": true,
|
||||
"save_local": true,
|
||||
"save_default": true,
|
||||
"save_temp": true,
|
||||
"save_temp_ttl_enable": true,
|
||||
"save_temp_ttl": "30d",
|
||||
"load_gist": true,
|
||||
"load_elasticsearch": true,
|
||||
"load_elasticsearch_size": 20,
|
||||
"load_local": true,
|
||||
"hide": false
|
||||
},
|
||||
"pulldowns": [
|
||||
{
|
||||
"type": "query",
|
||||
"collapse": false,
|
||||
"notice": false,
|
||||
"query": "*",
|
||||
"pinned": true,
|
||||
"history": [],
|
||||
"remember": 10,
|
||||
"enable": true
|
||||
},
|
||||
{
|
||||
"type": "filtering",
|
||||
"collapse": true,
|
||||
"notice": false,
|
||||
"enable": true
|
||||
}
|
||||
],
|
||||
"nav": [
|
||||
{
|
||||
"type": "timepicker",
|
||||
"collapse": false,
|
||||
"notice": false,
|
||||
"status": "Stable",
|
||||
"time_options": [
|
||||
"5m",
|
||||
"15m",
|
||||
"1h",
|
||||
"6h",
|
||||
"12h",
|
||||
"24h",
|
||||
"2d",
|
||||
"7d",
|
||||
"30d"
|
||||
],
|
||||
"refresh_intervals": [
|
||||
"5s",
|
||||
"10s",
|
||||
"30s",
|
||||
"1m",
|
||||
"5m",
|
||||
"15m",
|
||||
"30m",
|
||||
"1h",
|
||||
"2h",
|
||||
"1d"
|
||||
],
|
||||
"timefield": "@timestamp",
|
||||
"enable": true
|
||||
}
|
||||
],
|
||||
"refresh": false
|
||||
}
|
||||
Executable
+21
@@ -0,0 +1,21 @@
|
||||
Application Execution
|
||||
data_type is 'macosx:application_usage'
|
||||
data_type is 'syslog:line' AND body contains 'COMMAND=/bin/launchctl'
|
||||
|
||||
Application Install
|
||||
data_type is 'plist:key' AND plugin is 'plist_install_history'
|
||||
|
||||
AutoRun
|
||||
data_type is 'fs:stat' AND filename contains 'LaunchAgents/' AND timestamp_desc is 'HFS_DETECT crtime' AND filename contains '.plist'
|
||||
|
||||
File Downloaded
|
||||
data_type is 'chrome:history:file_downloaded'
|
||||
timestamp_desc is 'File Downloaded'
|
||||
data_type is 'macosx:lsquarantine'
|
||||
|
||||
Device Connected
|
||||
data_type is 'ipod:device:entry'
|
||||
data_type is 'plist:key' and plugin is 'plist_airport'
|
||||
|
||||
Document Printed
|
||||
(data_type is 'metadata:hachoir' OR data_type is 'metadata:OLECF') AND timestamp_desc contains 'Printed'
|
||||
Executable
+94
@@ -0,0 +1,94 @@
|
||||
Application Execution
|
||||
data_type is 'windows:prefetch'
|
||||
data_type is 'windows:lnk:link' and filename contains 'Recent' and (local_path contains '.exe' or network_path contains '.exe' or relative_path contains '.exe')
|
||||
data_type is 'windows:registry:key_value' AND (plugin contains 'userassist' or plugin contains 'mru') AND regvalue.__all__ contains '.exe'
|
||||
data_type is 'windows:evtx:record' and strings contains 'user mode service' and strings contains 'demand start'
|
||||
data_type is 'fs:stat' and filename contains 'Windows/Tasks/At'
|
||||
data_type is 'windows:tasks:job'
|
||||
data_type is 'windows:evt:record' and source_name is 'Security' and event_identifier is 592
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Security-Auditing' and event_identifier is 4688
|
||||
data_type is 'windows:registry:appcompatcache'
|
||||
|
||||
Application Installed
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Application-Experience' and event_identifier is 903
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Application-Experience' and event_identifier is 904
|
||||
|
||||
Application Updated
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Application-Experience' and event_identifier is 905
|
||||
|
||||
Application Removed
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Application-Experience' and event_identifier is 907
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Application-Experience' and event_identifier is 908
|
||||
|
||||
Document Opened
|
||||
data_type is 'windows:registry:key_value' AND plugin contains 'mru' AND regvalue.__all__ not contains '.exe' AND timestamp > 0
|
||||
|
||||
Failed Login
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Security-Auditing' and event_identifier is 4625
|
||||
|
||||
Logon
|
||||
data_type is 'windows:evt:record' and source_name is 'Security' and event_identifier is 540
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Security-Auditing' and event_identifier is 4624
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 21
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 1101
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Winlogon' and event_identifier is 7001
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-RemoteConnectionManager' and event_identifier is 1147
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-RemoteConnectionManager' and event_identifier is 1149
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-User Profiles Service' and event_identifier is 2
|
||||
|
||||
Logoff
|
||||
data_type is 'windows:evt:record' and source_name is 'Security' and event_identifier is 538
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Security-Auditing' and event_identifier is 4634
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Winlogon' and event_identifier is 7002
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 23
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 1103
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-User Profiles Service' and event_identifier is 4
|
||||
|
||||
Disconnect
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 24
|
||||
|
||||
Reconnect
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 25
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 1105
|
||||
|
||||
Shell Start
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 22
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TerminalServices-LocalSessionManager' and event_identifer is 1102
|
||||
|
||||
Task Scheduled
|
||||
data_type is 'windows:evt:record' and source_name is 'Security' and event_identifier is 602
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Security-Auditing' and event_identifier is 4698
|
||||
|
||||
Job Success
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TaskScheduler' and event_identifier is 102
|
||||
|
||||
Action Success
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-TaskScheduler' and event_identifier is 201
|
||||
|
||||
Name Resolution Timeout
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-DNS-Client' and event_identifier is 1014
|
||||
|
||||
Time Change
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Kernel-General' and event_identifier is 1
|
||||
|
||||
Shutdown
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Kernel-General' and event_identifier is 13
|
||||
|
||||
System Start
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Kernel-General' and event_identifier is 13
|
||||
|
||||
System Sleep
|
||||
data_type is 'windows:evtx:record' and source_name is 'Microsoft-Windows-Kernel-Power' and event_identifier is 42
|
||||
|
||||
AutoRun
|
||||
data_type is 'windows:registry:key_value' and plugin contains 'Run'
|
||||
|
||||
File Downloaded
|
||||
data_type is 'chrome:history:file_downloaded'
|
||||
timestamp_desc is 'File Downloaded'
|
||||
|
||||
Document Printed
|
||||
(data_type is 'metadata:hachoir' OR data_type is 'olecf:summary_info') AND timestamp_desc contains 'Printed'
|
||||
|
||||
Startup Application
|
||||
data_type is 'windows:registry:key_value' AND (plugin contains 'run' or plugin contains 'lfu') AND (regvalue.__all__ contains '.exe' OR regvalue.__all__ contains '.dll')
|
||||
Reference in New Issue
Block a user