<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">ActivityID</span>
<span class="pill kill-chain">category</span>
<span class="pill kill-chain">Channel</span>
<span class="pill kill-chain">Computer</span>
<span class="pill kill-chain">ComputerName</span>
<span class="pill kill-chain">date</span>
<span class="pill kill-chain">date_hour</span>
<span class="pill kill-chain">date_mday</span>
<span class="pill kill-chain">date_minute</span>
<span class="pill kill-chain">date_month</span>
<span class="pill kill-chain">date_second</span>
<span class="pill kill-chain">date_wday</span>
<span class="pill kill-chain">date_year</span>
<span class="pill kill-chain">date_zone</span>
<span class="pill kill-chain">dest</span>
<span class="pill kill-chain">Detection_Time</span>
<span class="pill kill-chain">Detection_time</span>
<span class="pill kill-chain">dvc</span>
<span class="pill kill-chain">dvc_nt_host</span>
<span class="pill kill-chain">Engine_Version</span>
<span class="pill kill-chain">event_id</span>
<span class="pill kill-chain">EventCode</span>
<span class="pill kill-chain">EventData_Xml</span>
<span class="pill kill-chain">EventID</span>
<span class="pill kill-chain">EventRecordID</span>
<span class="pill kill-chain">EventType</span>
<span class="pill kill-chain">eventtype</span>
<span class="pill kill-chain">file_name</span>
<span class="pill kill-chain">file_path</span>
<span class="pill kill-chain">Guid</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">ID</span>
<span class="pill kill-chain">id</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">Inheritance_Flags</span>
<span class="pill kill-chain">Inhertiance_Flags</span>
<span class="pill kill-chain">Involved_File</span>
<span class="pill kill-chain">Keywords</span>
<span class="pill kill-chain">Level</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">LogName</span>
<span class="pill kill-chain">Message</span>
<span class="pill kill-chain">meta</span>
<span class="pill kill-chain">Name</span>
<span class="pill kill-chain">New_Value</span>
<span class="pill kill-chain">New_value</span>
<span class="pill kill-chain">Old_Value</span>
<span class="pill kill-chain">Old_value</span>
<span class="pill kill-chain">OpCode</span>
<span class="pill kill-chain">Opcode</span>
<span class="pill kill-chain">Parent_Commandline</span>
<span class="pill kill-chain">Path</span>
<span class="pill kill-chain">Process_Name</span>
<span class="pill kill-chain">ProcessID</span>
<span class="pill kill-chain">Product_Name</span>
<span class="pill kill-chain">Product_Version</span>
<span class="pill kill-chain">product_version</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">RecordNumber</span>
<span class="pill kill-chain">RuleType</span>
<span class="pill kill-chain">Security_intelligence_Version</span>
<span class="pill kill-chain">severity</span>
<span class="pill kill-chain">severity_id</span>
<span class="pill kill-chain">Sid</span>
<span class="pill kill-chain">SidType</span>
<span class="pill kill-chain">signature</span>
<span class="pill kill-chain">signature_id</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">System_Props_Xml</span>
<span class="pill kill-chain">SystemTime</span>
<span class="pill kill-chain">tag</span>
<span class="pill kill-chain">tag::eventtype</span>
<span class="pill kill-chain">Target_Commandline</span>
<span class="pill kill-chain">Task</span>
<span class="pill kill-chain">TaskCategory</span>
<span class="pill kill-chain">ThreadID</span>
<span class="pill kill-chain">timeendpos</span>
<span class="pill kill-chain">timestamp</span>
<span class="pill kill-chain">timestartpos</span>
<span class="pill kill-chain">Type</span>
<span class="pill kill-chain">User</span>
<span class="pill kill-chain">user</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">UserID</span>
<span class="pill kill-chain">vendor_product</span>
<span class="pill kill-chain">Version</span>
</div>
Data Source: Windows Event Log Defender 1133
Description
Data source object for Windows Event Log Defender 1133
Details
| Property | Value |
|---|---|
| Source | XmlWinEventLog:Security |
| Sourcetype | XmlWinEventLog |
| Separator | EventCode |
Related Detections
Supported Apps
- Splunk Add-on for Microsoft Windows (version 11.0.3)
Event Fields
Fields
Example Log
1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Windows Defender' Guid='{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}'/><EventID>1122</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-11-20T20:24:37.5343180Z'/><EventRecordID>3051</EventRecordID><Correlation ActivityID='{c57e2caa-92af-4f2c-93d7-087d50b26e88}'/><Execution ProcessID='3488' ThreadID='5876'/><Channel>Microsoft-Windows-Windows Defender/Operational</Channel><Computer>researchvmhaa</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='Product Name'>Microsoft Defender Antivirus</Data><Data Name='Product Version'>4.18.23100.2009</Data><Data Name='Unused'></Data><Data Name='ID'>D1E49AAC-8F56-4280-B9BA-993A6D77406C</Data><Data Name='Detection Time'>2023-11-20T20:24:37.533Z</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='Path'>C:\Windows\cmd.exe</Data><Data Name='Process Name'>C:\Windows\PSEXESVC.exe</Data><Data Name='Security intelligence Version'>1.401.912.0</Data><Data Name='Engine Version'>1.1.23100.2009</Data><Data Name='RuleType'>ENT\ConsR</Data><Data Name='Target Commandline'>"cmd" </Data><Data Name='Parent Commandline'>C:\Windows\PSEXESVC.exe</Data><Data Name='Involved File'></Data><Data Name='Inhertiance Flags'>0x00000000</Data></EventData></Event>
Source: GitHub | Version: 4