Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity

Update windows_eventlog.yml (#24711)

Browse Source 
Stray quotation in example query

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
This commit is contained in:
Rebecca Cowart
2024-12-12 15:31:32 -06:00
committed by GitHub
co-authored by Eric
parent 52fe6dba14
commit bf83f0309b
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
schema/osquery_fleet_schema.json
+1 -1
View File
@@ -28747,7 +28747,7 @@
"evented": false,
"cacheable": false,
"notes": "* This is not an evented table - instead, it pulls directly from the local system's existing eventlogs. \n\n* The information returned in the `data` column will be JSON formatted, which will require additional parsing. ",
"examples": "Tracking user account changes is a key part of both detection & incident response. This query lists all Windows Eventlogs from the Security channel with an EventID of 4720 - A user account was created. There are many other relevant EventIDs that should be monitored as well: \n\n- [4722: Account enabled](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4722)\n\n- [4724: Password reset](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4724)\n\n- [4728: Added to a security-enabled global group](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4728)\n\n\n```\nSELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'\"\n```",
"examples": "Tracking user account changes is a key part of both detection & incident response. This query lists all Windows Eventlogs from the Security channel with an EventID of 4720 - A user account was created. There are many other relevant EventIDs that should be monitored as well: \n\n- [4722: Account enabled](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4722)\n\n- [4724: Password reset](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4724)\n\n- [4728: Added to a security-enabled global group](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4728)\n\n\n```\nSELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'\n```",
"columns": [
{
"name": "channel",
schema/tables/windows_eventlog.yml
+2 -2
View File
@@ -10,10 +10,10 @@ examples: |-
```
SELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'"
SELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'
```
notes: |-
* This is not an evented table - instead, it pulls directly from the local system's existing eventlogs.
* The information returned in the `data` column will be JSON formatted, which will require additional parsing.
* The information returned in the `data` column will be JSON formatted, which will require additional parsing.