From bf83f0309b295dfe5db758f1435baed8cc2b8c1a Mon Sep 17 00:00:00 2001 From: Rebecca Cowart Date: Thu, 12 Dec 2024 16:31:32 -0500 Subject: [PATCH] Update windows_eventlog.yml (#24711) Stray quotation in example query --------- Co-authored-by: Eric --- schema/osquery_fleet_schema.json | 2 +- schema/tables/windows_eventlog.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 3a12aee973..00bd623170 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -28747,7 +28747,7 @@ "evented": false, "cacheable": false, "notes": "* This is not an evented table - instead, it pulls directly from the local system's existing eventlogs. \n\n* The information returned in the `data` column will be JSON formatted, which will require additional parsing. ", - "examples": "Tracking user account changes is a key part of both detection & incident response. This query lists all Windows Eventlogs from the Security channel with an EventID of 4720 - A user account was created. There are many other relevant EventIDs that should be monitored as well: \n\n- [4722: Account enabled](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4722)\n\n- [4724: Password reset](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4724)\n\n- [4728: Added to a security-enabled global group](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4728)\n\n\n```\nSELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'\"\n```", + "examples": "Tracking user account changes is a key part of both detection & incident response. This query lists all Windows Eventlogs from the Security channel with an EventID of 4720 - A user account was created. There are many other relevant EventIDs that should be monitored as well: \n\n- [4722: Account enabled](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4722)\n\n- [4724: Password reset](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4724)\n\n- [4728: Added to a security-enabled global group](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4728)\n\n\n```\nSELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'\n```", "columns": [ { "name": "channel", diff --git a/schema/tables/windows_eventlog.yml b/schema/tables/windows_eventlog.yml index 48d2b62791..ad2b135f62 100644 --- a/schema/tables/windows_eventlog.yml +++ b/schema/tables/windows_eventlog.yml @@ -10,10 +10,10 @@ examples: |- ``` - SELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'" + SELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security' ``` notes: |- * This is not an evented table - instead, it pulls directly from the local system's existing eventlogs. - * The information returned in the `data` column will be JSON formatted, which will require additional parsing. \ No newline at end of file + * The information returned in the `data` column will be JSON formatted, which will require additional parsing.