{ "version": 1, "reviewed_on": "2026-11-10", "coverage_note": "A curated, expandable catalogue of concrete producer formats. It is not an exhaustive inventory of every product, event ID or release.", "sources": [ { "id": "windows-security-4624", "title": "Windows Security 4624 — Successful logon", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A logon session was created on the accessed computer.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Logon. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Investigate unusual logon types and source addresses; correlate the target logon ID with subsequent activity.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "LogonType distinguishes interactive, network and other sessions; a successful logon is not itself compromise. This sample uses event version 2.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "TargetLogonId, LogonType, IpAddress" }, "tags": [ "windows", "xml", "authentication", "logon" ], "references": [ { "title": "4624(S) An account was successfully logged on. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624" } ], "telemetry_components": [ "DC0067" ], "sample": { "path": "/log-sources/samples/windows-security-4624.xml", "sha256": "bb50c59c7ad1c1bca2fb442534bb3dd3a3388274f58a1824cd1ff77d14a95b50", "bytes": 2267, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "2dc6fe6e0f34743f13782a59e9bb7c1d47940fd576fc2ac5beef83e38f32b54c", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4624", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4625", "title": "Windows Security 4625 — Failed logon", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A logon attempt failed on the computer recording the event.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Logon. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Group failures by account, source and status; compare later successes and the account baseline.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Failures include stale services and mistyped passwords; do not equate a count threshold with password spraying. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "Status, SubStatus, LogonType, IpAddress" }, "tags": [ "windows", "xml", "authentication", "failure" ], "references": [ { "title": "4625(F) An account failed to log on. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-4625.xml", "sha256": "169ca6119ee289934e0ac6feb96b0da0a5a9f6faa87828b939ca1aaffc364a4a", "bytes": 1551, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "4b7e1e7025d30c00c0e99b2a76e6707c172de206e8936d25b5ec38a442df626f", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4625", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4688", "title": "Windows Security 4688 — Process creation", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A new process was created, with fields that depend on the event version and audit policy.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Process Creation. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Reconstruct parent and child processes and examine command-line context with user and session evidence.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "CommandLine can be empty unless the separate command-line policy is enabled; hexadecimal process IDs can be reused. This sample uses event version 2.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "NewProcessId, NewProcessName, CommandLine, SubjectLogonId" }, "tags": [ "windows", "xml", "process", "execution" ], "references": [ { "title": "4688(S) A new process has been created. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688" } ], "telemetry_components": [ "DC0032" ], "sample": { "path": "/log-sources/samples/windows-security-4688.xml", "sha256": "9cdbbc7df3be3baa9aa092e716a09ce2d12a7a39e33ea4f1d2d5a5a2464b7d28", "bytes": 1397, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "72b8ba86c401dfb31294eede4eae0567e5255229e52838911817681cf7de460e", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4688", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4698", "title": "Windows Security 4698 — Scheduled task created", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A scheduled task was created; TaskContent carries the task definition XML.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Other Object Access Events. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Review task action, principal and trigger; corroborate execution with process and scheduler events.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Task registration does not prove that the task ran. Later Windows versions add fields; escaped TaskContent needs a second XML parse. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "TaskName, TaskContent, SubjectLogonId" }, "tags": [ "windows", "xml", "scheduled-task", "persistence" ], "references": [ { "title": "4698(S) A scheduled task was created. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-4698.xml", "sha256": "877d4ff3226ac5276d2470e4171ae70b6ba4e0b18503a880d2dc1989671eda8b", "bytes": 2525, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "24f46bb7bd47ecae6879c8c5d87c04a57f9bfc6a60edfef78a3ea062c7b78564", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged. Escaped the publisher-rendered TaskContent XML as XML text to restore a well-formed event export; this is a repaired documentation example.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4698", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4720", "title": "Windows Security 4720 — User account created", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A user account was created in the local account database or directory context of the reporting host.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit User Account Management. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Correlate the acting account, change record and subsequent group membership or authentication.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Local and domain accounts differ; the event does not establish authorization or successful account use. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "TargetUserName, TargetSid, SubjectUserName" }, "tags": [ "windows", "xml", "identity", "account-management" ], "references": [ { "title": "4720(S) A user account was created. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-4720.xml", "sha256": "673f8413d30a0332087f3fa17c1bf443f74bbf1c14af10e30ca9870e81e1167b", "bytes": 1824, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "9fd8abbd99cf108c15abfa2aa4e899930af42dd06b4ce2b579396c466f9e27bd", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4720", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4732", "title": "Windows Security 4732 — Member added to local security group", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A member was added to a security-enabled local group.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Security Group Management. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Track sensitive local-group changes and confirm the member SID and authorized administrator.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "A group name alone is ambiguous across hosts; resolve group and member SIDs in the correct domain context. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "MemberSid, TargetSid, TargetUserName" }, "tags": [ "windows", "xml", "identity", "privilege" ], "references": [ { "title": "4732(S) A member was added to a security-enabled local group. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-4732.xml", "sha256": "bc26e5ac4ea8ce70df90ca530fe08a4e0d247870d376b7df7d043f72c0bb6b13", "bytes": 1224, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4732", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "38c4b0d1d1b96710f0f08453df4db6a0e949ab4b73c65ceca18eb74574a345f9", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4732", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4740", "title": "Windows Security 4740 — Account locked out", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "An account was locked out under the applicable account-lockout policy.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit User Account Management. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Identify recurring lockouts and correlate caller information with authentication failure events.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "CallerComputerName may be missing or insufficient; a lockout does not identify the underlying process or intent. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "TargetUserName, CallerComputerName, SubjectUserName" }, "tags": [ "windows", "xml", "authentication", "lockout" ], "references": [ { "title": "4740(S) A user account was locked out. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-4740.xml", "sha256": "68655f9a2aa7c439dd4ac8a12c607ed154582e5e59789c5f9214e357da745026", "bytes": 986, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "cecab6bd23303d51bce2d84d821659d1212ee0db8a125753e8a85650f401ff00", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4740", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4768", "title": "Windows Security 4768 — Kerberos TGT request", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "The domain controller handled a Kerberos authentication-service request.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Kerberos Authentication Service. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Compare client address, account and encryption information against domain policy and related Kerberos events.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Event versions and fields vary with Windows updates; this preserved documentation example is not a promise of the latest field set. This sample uses event version 2.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "TargetUserName, IpAddress, TicketEncryptionType, Status" }, "tags": [ "windows", "xml", "kerberos", "active-directory" ], "references": [ { "title": "4768(S, F) A Kerberos authentication ticket (TGT) was requested. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768" } ], "telemetry_components": [ "DC0084" ], "sample": { "path": "/log-sources/samples/windows-security-4768.xml", "sha256": "db6b0cdeb09eb4b63891c9efec0a44b3fffefa98da3d310fde496a2511b04556", "bytes": 2089, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4768", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "40d0176e458fc8eef3a109c0304d37b51849c9f31dab4bd73afae26bf24fa3c0", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4768", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4769", "title": "Windows Security 4769 — Kerberos service ticket request", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A domain controller recorded a Kerberos service-ticket request.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Kerberos Service Ticket Operations. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Review service account targeting and unusual ticket encryption or request patterns with client context.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Ticket issuance does not show service execution or a cracked credential; distinguish versions and success/failure status. This sample uses event version 2.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "ServiceName, IpAddress, TicketEncryptionType, Status" }, "tags": [ "windows", "xml", "kerberos", "active-directory" ], "references": [ { "title": "4769(S, F) A Kerberos service ticket was requested. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769" } ], "telemetry_components": [ "DC0084" ], "sample": { "path": "/log-sources/samples/windows-security-4769.xml", "sha256": "a5b469b3026a9d287a8f6ea20f8b05df02d434fee5d2b21256303e64d28c7825", "bytes": 2008, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "cbca97bf17362071d58fb156848e0de956de9cab1976d1ead903c98a94b0ccdd", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4769", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4776", "title": "Windows Security 4776 — NTLM credential validation", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "The authoritative computer attempted to validate credentials with NTLM.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Credential Validation. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Correlate workstation, account and status with destination logon events.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "This event does not supply the complete destination connection; success status alone does not show what the user accessed. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "TargetUserName, Workstation, Status" }, "tags": [ "windows", "xml", "ntlm", "authentication" ], "references": [ { "title": "4776(S, F) The computer attempted to validate the credentials for an account. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-4776.xml", "sha256": "9480a9ba4a83195198184e4085596973c6eacf3b5ba5be78b4b35932e5c26fd1", "bytes": 836, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "9edba6386e1246464031f0e6e2cf1f2694a9adcce2cefcac998456cfd7c58822", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4776", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-1102", "title": "Windows Security 1102 — Security audit log cleared", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "The Windows Security log was cleared.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit-log clearing. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Check the clearing account, maintenance window and continuity of forwarded records.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Clearing can be authorized maintenance; the local log cannot reconstruct records already removed. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "SubjectUserName, SubjectDomainName, SubjectLogonId" }, "tags": [ "windows", "xml", "audit-integrity", "defense-evasion" ], "references": [ { "title": "1102(S) The audit log was cleared. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-1102.xml", "sha256": "25f890259cbfb03d70d4fc3ac42600b0bb2faf32fef782e4bd7caf3f4868a8c9", "bytes": 947, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "665be99dd9ab9f2de0884753bf194433b2f017b3ee48fa0037aac4d03527e67f", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "1102", "provider": "Microsoft-Windows-Eventlog", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-5156", "title": "Windows Security 5156 — Filtering Platform connection permitted", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "Windows Filtering Platform permitted a connection.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Filtering Platform Connection. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Correlate process/application, direction and five-tuple with endpoint and network evidence.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Permit is a filtering decision, not proof of a completed application exchange; collection can be high volume. This sample uses event version 1.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "Application, Direction, SourceAddress, DestAddress, Protocol" }, "tags": [ "windows", "xml", "firewall", "network" ], "references": [ { "title": "5156(S) The Windows Filtering Platform has permitted a connection. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-5156.xml", "sha256": "369d43181bb8c75cccacf8b564c7150d8210747c445db0b7c4ff84b4d3333361", "bytes": 1199, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "41011831ad35aaa582294c6557b0321f69acf353690aded7dbec56ea9117d008", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "5156", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-4663", "title": "Windows Security 4663 — Object access", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "An audited object access was recorded for the configured object and access mask.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit File System or applicable object subcategory plus SACL. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Inspect access to sensitive objects and correlate process ID, logon ID and object name.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "Audit policy alone is insufficient without an applicable SACL; access does not establish exfiltration. This sample uses event version 1.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "ObjectName, AccessMask, ProcessName, SubjectLogonId" }, "tags": [ "windows", "xml", "file", "object-access" ], "references": [ { "title": "4663(S) An attempt was made to access an object. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/windows-security-4663.xml", "sha256": "92f9d59eef0a56e300832687a0c72fbcccebf022cdc7f5de9f4a7931d7bfa447", "bytes": 1318, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "66c4457f4fbd31daf4c49e4b8ab81278ea6576809abd47a54ead0d5d8a2f9ef1", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4663", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "windows-security-5136", "title": "Windows Security 5136 — Directory object modified", "group": "Windows and Active Directory", "system": "Windows", "format": "xml", "description": "A directory object attribute was modified on a domain controller.", "location": "Windows Event Log: Security; archived .evtx is binary, while this fixture is an XML event export.", "collection": "Configure Audit Directory Service Changes plus applicable SACL. Read with Get-WinEvent and preserve provider, event ID, version, computer and record ID.", "uses": [ "Review sensitive attribute changes, the actor and replication or administrative context.", "Compare event time with ingestion time and retain the original XML for a reviewable evidence trail." ], "limitations": "A modification can produce separate value-deleted and value-added records; preserve correlation and operation fields. This sample uses event version 0.", "field_notes": { "System/EventID": "Event identifier within the named provider.", "System/Version": "Version of this event layout.", "System/TimeCreated/@SystemTime": "Event timestamp in UTC.", "EventData": "Named fields; use names, not positional array indices.", "Relevant fields": "ObjectDN, AttributeLDAPDisplayName, AttributeValue, OperationType" }, "tags": [ "windows", "xml", "active-directory", "directory-change" ], "references": [ { "title": "5136(S) A directory service object was modified. - Windows 10 | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136" } ], "telemetry_components": [ "DC0066" ], "sample": { "path": "/log-sources/samples/windows-security-5136.xml", "sha256": "adb342ed79addd4139ff9008d03852b70102b7d696baed95012fb5ca49c73c3a", "bytes": 1439, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "bd57553dbabddbef0dc2ea360c93eb2c5e93d30640c370c677d84240c02c10b1", "transformation": "Removed Event Viewer tree expansion markers before XML tags; field values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "5136", "provider": "Microsoft-Windows-Security-Auditing", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "sysmon-1", "title": "Sysmon 1 — Process creation", "group": "Windows and Active Directory", "system": "Sysmon", "format": "xml", "description": "Sysmon records process creation through its Windows Operational channel.", "location": "Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.", "collection": "Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.", "uses": [ "Reconstruct process ancestry and suspicious command-line context.", "Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join." ], "limitations": "A process start does not prove successful payload behavior.", "field_notes": { "EventID": "1 in Microsoft-Windows-Sysmon.", "UtcTime": "Producer-supplied event time.", "ProcessGuid": "Process correlation identifier where present; case-sensitive field names vary by event.", "Relevant fields": "ProcessGuid, Image, CommandLine, ParentProcessGuid" }, "tags": [ "sysmon", "xml", "endpoint", "process", "process-creation" ], "references": [ { "title": "Sysmon - Sysinternals | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon" }, { "title": "Sysmon events | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-events" } ], "telemetry_components": [ "DC0032" ], "sample": { "path": "/log-sources/samples/sysmon-1.xml", "sha256": "bffbcecc27871ee51eb79ecff5ad9eb7f263d5e104986e48ad456e85838ed585", "bytes": 1691, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json", "locator": "events[51].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e9dfb46599d08c73a247eef708e9151bde5a533671aa47a45463f03aa2383575", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "1", "provider": "Microsoft-Windows-Sysmon", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "sysmon-3", "title": "Sysmon 3 — Network connection", "group": "Windows and Active Directory", "system": "Sysmon", "format": "xml", "description": "Sysmon records network connection through its Windows Operational channel.", "location": "Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.", "collection": "Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.", "uses": [ "Tie network connections to processes and compare destination history.", "Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join." ], "limitations": "Network connection logging is disabled by default in Sysmon; collection depends on configuration.", "field_notes": { "EventID": "3 in Microsoft-Windows-Sysmon.", "UtcTime": "Producer-supplied event time.", "ProcessGuid": "Process correlation identifier where present; case-sensitive field names vary by event.", "Relevant fields": "ProcessGuid, DestinationIp, DestinationPort, Initiated" }, "tags": [ "sysmon", "xml", "endpoint", "process", "network-connection" ], "references": [ { "title": "Sysmon - Sysinternals | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon" }, { "title": "Sysmon events | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-events" } ], "telemetry_components": [ "DC0082" ], "sample": { "path": "/log-sources/samples/sysmon-3.xml", "sha256": "1a39f40cbfc538095927cb9e3a141e67537dfce8424e1f56b48cb16aba72dd06", "bytes": 1410, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json", "locator": "events[71].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e9dfb46599d08c73a247eef708e9151bde5a533671aa47a45463f03aa2383575", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "3", "provider": "Microsoft-Windows-Sysmon", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "sysmon-7", "title": "Sysmon 7 — Image loaded", "group": "Windows and Active Directory", "system": "Sysmon", "format": "xml", "description": "Sysmon records image loaded through its Windows Operational channel.", "location": "Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.", "collection": "Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.", "uses": [ "Investigate unusual DLL paths and signature context.", "Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join." ], "limitations": "Image-load logging must be enabled; signature information can arrive asynchronously and is not a trust verdict.", "field_notes": { "EventID": "7 in Microsoft-Windows-Sysmon.", "UtcTime": "Producer-supplied event time.", "ProcessGuid": "Process correlation identifier where present; case-sensitive field names vary by event.", "Relevant fields": "Image, ImageLoaded, Signed, SignatureStatus" }, "tags": [ "sysmon", "xml", "endpoint", "process", "image-loaded" ], "references": [ { "title": "Sysmon - Sysinternals | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon" }, { "title": "Sysmon events | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-events" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/sysmon-7.xml", "sha256": "ea1a0e8a82ed6547451257a82dae7b4955fc6de36ea929da24d445230ade06e7", "bytes": 1521, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json", "locator": "events[195].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e9dfb46599d08c73a247eef708e9151bde5a533671aa47a45463f03aa2383575", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "7", "provider": "Microsoft-Windows-Sysmon", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "sysmon-8", "title": "Sysmon 8 — CreateRemoteThread", "group": "Windows and Active Directory", "system": "Sysmon", "format": "xml", "description": "Sysmon records createremotethread through its Windows Operational channel.", "location": "Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.", "collection": "Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.", "uses": [ "Investigate cross-process thread creation with module and process context.", "Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join." ], "limitations": "Not every injection method creates a remote thread; a record is not proof of malicious injection.", "field_notes": { "EventID": "8 in Microsoft-Windows-Sysmon.", "UtcTime": "Producer-supplied event time.", "ProcessGuid": "Process correlation identifier where present; case-sensitive field names vary by event.", "Relevant fields": "SourceProcessGuid, TargetProcessGuid, StartAddress" }, "tags": [ "sysmon", "xml", "endpoint", "process", "createremotethread" ], "references": [ { "title": "Sysmon - Sysinternals | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon" }, { "title": "Sysmon events | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-events" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/sysmon-8.xml", "sha256": "f77c316e8fa9f41383ec134ef15de3a7162145de373cea82ecdbce0f10be7254", "bytes": 1364, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json", "locator": "events[211].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e9dfb46599d08c73a247eef708e9151bde5a533671aa47a45463f03aa2383575", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "8", "provider": "Microsoft-Windows-Sysmon", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "sysmon-13", "title": "Sysmon 13 — Registry value set", "group": "Windows and Active Directory", "system": "Sysmon", "format": "xml", "description": "Sysmon records registry value set through its Windows Operational channel.", "location": "Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.", "collection": "Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.", "uses": [ "Inspect persistence-sensitive registry value changes and the writing process.", "Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join." ], "limitations": "Not all writes are malicious; determine value type and correlate the original registry location.", "field_notes": { "EventID": "13 in Microsoft-Windows-Sysmon.", "UtcTime": "Producer-supplied event time.", "ProcessGuid": "Process correlation identifier where present; case-sensitive field names vary by event.", "Relevant fields": "ProcessGuid, TargetObject, Details" }, "tags": [ "sysmon", "xml", "endpoint", "process", "registry-value-set" ], "references": [ { "title": "Sysmon - Sysinternals | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon" }, { "title": "Sysmon events | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-events" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/sysmon-13.xml", "sha256": "4eb954713c4e595071f89aedfe5b4dab6ff641996e898f355f34e1b7fee8d94d", "bytes": 1014, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json", "locator": "events[5].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e9dfb46599d08c73a247eef708e9151bde5a533671aa47a45463f03aa2383575", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "13", "provider": "Microsoft-Windows-Sysmon", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "sysmon-22", "title": "Sysmon 22 — DNS query", "group": "Windows and Active Directory", "system": "Sysmon", "format": "xml", "description": "Sysmon records dns query through its Windows Operational channel.", "location": "Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.", "collection": "Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.", "uses": [ "Connect DNS queries to the responsible process and corroborate network activity.", "Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join." ], "limitations": "DNS query data does not prove a later connection; cached answers and query outcomes affect interpretation.", "field_notes": { "EventID": "22 in Microsoft-Windows-Sysmon.", "UtcTime": "Producer-supplied event time.", "ProcessGuid": "Process correlation identifier where present; case-sensitive field names vary by event.", "Relevant fields": "ProcessGuid, QueryName, QueryStatus, QueryResults" }, "tags": [ "sysmon", "xml", "endpoint", "process", "dns-query" ], "references": [ { "title": "Sysmon - Sysinternals | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon" }, { "title": "Sysmon events | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-events" } ], "telemetry_components": [ "DC0096" ], "sample": { "path": "/log-sources/samples/sysmon-22.xml", "sha256": "5cadfddcce0ab410e19e8dca387291383b7302df9daa532ddecf5ed0df30950c", "bytes": 1066, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json", "locator": "events[0].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e9dfb46599d08c73a247eef708e9151bde5a533671aa47a45463f03aa2383575", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "22", "provider": "Microsoft-Windows-Sysmon", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "sysmon-23", "title": "Sysmon 23 — File deletion archived", "group": "Windows and Active Directory", "system": "Sysmon", "format": "xml", "description": "Sysmon records file deletion archived through its Windows Operational channel.", "location": "Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.", "collection": "Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.", "uses": [ "Review file deletion with retained artifacts and process history.", "Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join." ], "limitations": "FileDelete behavior and archiving differ from FileDeleteDetected event 26; validate configuration and storage retention.", "field_notes": { "EventID": "23 in Microsoft-Windows-Sysmon.", "UtcTime": "Producer-supplied event time.", "ProcessGuid": "Process correlation identifier where present; case-sensitive field names vary by event.", "Relevant fields": "ProcessGuid, TargetFilename, Hashes, Archived" }, "tags": [ "sysmon", "xml", "endpoint", "process", "file-deletion-archived" ], "references": [ { "title": "Sysmon - Sysinternals | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon" }, { "title": "Sysmon events | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-events" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/sysmon-23.xml", "sha256": "4d7c5ae56349329038568f3606ea79fa3532b01dd0095193dbd5382b2c3c7704", "bytes": 1213, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json", "locator": "events[2].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e9dfb46599d08c73a247eef708e9151bde5a533671aa47a45463f03aa2383575", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "23", "provider": "Microsoft-Windows-Sysmon", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "powershell-4103", "title": "PowerShell 4103 — Module logging", "group": "Windows and Active Directory", "system": "PowerShell", "format": "xml", "description": "PowerShell logs pipeline execution details for configured modules.", "location": "Windows PowerShell: Microsoft-Windows-PowerShell/Operational. PowerShell 7 uses PowerShellCore/Operational after registration.", "collection": "Enable the corresponding module or script-block logging policy for the target edition. Read with Get-WinEvent; protect potentially sensitive script content.", "uses": [ "Review suspicious automation with process, user and host context.", "For script blocks, reconstruct MessageNumber / MessageTotal parts by ScriptBlockId and preserve ordering." ], "limitations": "Logging and automatic suspicious-script behavior differ by version; script text is not proof every command completed.", "field_notes": { "EventID": "4103", "ContextInfo": "Pipeline/module context where present.", "ScriptBlockText": "Script text in event 4104; can include secrets.", "ScriptBlockId": "Script-block correlation value, not a process identifier." }, "tags": [ "powershell", "xml", "script", "execution" ], "references": [ { "title": "about_Logging_Windows - PowerShell | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5" } ], "telemetry_components": [ "DC0064" ], "sample": { "path": "/log-sources/samples/powershell-4103.xml", "sha256": "19949426f543928077fd75fb64022f97bb6634a9d7c1aa74a605541115adffbf", "bytes": 1618, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json", "locator": "events[1].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "10825018283c4c91047490ffd28ab38de19792e79666d6406fcf042f543afb89", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4103", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "powershell-4104", "title": "PowerShell 4104 — Script block logging", "group": "Windows and Active Directory", "system": "PowerShell", "format": "xml", "description": "PowerShell logs script-block text with an identifier and multipart sequence fields.", "location": "Windows PowerShell: Microsoft-Windows-PowerShell/Operational. PowerShell 7 uses PowerShellCore/Operational after registration.", "collection": "Enable the corresponding module or script-block logging policy for the target edition. Read with Get-WinEvent; protect potentially sensitive script content.", "uses": [ "Review suspicious automation with process, user and host context.", "For script blocks, reconstruct MessageNumber / MessageTotal parts by ScriptBlockId and preserve ordering." ], "limitations": "Logging and automatic suspicious-script behavior differ by version; script text is not proof every command completed.", "field_notes": { "EventID": "4104", "ContextInfo": "Pipeline/module context where present.", "ScriptBlockText": "Script text in event 4104; can include secrets.", "ScriptBlockId": "Script-block correlation value, not a process identifier." }, "tags": [ "powershell", "xml", "script", "execution" ], "references": [ { "title": "about_Logging_Windows - PowerShell | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5" } ], "telemetry_components": [ "DC0064" ], "sample": { "path": "/log-sources/samples/powershell-4104.xml", "sha256": "fd4aedcb9af1e770f9b93aaba3552fa64f96ed572d4af8e10c9716024123ec18", "bytes": 897, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json", "locator": "events[3].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "10825018283c4c91047490ffd28ab38de19792e79666d6406fcf042f543afb89", "transformation": "Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "event_id": "4104", "root": "{http://schemas.microsoft.com/win/2004/08/events/event}Event" }, "reviewed_on": "2026-11-10" }, { "id": "linux-sshd", "title": "Linux SSH authentication — auth.log / secure", "group": "Linux and Unix", "system": "Linux", "format": "syslog", "description": "OpenSSH authentication messages are routed through the host logging configuration.", "location": "Often /var/log/auth.log on Debian-family systems or /var/log/secure on RHEL-family systems; journald may be the primary store.", "collection": "Check sshd LogLevel and SyslogFacility plus rsyslog/journald routing and permissions.", "uses": [ "Correlate failed and accepted logins by account and remote address.", "Join the sshd PID and session time to sudo, audit and process records." ], "limitations": "Traditional syslog timestamps lack year and timezone. An accepted authentication method does not establish the subsequent commands.", "field_notes": { "sshd[pid]": "Daemon process identifier.", "Accepted publickey": "Authentication outcome and method.", "from / port": "Remote peer as observed by sshd." }, "tags": [ "linux", "syslog", "authentication", "ssh", "var-log" ], "references": [ { "title": "sshd(8) - OpenBSD manual pages", "url": "https://man.openbsd.org/sshd.8" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/linux-sshd.log", "sha256": "ff1a23c6f2a42ac96b679ccc6de8e2bcd814e2e4c378478d944072d92b8c8f40", "bytes": 152, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "f9900f7fff6e839b4bed266e40324a214be4bba9861fcc2ca54254f76d3f321f", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "linux-sudo", "title": "Linux sudo audit messages", "group": "Linux and Unix", "system": "Linux", "format": "syslog", "description": "sudo can record attempted privilege transitions and command context through syslog or its configured logs.", "location": "System authentication log or configured sudo logfile; optional I/O logs are a separate format.", "collection": "Review sudoers logging settings and log destinations. Keep command arguments under an appropriate access policy.", "uses": [ "Compare invoking user, target user, command and approved change.", "Correlate the terminal and working directory with the login session." ], "limitations": "A logged command request does not prove command completion. I/O logging is separately configured.", "field_notes": { "TTY": "Invoking terminal.", "PWD": "Working directory.", "USER": "Requested target account.", "COMMAND": "Requested command and arguments." }, "tags": [ "linux", "syslog", "privilege", "sudo", "var-log" ], "references": [ { "title": "Sudoers Manual | Sudo", "url": "https://www.sudo.ws/docs/man/sudoers.man/" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/linux-sudo.log", "sha256": "bb8324153253d60b707769ddd81412fbb2e1080f040d26a5717d4df26da58e3a", "bytes": 102, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log", "locator": "line 5", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "f9900f7fff6e839b4bed266e40324a214be4bba9861fcc2ca54254f76d3f321f", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "linux-audit-syscall", "title": "Linux Audit syscall", "group": "Linux and Unix", "system": "Linux Audit", "format": "audit", "description": "Kernel audit syscall records include identity, architecture, return status and process context.", "location": "Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.", "collection": "Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.", "uses": [ "Join the audit timestamp and serial to related EXECVE, CWD and PATH records.", "Preserve the raw record and its complete event group before enrichment or normalization." ], "limitations": "Syscall numbers depend on architecture; auid 4294967295 represents an unset login UID, not a named user.", "field_notes": { "type": "Audit record type.", "msg=audit(epoch:serial)": "Timestamp and serial used to group records.", "auid / uid": "Login identity and effective process context differ.", "arch": "Syscall architecture discriminator when present." }, "tags": [ "linux-audit", "audit", "var-log", "syscall" ], "references": [ { "title": "ausearch(8) - Linux manual page", "url": "https://man7.org/linux/man-pages/man8/ausearch.8.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/linux-audit-syscall.log", "sha256": "52464230aca002e92ab3e55dd62fd46fe810a62ba97874d8fe00977736c6ee60", "bytes": 335, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log", "locator": "line 2", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "af4273740afed7479d28ac3fd2bcad35a750a5101d6ae44e8d4a512fe3ad0d9b", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "linux-audit-execve", "title": "Linux Audit command arguments", "group": "Linux and Unix", "system": "Linux Audit", "format": "audit", "description": "EXECVE records describe arguments associated with an audited exec call.", "location": "Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.", "collection": "Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.", "uses": [ "Reassemble argument records and correlate the same event serial with SYSCALL and PATH.", "Preserve the raw record and its complete event group before enrichment or normalization." ], "limitations": "Arguments may be hex encoded, split across records or truncated; do not interpret one record as the entire event.", "field_notes": { "type": "Audit record type.", "msg=audit(epoch:serial)": "Timestamp and serial used to group records.", "auid / uid": "Login identity and effective process context differ.", "arch": "Syscall architecture discriminator when present." }, "tags": [ "linux-audit", "audit", "var-log", "execve" ], "references": [ { "title": "ausearch(8) - Linux manual page", "url": "https://man7.org/linux/man-pages/man8/ausearch.8.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/linux-audit-execve.log", "sha256": "ecff992510a722b0cdcae3fda1efa4cd257d9e4e9fa6144940b4902147c60eb9", "bytes": 60, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log", "locator": "line 11", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "af4273740afed7479d28ac3fd2bcad35a750a5101d6ae44e8d4a512fe3ad0d9b", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "linux-audit-path", "title": "Linux Audit object paths", "group": "Linux and Unix", "system": "Linux Audit", "format": "audit", "description": "PATH records describe objects associated with a kernel audit event.", "location": "Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.", "collection": "Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.", "uses": [ "Join item, inode and path to the corresponding syscall and device context.", "Preserve the raw record and its complete event group before enrichment or normalization." ], "limitations": "A PATH record alone does not prove a file write, successful access or exfiltration.", "field_notes": { "type": "Audit record type.", "msg=audit(epoch:serial)": "Timestamp and serial used to group records.", "auid / uid": "Login identity and effective process context differ.", "arch": "Syscall architecture discriminator when present." }, "tags": [ "linux-audit", "audit", "var-log", "path" ], "references": [ { "title": "ausearch(8) - Linux manual page", "url": "https://man7.org/linux/man-pages/man8/ausearch.8.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/linux-audit-path.log", "sha256": "94e86c0f25a12bc05a2b67814b1753f676cc1840103449aac7e25cd88692ed92", "bytes": 189, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log", "locator": "line 41", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "af4273740afed7479d28ac3fd2bcad35a750a5101d6ae44e8d4a512fe3ad0d9b", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "linux-audit-avc", "title": "SELinux AVC denials", "group": "Linux and Unix", "system": "Linux Audit", "format": "audit", "description": "SELinux access-vector-cache messages record an access-control decision and security contexts.", "location": "Typically /var/log/audit/audit.log when auditd is configured; audit transport records can be aggregated differently.", "collection": "Review audit rules, backlog/lost-event counters, daemon state and retention. Use ausearch with an authorized local log copy.", "uses": [ "Review denied permissions with source and target labels and application activity.", "Preserve the raw record and its complete event group before enrichment or normalization." ], "limitations": "Permissive mode changes enforcement; a denial record must be interpreted with policy and permissive state.", "field_notes": { "type": "Audit record type.", "msg=audit(epoch:serial)": "Timestamp and serial used to group records.", "auid / uid": "Login identity and effective process context differ.", "arch": "Syscall architecture discriminator when present." }, "tags": [ "linux-audit", "audit", "var-log", "avc" ], "references": [ { "title": "ausearch(8) - Linux manual page", "url": "https://man7.org/linux/man-pages/man8/ausearch.8.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/linux-audit-avc.log", "sha256": "a4650a2b56bab5a0c3f42e046842c6204fd2e770035df2cf0ff3f3e1f5881a06", "bytes": 223, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log", "locator": "line 49", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "af4273740afed7479d28ac3fd2bcad35a750a5101d6ae44e8d4a512fe3ad0d9b", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "linux-journal", "title": "systemd journal — JSON export", "group": "Linux and Unix", "system": "systemd", "format": "json", "description": "journalctl serializes journal entries to JSON; strings, arrays, byte arrays and null have distinct meanings.", "location": "Binary .journal files under /run/log/journal or /var/log/journal; journalctl -o json provides a textual export.", "collection": "Check journald storage policy, namespace, rate limiting and access. Export selected authorized entries with journalctl -o json.", "uses": [ "Test parsers against scalar strings, repeated fields, binary arrays and null values.", "For real events, correlate _BOOT_ID, process identifiers and timestamps; these metadata fields are absent from this format-demonstration sample." ], "limitations": "This is the publisher’s serialization demonstration, not a captured security event. JSON is not the binary journal file format.", "field_notes": { "MESSAGE": "Application message.", "_UDEV_DEVLINK": "Repeated values become a JSON array.", "BINARY": "Non-text bytes become a numeric array.", "LARGE": "null can represent a field omitted because of its size." }, "tags": [ "systemd", "json", "journal", "var-log", "parser" ], "references": [ { "title": "Journal Export Formats", "url": "https://systemd.io/JOURNAL_EXPORT_FORMATS/" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/linux-journal.json", "sha256": "d868b81686aa408c6c0551b64273368d99635a097cd53ebcd843db6e8580eada", "bytes": 264, "kind": "publisher-documentation-example", "source_url": "https://systemd.io/JOURNAL_EXPORT_FORMATS/", "locator": "preformatted example 5", "source_commit": null, "source_sha256": "ff906f75d1e71aac7991d93405ab51c18a3becee39b4b44f30b72fd4f41c7bbc", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "MESSAGE", "_UDEV_DEVNODE", "_UDEV_DEVLINK", "BINARY", "LARGE" ] }, "reviewed_on": "2026-11-10" }, { "id": "macos-unified", "title": "macOS Unified Logging — JSON event", "group": "Endpoint and virtualization", "system": "macOS", "format": "json", "description": "Unified Logging exposes structured application and operating-system messages with subsystem and process context.", "location": "Unified log store; log show or log stream JSON output, subject to OS version, permissions and privacy redaction.", "collection": "Select a bounded time interval and predicate. Preserve the exact log output style; private fields may remain redacted.", "uses": [ "Filter authentication-related subsystems and correlate with endpoint process evidence.", "Compare process ID, subsystem, category and event message to reconstruct a bounded timeline." ], "limitations": "Unified logs are not a complete process-audit feed; timestamps, field availability and privacy behavior vary by release.", "field_notes": { "timestamp": "Event timestamp in the serialized record.", "subsystem / category": "Producer-defined classification.", "eventMessage": "Rendered message, potentially privacy-redacted.", "processID": "Process identifier; correlate with time and host." }, "tags": [ "macos", "json", "endpoint", "authentication" ], "references": [ { "title": "Logging | Apple Developer Documentation", "url": "https://developer.apple.com/documentation/os/logging" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/macos-unified.json", "sha256": "49ab0c7d7101b3667ab5105bd696d1c8d557ba8a8db102d616c2d6a0f981128e", "bytes": 1226, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/macos/data_stream/authentication/_dev/test/pipeline/test-authentication.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e335907506f1a5f9f4deed2b7b83fffc44d20b35b45befc3996453e04f777454", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "timezoneName", "messageType", "eventType", "source", "formatString", "userID", "activityIdentifier", "subsystem", "category", "threadID", "senderImageUUID", "backtrace", "bootUUID", "processImagePath", "senderImagePath", "timestamp", "eventMessage", "processImageUUID", "traceID", "processID", "senderProgramCounter", "parentActivityIdentifier" ] }, "reviewed_on": "2026-11-10" }, { "id": "osquery-results", "title": "osquery differential results", "group": "Endpoint and virtualization", "system": "osquery", "format": "json", "description": "Scheduled query differential results describe rows added or removed relative to the query’s prior state.", "location": "Configured logger destination, commonly osqueryd.results.log; not the INFO status log.", "collection": "Review the scheduled SQL, interval, host identifier and differential versus snapshot mode.", "uses": [ "Investigate a new process or configuration row with its query name and schedule.", "Keep removed and added results together when evaluating state changes." ], "limitations": "A scheduled process-table query can miss short-lived processes. An added row is a state delta, not automatically a real-time creation event.", "field_notes": { "action": "added, removed or snapshot semantics depend on logger mode.", "columns": "Result values from the scheduled SQL; values are commonly strings.", "name": "Scheduled query name.", "unixTime": "Event time represented as epoch seconds." }, "tags": [ "osquery", "json", "endpoint", "inventory", "process" ], "references": [ { "title": "Logging - osquery", "url": "https://osquery.readthedocs.io/en/stable/deployment/logging/" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/osquery-results.json", "sha256": "09436c141a9bcdc9adde91df59d9b5b17ad2af4b37541614fb293f51a837a84d", "bytes": 320, "kind": "publisher-documentation-example", "source_url": "https://osquery.readthedocs.io/en/stable/deployment/logging/", "locator": "preformatted example 6", "source_commit": null, "source_sha256": "d255e3fdabc60c52bd0f96e52ddb2d0c79689831f0f32f68e487efa4de9be66e", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "action", "columns", "name", "hostname", "calendarTime", "unixTime", "epoch", "counter", "numerics" ] }, "reviewed_on": "2026-11-10" }, { "id": "defender-alerts", "title": "Microsoft Defender for Endpoint alerts API", "group": "Endpoint and virtualization", "system": "Microsoft Defender", "format": "json", "description": "Alert objects describe a detection and its workflow state in Defender for Endpoint.", "location": "Vendor API or configured event stream, with tenant permissions and retention controls.", "collection": "Use the documented API scope and subscription; preserve event IDs, metadata version and pagination/offset state.", "uses": [ "Triage the stated detection with source telemetry and analyst context.", "Track duplicate delivery, status changes and last-update timestamps without overwriting original evidence." ], "limitations": "An alert API object is not a DeviceProcessEvents raw event; verdict, investigation state and workflow status are different concepts.", "field_notes": { "id / event ID": "Vendor-scoped identity; retain tenant context.", "status": "Workflow status is not evidence of maliciousness.", "metadata": "Stream version and cursor information where present." }, "tags": [ "microsoft-defender", "json", "edr", "alerts" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/defender-alerts.json", "sha256": "4f1175121a46b487058bd1b468effe406b0fbb21532b6335578573ad9f7f3876", "bytes": 1825, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/microsoft_defender_endpoint/data_stream/log/_dev/test/pipeline/test-defenderatp.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "4a0a2bfd0aa0263d24d77da62824683cda9832d9f7ff9edb898905e105897d6e", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "id", "incidentId", "investigationId", "assignedTo", "severity", "status", "classification", "determination", "investigationState", "detectionSource", "category", "threatFamilyName", "title", "description", "alertCreationTime", "firstEventTime", "lastEventTime", "lastUpdateTime", "resolvedTime", "machineId", "computerDnsName", "rbacGroupName", "aadTenantId", "relatedUser", "comments", "evidence" ] }, "reviewed_on": "2026-11-10" }, { "id": "crowdstrike-event-stream", "title": "CrowdStrike Falcon event stream", "group": "Endpoint and virtualization", "system": "CrowdStrike", "format": "json", "description": "Falcon event-stream objects carry a metadata envelope and an event-specific payload.", "location": "Vendor API or configured event stream, with tenant permissions and retention controls.", "collection": "Use the documented API scope and subscription; preserve event IDs, metadata version and pagination/offset state.", "uses": [ "Triage the stated detection with source telemetry and analyst context.", "Track duplicate delivery, status changes and last-update timestamps without overwriting original evidence." ], "limitations": "This is an Event Streams example, not a Falcon Data Replicator raw sensor event. Event types have different payload schemas.", "field_notes": { "id / event ID": "Vendor-scoped identity; retain tenant context.", "status": "Workflow status is not evidence of maliciousness.", "metadata": "Stream version and cursor information where present." }, "tags": [ "crowdstrike", "json", "edr", "alerts" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/crowdstrike-event-stream.json", "sha256": "70003e22cee579f1989b902eb39a9a4aa71cb92abed93a462fc103b4428a4509", "bytes": 1495, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-automated-lead-summary.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "70003e22cee579f1989b902eb39a9a4aa71cb92abed93a462fc103b4428a4509", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "metadata", "event" ] }, "reviewed_on": "2026-11-10" }, { "id": "vcenter-syslog", "title": "VMware vCenter audit and event syslog", "group": "Endpoint and virtualization", "system": "VMware", "format": "syslog", "description": "vCenter emits management and session activity through service logs and remote syslog.", "location": "vCenter service logs / configured remote syslog; ESXi host logs are separate sources.", "collection": "Configure supported remote logging and time synchronization; retain service/app name and management-plane identity.", "uses": [ "Review management login/logout sequences and administrative actions.", "Correlate session events with change tickets and hypervisor-side logs." ], "limitations": "This is a vCenter vpxd event, not an ESXi vmkernel record. Do not use one parser for all VMware services.", "field_notes": { "APP-NAME": "vpxd identifies the emitting service.", "vim.event.UserLoginSessionEvent": "Native event class.", "Event [id]": "Event identifier inside the message." }, "tags": [ "vmware", "syslog", "virtualization", "administration" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/vcenter-syslog.log", "sha256": "67b7b05d871de229ae5a1369f7f00758695528cc8a0546e27e886ff93601827a", "bytes": 277, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log", "locator": "line 3", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "8d5b115ca2e1d8c9acc82af2058ad3105667577aedfb07fd6e9d0a3cfa732349", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "panos-traffic", "title": "Palo Alto PAN-OS traffic", "group": "Network and perimeter", "system": "PAN-OS", "format": "csv", "description": "Session traffic and policy decisions.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Correlate session ID, source/destination, action, application and byte counters.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "CSV layouts vary by release and configured forwarding format; a session-end record is different from a start record.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "pan-os", "csv", "network", "perimeter" ], "references": [ { "title": "Traffic Log Fields", "url": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/panos-traffic.log", "sha256": "1127fd5c643752c9d5b4278800e1c9cc41de0ef282657600bc0b7f5f1580c66c", "bytes": 499, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "496ba1b7a1d9804ea5453f9b1a54de7c72063b380bc8783da7d65602984f45ef", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "panos-threat", "title": "Palo Alto PAN-OS threat", "group": "Network and perimeter", "system": "PAN-OS", "format": "csv", "description": "Threat log records; this fixture is a URL subtype.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Pivot from subtype and session ID to traffic and endpoint context.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "Threat subtypes have different meanings; URL logging alone does not establish exploitation.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "pan-os", "csv", "network", "perimeter" ], "references": [ { "title": "Traffic Log Fields", "url": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/panos-threat.log", "sha256": "7844d4db038db89f0c650ac376a5a02fbff17b5a99e85397ab4d8eb531a4c62c", "bytes": 542, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-threat-sample.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "b697b9a427b9d5b248d68d35eaa1713cf93c8f578a948d55c352d9119c38c7fe", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "panos-config", "title": "Palo Alto PAN-OS configuration", "group": "Network and perimeter", "system": "PAN-OS", "format": "csv", "description": "Management-plane configuration activity.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Review actor, command, configuration path and outcome against approved changes.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "A configuration record is not a packet or session log.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "pan-os", "csv", "network", "perimeter" ], "references": [ { "title": "Traffic Log Fields", "url": "https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/panos-config.log", "sha256": "ec2b59d890574ae812ec67425325a348919c963cfe76cb7b15f4f59d386a80b5", "bytes": 268, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-config-sample.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "d8a1ca2c99ec29b4e5b2906eb3b24ab06206cdb142019de33dcc936a49d11c48", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "fortigate-utm", "title": "FortiGate UTM security events", "group": "Network and perimeter", "system": "FortiGate", "format": "key-value", "description": "FortiOS UTM records with typed key=value fields.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Review subtype, action, policy and connection context alongside traffic logs.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "This fixture represents the upstream 7.2 test layout; different UTM subtypes have different fields.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "fortigate", "key-value", "network", "perimeter" ], "references": [ { "title": "Log message fields | FortiGate / FortiOS 7.0.5 | Fortinet Document Library", "url": "https://docs.fortinet.com/document/fortigate/7.0.5/fortios-log-message-reference/357866/log-message-fields" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/fortigate-utm.log", "sha256": "d2181011da9ff4180364b529c7c6ba27122f80697368640e6c9effd8ae595e25", "bytes": 786, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet-7-2.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "f70ceda157b17dc9151dc7bc58eccff13a197b0356fbde356947dfad13c6774f", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "cisco-asa-connections", "title": "Cisco ASA TCP connection creation", "group": "Network and perimeter", "system": "Cisco ASA", "format": "syslog", "description": "ASA message 302013 records a TCP connection built by the firewall.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Join connection ID to teardown messages and NAT records.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "Built does not establish application success; message IDs define distinct layouts.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "cisco-asa", "syslog", "network", "perimeter" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/cisco-asa-connections.log", "sha256": "bf0769449352ed8c0725b366434bc31791e9b5c3b8cb83c806b331eff04a8539", "bytes": 197, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log", "locator": "line 2", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "0fc3d2cd58d0d67a08efcc09ad95d55249347cb9f2e4dd8668fa6cce644a7cbd", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "cisco-asa-teardown", "title": "Cisco ASA TCP teardown", "group": "Network and perimeter", "system": "Cisco ASA", "format": "syslog", "description": "ASA message 302014 describes a connection teardown.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Review duration, bytes and teardown reason with the matching build message.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "Missing creation or teardown records can reflect collection loss or long-lived sessions.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "cisco-asa", "syslog", "network", "perimeter" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/cisco-asa-teardown.log", "sha256": "1d1a3b10594c237e5b84465a81460fe18625b89354706968263f2b1237eadb5f", "bytes": 191, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log", "locator": "line 3", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "0fc3d2cd58d0d67a08efcc09ad95d55249347cb9f2e4dd8668fa6cce644a7cbd", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "cisco-asa-nat", "title": "Cisco ASA address translation", "group": "Network and perimeter", "system": "Cisco ASA", "format": "syslog", "description": "ASA translation messages relate local and translated addresses.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Recover address context when correlating internal hosts and perimeter observations.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "A NAT translation alone does not identify a user or application.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "cisco-asa", "syslog", "network", "perimeter" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/cisco-asa-nat.log", "sha256": "d87ff3f02e2d489b47511ace8c68327431e8d17b6c1a3cb588c2739c95b2d7f7", "bytes": 151, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "0fc3d2cd58d0d67a08efcc09ad95d55249347cb9f2e4dd8668fa6cce644a7cbd", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "pfsense-filterlog", "title": "pfSense packet filter", "group": "Network and perimeter", "system": "pfSense", "format": "csv", "description": "filterlog emits a syslog envelope followed by packet-filter CSV.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Review rule, interface, action, direction and protocol-specific fields.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "Field positions after the common prefix depend on IP version and protocol.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "pfsense", "csv", "network", "perimeter" ], "references": [ { "title": "Raw Filter Log Format | pfSense Documentation", "url": "https://docs.netgate.com/pfsense/en/latest/monitoring/logs/raw-filter-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/pfsense-filterlog.log", "sha256": "5da4285e4bd41d947b96765f5e26e2308a594ed8ffc1b788cfd0fc4bc81f4b08", "bytes": 193, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-bsd.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "50305fde1c67622d7738e467a736a5cc3bee157ea1007bf0273e58fa3678ab1a", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "juniper-srx-flow", "title": "Juniper SRX session flow", "group": "Network and perimeter", "system": "Juniper SRX", "format": "syslog", "description": "RT_FLOW_SESSION_CREATE uses structured session fields in a syslog message.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Correlate session identifier, zones, policy and translated addresses.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "Session creation is not a completed transaction; retain the structured-data escaping.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "juniper-srx", "syslog", "network", "perimeter" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/juniper-srx-flow.log", "sha256": "f246631534dcb13186c2d769570e2acc374d7ea7376ae2e942b59ba2dc3c1cc5", "bytes": 850, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-flow.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "44681891ec7aaa2ac122ba8cc39b2b79b3ad34d2bace307b7988ce5857174085", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "zscaler-web", "title": "Zscaler NSS web — configured JSON", "group": "Network and perimeter", "system": "Zscaler", "format": "json", "description": "A configured NSS web JSON export with an event envelope.", "location": "Device logging subsystem / configured remote syslog or vendor export.", "collection": "Record firmware version, enabled log categories, forwarding template, time zone and reliable transport settings.", "uses": [ "Review URL, user, action and destination in the configured feed.", "Compare device event time and collector time; monitor drops and preserve the original message." ], "limitations": "NSS output templates are configurable; this example is not a universal Zscaler schema.", "field_notes": { "Envelope": "Priority, timestamp and hostname depend on the transport format.", "Message payload": "Use the exact vendor message type and version, not a generic whitespace split." }, "tags": [ "zscaler", "json", "network", "perimeter" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/zscaler-web.json", "sha256": "38e1d5ff8ce421c6dbd3566b2964ce850269608fb92cdc4c945b9074c8f0be2b", "bytes": 4953, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "d9c844adfe1831f1caabf0e7af0bfaa8015a37219e9ba1140eae96351319be53", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "version", "sourcetype", "event" ] }, "reviewed_on": "2026-11-10" }, { "id": "zeek-connection", "title": "Zeek connection JSON", "group": "Network sensors", "system": "Zeek", "format": "json", "description": "Zeek protocol analysis produces structured metadata from observed network traffic.", "location": "Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.", "collection": "Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.", "uses": [ "Correlate connection state, duration and byte counts.", "Join uid across connection and protocol logs; use fuid for file references when present." ], "limitations": "Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.", "field_notes": { "ts": "Epoch timestamp of the logged activity.", "uid": "Connection identifier, when present; retain sensor context.", "fuid": "File identifier, when present.", "id.orig_h / id.resp_h": "Originator and responder addresses, not necessarily client intent." }, "tags": [ "zeek", "json", "network", "sensor", "connection" ], "references": [ { "title": "conn.log — Book of Zeek (9.0.1)", "url": "https://docs.zeek.org/en/current/logs/conn.html" } ], "telemetry_components": [ "DC0082" ], "sample": { "path": "/log-sources/samples/zeek-connection.json", "sha256": "2a1bf18ec5642a983f337626f13e9186b895dbe36dd1374c84930ba9d0f4b6f1", "bytes": 448, "kind": "publisher-documentation-example", "source_url": "https://docs.zeek.org/en/current/logs/conn.html", "locator": "preformatted example 5", "source_commit": null, "source_sha256": "a1992bd3b47a887f13a482a047e2445ca2f99539212f08ef698af7d7f682d38e", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "uid", "conn_state" ] }, "reviewed_on": "2026-11-10" }, { "id": "zeek-dns", "title": "Zeek DNS JSON", "group": "Network sensors", "system": "Zeek", "format": "json", "description": "Zeek protocol analysis produces structured metadata from observed network traffic.", "location": "Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.", "collection": "Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.", "uses": [ "Review queried names, response codes and answers.", "Join uid across connection and protocol logs; use fuid for file references when present." ], "limitations": "Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.", "field_notes": { "ts": "Epoch timestamp of the logged activity.", "uid": "Connection identifier, when present; retain sensor context.", "fuid": "File identifier, when present.", "id.orig_h / id.resp_h": "Originator and responder addresses, not necessarily client intent." }, "tags": [ "zeek", "json", "network", "sensor", "dns" ], "references": [ { "title": "dns.log — Book of Zeek (9.0.1)", "url": "https://docs.zeek.org/en/current/logs/dns.html" } ], "telemetry_components": [ "DC0096" ], "sample": { "path": "/log-sources/samples/zeek-dns.json", "sha256": "9352fefb1d76b62f720bd7b892c0be00f4d90b6003f91dfdfbff6f0780d2202c", "bytes": 595, "kind": "publisher-documentation-example", "source_url": "https://docs.zeek.org/en/current/logs/dns.html", "locator": "preformatted example 5", "source_commit": null, "source_sha256": "e702c3fbb8775233b0b2ba59cab602879f4e828d83c95bb1e4a32a0a0171d893", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "uid", "query" ] }, "reviewed_on": "2026-11-10" }, { "id": "zeek-http", "title": "Zeek HTTP JSON", "group": "Network sensors", "system": "Zeek", "format": "json", "description": "Zeek protocol analysis produces structured metadata from observed network traffic.", "location": "Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.", "collection": "Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.", "uses": [ "Inspect request method, host, URI and response status.", "Join uid across connection and protocol logs; use fuid for file references when present." ], "limitations": "Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.", "field_notes": { "ts": "Epoch timestamp of the logged activity.", "uid": "Connection identifier, when present; retain sensor context.", "fuid": "File identifier, when present.", "id.orig_h / id.resp_h": "Originator and responder addresses, not necessarily client intent." }, "tags": [ "zeek", "json", "network", "sensor", "http" ], "references": [ { "title": "http.log — Book of Zeek (9.0.1)", "url": "https://docs.zeek.org/en/current/logs/http.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/zeek-http.json", "sha256": "2f6c37dfdd8880426ed9927e5ac3fc1dc845a57b134ca814878c977eb56f0bac", "bytes": 405, "kind": "publisher-documentation-example", "source_url": "https://docs.zeek.org/en/current/logs/http.html", "locator": "preformatted example 2", "source_commit": null, "source_sha256": "5ad2e9a76c961e9b3c742af1f8e073e77dce97c941ba75da409df289636c05f5", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "uid", "method" ] }, "reviewed_on": "2026-11-10" }, { "id": "zeek-tls", "title": "Zeek TLS JSON", "group": "Network sensors", "system": "Zeek", "format": "json", "description": "Zeek protocol analysis produces structured metadata from observed network traffic.", "location": "Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.", "collection": "Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.", "uses": [ "Review TLS version and certificate references where available.", "Join uid across connection and protocol logs; use fuid for file references when present." ], "limitations": "Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.", "field_notes": { "ts": "Epoch timestamp of the logged activity.", "uid": "Connection identifier, when present; retain sensor context.", "fuid": "File identifier, when present.", "id.orig_h / id.resp_h": "Originator and responder addresses, not necessarily client intent." }, "tags": [ "zeek", "json", "network", "sensor", "tls" ], "references": [ { "title": "ssl.log — Book of Zeek (9.0.1)", "url": "https://docs.zeek.org/en/current/logs/ssl.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/zeek-tls.json", "sha256": "cb60724dd70c848a4aa6d9100e8632c62283092423eb76b2c4d41a4718519ee9", "bytes": 630, "kind": "publisher-documentation-example", "source_url": "https://docs.zeek.org/en/current/logs/ssl.html", "locator": "preformatted example 6", "source_commit": null, "source_sha256": "963dceeb5617f2e4f9524c463610f880d762d6a494c8408caa942d4f6cd80cae", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "uid", "version" ] }, "reviewed_on": "2026-11-10" }, { "id": "zeek-file", "title": "Zeek file analysis JSON", "group": "Network sensors", "system": "Zeek", "format": "json", "description": "Zeek protocol analysis produces structured metadata from observed network traffic.", "location": "Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.", "collection": "Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.", "uses": [ "Join file IDs to protocol and connection evidence.", "Join uid across connection and protocol logs; use fuid for file references when present." ], "limitations": "Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.", "field_notes": { "ts": "Epoch timestamp of the logged activity.", "uid": "Connection identifier, when present; retain sensor context.", "fuid": "File identifier, when present.", "id.orig_h / id.resp_h": "Originator and responder addresses, not necessarily client intent." }, "tags": [ "zeek", "json", "network", "sensor", "file" ], "references": [ { "title": "files.log — Book of Zeek (9.0.1)", "url": "https://docs.zeek.org/en/current/logs/files.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/zeek-file.json", "sha256": "2147c5e00848cf7c329729eec3462f0065fc40758f4bb3d52614a7c4ecdbe22a", "bytes": 562, "kind": "publisher-documentation-example", "source_url": "https://docs.zeek.org/en/current/logs/files.html", "locator": "preformatted example 7", "source_commit": null, "source_sha256": "e5cf1c4e527683315dac842160c2b84d2014ae292a7a52ac07bb248af4082802", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "fuid" ] }, "reviewed_on": "2026-11-10" }, { "id": "zeek-ssh", "title": "Zeek SSH JSON", "group": "Network sensors", "system": "Zeek", "format": "json", "description": "Zeek protocol analysis produces structured metadata from observed network traffic.", "location": "Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.", "collection": "Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.", "uses": [ "Investigate SSH session metadata with endpoint authentication evidence.", "Join uid across connection and protocol logs; use fuid for file references when present." ], "limitations": "Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.", "field_notes": { "ts": "Epoch timestamp of the logged activity.", "uid": "Connection identifier, when present; retain sensor context.", "fuid": "File identifier, when present.", "id.orig_h / id.resp_h": "Originator and responder addresses, not necessarily client intent." }, "tags": [ "zeek", "json", "network", "sensor", "ssh" ], "references": [ { "title": "ssh.log — Book of Zeek (9.0.1)", "url": "https://docs.zeek.org/en/current/logs/ssh.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/zeek-ssh.json", "sha256": "6a9521a4a6bf830700b21992e3802ba315af5f5a8bdf85fd5582f0def43fba54", "bytes": 1924, "kind": "publisher-documentation-example", "source_url": "https://docs.zeek.org/en/current/logs/ssh.html", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "2a624fc69a040778e0a42447eaba97ddaf29cf68b885fb196610f5de4b941195", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "uid" ] }, "reviewed_on": "2026-11-10" }, { "id": "zeek-smtp", "title": "Zeek SMTP JSON", "group": "Network sensors", "system": "Zeek", "format": "json", "description": "Zeek protocol analysis produces structured metadata from observed network traffic.", "location": "Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.", "collection": "Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.", "uses": [ "Review mail transaction metadata and related extracted files.", "Join uid across connection and protocol logs; use fuid for file references when present." ], "limitations": "Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.", "field_notes": { "ts": "Epoch timestamp of the logged activity.", "uid": "Connection identifier, when present; retain sensor context.", "fuid": "File identifier, when present.", "id.orig_h / id.resp_h": "Originator and responder addresses, not necessarily client intent." }, "tags": [ "zeek", "json", "network", "sensor", "smtp" ], "references": [ { "title": "smtp.log — Book of Zeek (9.0.1)", "url": "https://docs.zeek.org/en/current/logs/smtp.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/zeek-smtp.json", "sha256": "d0e780ed7c89cbc8c910fee3c7dcbddf2b4b836d0013f0a84324afd9de3f4903", "bytes": 772, "kind": "publisher-documentation-example", "source_url": "https://docs.zeek.org/en/current/logs/smtp.html", "locator": "preformatted example 2", "source_commit": null, "source_sha256": "2471ffd8f669d7f70c25bfc82394d9fb7014cdbd2745d9a7bdb817cb9e2b581c", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "uid" ] }, "reviewed_on": "2026-11-10" }, { "id": "suricata-alert", "title": "Suricata EVE alert", "group": "Network sensors", "system": "Suricata", "format": "json", "description": "EVE JSON emits typed records from the Suricata network engine.", "location": "Configured eve-log output, commonly eve.json.", "collection": "Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.", "uses": [ "Correlate flow_id and event_type with related protocol and alert records.", "For alerts, review signature, action and packet context before assigning a verdict." ], "limitations": "An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.", "field_notes": { "event_type": "Selects the payload schema.", "flow_id": "Flow correlation identifier; preserve numeric precision.", "timestamp": "Event time with offset.", "alert": "Rule-match context when present." }, "tags": [ "suricata", "json", "network", "ids", "alert" ], "references": [ { "title": "15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation", "url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/suricata-alert.json", "sha256": "26eb8c360e9a53fd6fd3b8e2d559f98953b1cf44263bc552375809297c4e95c0", "bytes": 606, "kind": "publisher-documentation-example", "source_url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "faaf422e6c92a02e8e5d23a57bcb792a0831a05fbbbbb7b2898b0489ba59dc05", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "event_type" ], "values": { "event_type": "alert" } }, "reviewed_on": "2026-11-10" }, { "id": "suricata-fileinfo", "title": "Suricata EVE fileinfo", "group": "Network sensors", "system": "Suricata", "format": "json", "description": "EVE JSON emits typed records from the Suricata network engine.", "location": "Configured eve-log output, commonly eve.json.", "collection": "Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.", "uses": [ "Correlate flow_id and event_type with related protocol and alert records.", "For alerts, review signature, action and packet context before assigning a verdict." ], "limitations": "An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.", "field_notes": { "event_type": "Selects the payload schema.", "flow_id": "Flow correlation identifier; preserve numeric precision.", "timestamp": "Event time with offset.", "alert": "Rule-match context when present." }, "tags": [ "suricata", "json", "network", "ids", "fileinfo" ], "references": [ { "title": "15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation", "url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/suricata-fileinfo.json", "sha256": "9675224247e29577dbe631b176f0fda9bd8fc119df83822d515ee8add2f2359b", "bytes": 749, "kind": "publisher-documentation-example", "source_url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html", "locator": "preformatted example 5", "source_commit": null, "source_sha256": "faaf422e6c92a02e8e5d23a57bcb792a0831a05fbbbbb7b2898b0489ba59dc05", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "event_type" ], "values": { "event_type": "fileinfo" } }, "reviewed_on": "2026-11-10" }, { "id": "suricata-http", "title": "Suricata EVE http", "group": "Network sensors", "system": "Suricata", "format": "json", "description": "EVE JSON emits typed records from the Suricata network engine.", "location": "Configured eve-log output, commonly eve.json.", "collection": "Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.", "uses": [ "Correlate flow_id and event_type with related protocol and alert records.", "For alerts, review signature, action and packet context before assigning a verdict." ], "limitations": "An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.", "field_notes": { "event_type": "Selects the payload schema.", "flow_id": "Flow correlation identifier; preserve numeric precision.", "timestamp": "Event time with offset.", "alert": "Rule-match context when present." }, "tags": [ "suricata", "json", "network", "ids", "http" ], "references": [ { "title": "15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation", "url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/suricata-http.json", "sha256": "ffdf665d9bd96d8db5e5a6913f962cae361c2c97741e9719bb301f124dbe8a75", "bytes": 1597, "kind": "publisher-documentation-example", "source_url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html", "locator": "preformatted example 6", "source_commit": null, "source_sha256": "faaf422e6c92a02e8e5d23a57bcb792a0831a05fbbbbb7b2898b0489ba59dc05", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "event_type" ], "values": { "event_type": "http" } }, "reviewed_on": "2026-11-10" }, { "id": "suricata-anomaly", "title": "Suricata EVE anomaly", "group": "Network sensors", "system": "Suricata", "format": "json", "description": "EVE JSON emits typed records from the Suricata network engine.", "location": "Configured eve-log output, commonly eve.json.", "collection": "Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.", "uses": [ "Correlate flow_id and event_type with related protocol and alert records.", "For alerts, review signature, action and packet context before assigning a verdict." ], "limitations": "An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.", "field_notes": { "event_type": "Selects the payload schema.", "flow_id": "Flow correlation identifier; preserve numeric precision.", "timestamp": "Event time with offset.", "alert": "Rule-match context when present." }, "tags": [ "suricata", "json", "network", "ids", "anomaly" ], "references": [ { "title": "15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation", "url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/suricata-anomaly.json", "sha256": "9120cc636c0ffbc3f27936e578c743d60f5f432a43435931acd16a1c099d9bca", "bytes": 533, "kind": "publisher-documentation-example", "source_url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html", "locator": "preformatted example 7", "source_commit": null, "source_sha256": "faaf422e6c92a02e8e5d23a57bcb792a0831a05fbbbbb7b2898b0489ba59dc05", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "event_type" ], "values": { "event_type": "anomaly" } }, "reviewed_on": "2026-11-10" }, { "id": "suricata-flow", "title": "Suricata EVE flow", "group": "Network sensors", "system": "Suricata", "format": "json", "description": "EVE JSON emits typed records from the Suricata network engine.", "location": "Configured eve-log output, commonly eve.json.", "collection": "Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.", "uses": [ "Correlate flow_id and event_type with related protocol and alert records.", "For alerts, review signature, action and packet context before assigning a verdict." ], "limitations": "An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.", "field_notes": { "event_type": "Selects the payload schema.", "flow_id": "Flow correlation identifier; preserve numeric precision.", "timestamp": "Event time with offset.", "alert": "Rule-match context when present." }, "tags": [ "suricata", "json", "network", "ids", "flow" ], "references": [ { "title": "15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation", "url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/suricata-flow.json", "sha256": "199a75828515b96ba46ab0047e820a88071e813d96cc029e56e2cca7f82fdc5c", "bytes": 1028, "kind": "publisher-documentation-example", "source_url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html", "locator": "preformatted example 8", "source_commit": null, "source_sha256": "faaf422e6c92a02e8e5d23a57bcb792a0831a05fbbbbb7b2898b0489ba59dc05", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "event_type" ], "values": { "event_type": "flow" } }, "reviewed_on": "2026-11-10" }, { "id": "suricata-mqtt", "title": "Suricata EVE mqtt", "group": "Network sensors", "system": "Suricata", "format": "json", "description": "EVE JSON emits typed records from the Suricata network engine.", "location": "Configured eve-log output, commonly eve.json.", "collection": "Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.", "uses": [ "Correlate flow_id and event_type with related protocol and alert records.", "For alerts, review signature, action and packet context before assigning a verdict." ], "limitations": "An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.", "field_notes": { "event_type": "Selects the payload schema.", "flow_id": "Flow correlation identifier; preserve numeric precision.", "timestamp": "Event time with offset.", "alert": "Rule-match context when present." }, "tags": [ "suricata", "json", "network", "ids", "mqtt" ], "references": [ { "title": "15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation", "url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/suricata-mqtt.json", "sha256": "db0bbe2f46266df5677adb2f0fe505f7082b1426aa3afddf6bd8b1db72d138ba", "bytes": 791, "kind": "publisher-documentation-example", "source_url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html", "locator": "preformatted example 63", "source_commit": null, "source_sha256": "faaf422e6c92a02e8e5d23a57bcb792a0831a05fbbbbb7b2898b0489ba59dc05", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "event_type" ], "values": { "event_type": "mqtt" } }, "reviewed_on": "2026-11-10" }, { "id": "suricata-pgsql", "title": "Suricata EVE pgsql", "group": "Network sensors", "system": "Suricata", "format": "json", "description": "EVE JSON emits typed records from the Suricata network engine.", "location": "Configured eve-log output, commonly eve.json.", "collection": "Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.", "uses": [ "Correlate flow_id and event_type with related protocol and alert records.", "For alerts, review signature, action and packet context before assigning a verdict." ], "limitations": "An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.", "field_notes": { "event_type": "Selects the payload schema.", "flow_id": "Flow correlation identifier; preserve numeric precision.", "timestamp": "Event time with offset.", "alert": "Rule-match context when present." }, "tags": [ "suricata", "json", "network", "ids", "pgsql" ], "references": [ { "title": "15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation", "url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/suricata-pgsql.json", "sha256": "78aceb48bb95c3fbe3eb0cf4fdcc72223b5c8d3db885fe0d6b7443a2c12e1135", "bytes": 496, "kind": "publisher-documentation-example", "source_url": "https://docs.suricata.io/en/latest/output/eve/eve-json-format.html", "locator": "preformatted example 77", "source_commit": null, "source_sha256": "faaf422e6c92a02e8e5d23a57bcb792a0831a05fbbbbb7b2898b0489ba59dc05", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "event_type" ], "values": { "event_type": "pgsql" } }, "reviewed_on": "2026-11-10" }, { "id": "aws-cloudtrail", "title": "AWS CloudTrail", "group": "Cloud platforms", "system": "AWS", "format": "json", "description": "CloudTrail log-file envelope containing API activity records.", "location": "Configured trail delivery or event data store; event history is not a substitute for every data-event category.", "collection": "Enable required management/data event categories and verify account/region coverage.", "uses": [ "Review userIdentity, eventName, resources and errors; correlate requestID and session context.", "Retain resource, account/project/subscription and region context for correlation." ], "limitations": "Delivery can duplicate records; eventVersion and optional fields vary. A successful API call does not prove later resource behavior.", "field_notes": { "Records": "Native field; inspect its exact type and nesting in the complete example below.", "eventVersion": "Native field; inspect its exact type and nesting in the complete example below.", "userIdentity": "Native field; inspect its exact type and nesting in the complete example below.", "eventName": "Native field; inspect its exact type and nesting in the complete example below.", "eventTime": "Native field; inspect its exact type and nesting in the complete example below." }, "tags": [ "aws", "json", "cloud", "audit" ], "references": [ { "title": "CloudTrail log file examples - AWS CloudTrail", "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-examples.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/aws-cloudtrail.json", "sha256": "909894e5ef0e45804331a23c050431b077049eded8d8bba42bf2225f1b385d4f", "bytes": 2615, "kind": "publisher-documentation-example", "source_url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-examples.html", "locator": "preformatted example 3", "source_commit": null, "source_sha256": "5426ad89a5267103b93a7464300fd64f9de8a74ce17c7f6eb27cee55b90bb1f1", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "Records" ] }, "reviewed_on": "2026-11-10" }, { "id": "aws-waf", "title": "AWS WAF", "group": "Cloud platforms", "system": "AWS", "format": "json", "description": "Web ACL request evaluation records.", "location": "Configured WAF log destination.", "collection": "Enable logging with suitable redaction, filtering and destination permissions.", "uses": [ "Investigate terminating rules and action with httpRequest context.", "Retain resource, account/project/subscription and region context for correlation." ], "limitations": "ALLOW/BLOCK is a WAF decision, not an application response or exploitation verdict.", "field_notes": { "action": "Native field; inspect its exact type and nesting in the complete example below.", "httpRequest": "Native field; inspect its exact type and nesting in the complete example below.", "webaclId": "Native field; inspect its exact type and nesting in the complete example below.", "timestamp": "Native field; inspect its exact type and nesting in the complete example below." }, "tags": [ "aws", "json", "cloud", "audit" ], "references": [ { "title": "Log fields for protection pack (web ACL) traffic - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director", "url": "https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/aws-waf.json", "sha256": "0ce3dfa3d85c9dcff9ff34df000942f19c7d53865a950ecd5d250980bd899f56", "bytes": 826, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/aws/data_stream/waf/_dev/test/pipeline/test-waf.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "8852f05a2e00c1e03ed698e5a292dc13c03cb7464e7408cd3eb8c6065ce9dbf4", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "timestamp", "formatVersion", "webaclId", "terminatingRuleId", "terminatingRuleType", "action", "terminatingRuleMatchDetails", "httpSourceName", "httpSourceId", "ruleGroupList", "rateBasedRuleList", "nonTerminatingMatchingRules", "httpRequest", "labels" ] }, "reviewed_on": "2026-11-10" }, { "id": "aws-api-gateway", "title": "AWS API Gateway — configured access JSON", "group": "Cloud platforms", "system": "AWS", "format": "json", "description": "Access log object generated by a configured context-variable template.", "location": "API Gateway stage access log destination.", "collection": "Preserve the exact access log template and stage configuration.", "uses": [ "Correlate requestId, method, route, status and latency with backend evidence.", "Retain resource, account/project/subscription and region context for correlation." ], "limitations": "There is no single universal access-log JSON schema; this fixture represents one selected template.", "field_notes": { "requestId": "Native field; inspect its exact type and nesting in the complete example below.", "httpMethod": "Native field; inspect its exact type and nesting in the complete example below.", "routeKey": "Native field; inspect its exact type and nesting in the complete example below.", "status": "Native field; inspect its exact type and nesting in the complete example below." }, "tags": [ "aws", "json", "cloud", "audit" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/aws-api-gateway.json", "sha256": "f25f2373d2cfa77d1389225c7c46de1718397af7814fa5754ee93db8952d44c4", "bytes": 193, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-http.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "d4a7a30ec23c05e6ac4f866ef5e1734d243a77ef02db17e6f857af25d7696e4e", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "requestId", "ip", "requestTime", "httpMethod", "routeKey", "status", "protocol", "responseLength" ] }, "reviewed_on": "2026-11-10" }, { "id": "azure-activity", "title": "Azure Activity Log", "group": "Cloud platforms", "system": "Azure", "format": "json", "description": "Azure control-plane activity exported as structured events.", "location": "Activity Log / configured diagnostic destination.", "collection": "Select subscriptions and export categories; record destination-specific envelopes.", "uses": [ "Review operationName, caller, status and correlationId for administrative changes.", "Retain resource, account/project/subscription and region context for correlation." ], "limitations": "Control-plane activity is different from resource data-plane access; export representations vary.", "field_notes": { "category": "Native field; inspect its exact type and nesting in the complete example below.", "operationName": "Native field; inspect its exact type and nesting in the complete example below.", "correlationId": "Native field; inspect its exact type and nesting in the complete example below." }, "tags": [ "azure", "json", "cloud", "audit" ], "references": [ { "title": "Azure Activity Log event schema - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/azure-activity.json", "sha256": "f8df819b342ef50baf0a73994fd7e2a139063b3c7b6137ea42db18260e424094", "bytes": 4018, "kind": "publisher-documentation-example", "source_url": "https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "7608a59ede44e566c30abba872140ef042bfd48ae1599422c1a330e04cd3b85f", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "authorization", "caller", "channels", "claims", "correlationId", "eventDataId", "eventName", "category", "eventTimestamp", "id", "level", "operationId", "operationName", "resourceGroupName", "resourceProviderName", "resourceType", "resourceId", "status", "subStatus", "submissionTimestamp", "subscriptionId", "properties", "relatedEvents" ] }, "reviewed_on": "2026-11-10" }, { "id": "gcp-audit", "title": "Google Cloud Audit Logs", "group": "Cloud platforms", "system": "Google Cloud", "format": "json", "description": "Cloud Logging LogEntry carrying an AuditLog protoPayload.", "location": "Cloud Logging audit log streams and configured sinks.", "collection": "Check Admin Activity, Data Access and applicable audit policy; verify sink exclusions.", "uses": [ "Review principal, method, service, resource and authorization information.", "Retain resource, account/project/subscription and region context for correlation." ], "limitations": "Data Access availability depends on service and configuration; absent logs cannot establish absence of access.", "field_notes": { "protoPayload": "Native field; inspect its exact type and nesting in the complete example below.", "resource": "Native field; inspect its exact type and nesting in the complete example below.", "logName": "Native field; inspect its exact type and nesting in the complete example below.", "timestamp": "Native field; inspect its exact type and nesting in the complete example below." }, "tags": [ "google-cloud", "json", "cloud", "audit" ], "references": [ { "title": "Understanding audit logs  |  Cloud Logging  |  Google Cloud Documentation", "url": "https://cloud.google.com/logging/docs/audit/understanding-audit-logs" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/gcp-audit.json", "sha256": "2e20b3fa812efabb6a01ec525e42eb28d6bfd9d2edab6adae7aa680323dbcced", "bytes": 945, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/gcp/data_stream/audit/_dev/test/pipeline/test-audit.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "3f16912f5cf63d15773182d8dd309f6f45ad6640b0f7fcab955e137ff776c28e", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "insertId", "logName", "protoPayload", "receiveTimestamp", "resource", "severity", "timestamp" ] }, "reviewed_on": "2026-11-10" }, { "id": "gcp-vpc-flow", "title": "Google Cloud VPC Flow Logs", "group": "Cloud platforms", "system": "Google Cloud", "format": "json", "description": "Sampled network flow records within a Cloud Logging LogEntry.", "location": "Enabled subnet/network flow logging and Cloud Logging sinks.", "collection": "Record aggregation interval, sampling, metadata and filtering settings.", "uses": [ "Compare connection tuples, byte estimates and resource metadata with host evidence.", "Retain resource, account/project/subscription and region context for correlation." ], "limitations": "Sampling and aggregation prevent treating one record as a packet capture or complete traffic history.", "field_notes": { "jsonPayload": "Native field; inspect its exact type and nesting in the complete example below.", "resource": "Native field; inspect its exact type and nesting in the complete example below.", "timestamp": "Native field; inspect its exact type and nesting in the complete example below." }, "tags": [ "google-cloud", "json", "cloud", "audit" ], "references": [], "telemetry_components": [], "sample": { "path": "/log-sources/samples/gcp-vpc-flow.json", "sha256": "0d30d698e4c96da4d2f68d6092a80995920e1943e6f2423a69ddedaf57a39b82", "bytes": 934, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/gcp/data_stream/vpcflow/_dev/test/pipeline/test-vpcflow.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "eb5ed372fdb2bfbb540e7e6bdbcd144e328ba8f016dd86f78a5796057c9fe8e6", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "insertId", "jsonPayload", "logName", "receiveTimestamp", "resource", "timestamp" ] }, "reviewed_on": "2026-11-10" }, { "id": "entra-service-principal-signin", "title": "Microsoft Entra service-principal sign-ins", "group": "Identity and SaaS", "system": "Microsoft", "format": "json", "description": "Diagnostic export of service-principal authentication activity.", "location": "Product audit API or configured diagnostic export.", "collection": "Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.", "uses": [ "Review application identity, resource, IP and result with credential changes.", "Compare actor and target context with approved changes and other authentication evidence." ], "limitations": "This category is not interactive user sign-in; result fields and export envelopes differ.", "field_notes": { "Event identity": "Use the source event ID and tenant scope to deduplicate.", "Event type": "Select the schema for this category/action.", "Timestamp": "Retain both event and ingestion time where available." }, "tags": [ "microsoft", "json", "identity", "saas", "audit" ], "references": [ { "title": "Learn about the monitoring and health activity log schemas - Microsoft Entra ID | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-azure-monitor-sign-ins-log-schema" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/entra-service-principal-signin.json", "sha256": "570e7ee54145cdd28b82796681d3c42c5cbe14c6be7878c6efa6b732593e91a3", "bytes": 3030, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/azure/data_stream/signinlogs/_dev/test/pipeline/test-alternative-time-and-duration-as-string.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "570e7ee54145cdd28b82796681d3c42c5cbe14c6be7878c6efa6b732593e91a3", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "callerIpAddress", "category", "correlationId", "durationMs", "level", "location", "operationName", "operationVersion", "properties", "resourceId", "resultSignature", "resultType", "tenantId", "time" ] }, "reviewed_on": "2026-11-10" }, { "id": "entra-audit", "title": "Microsoft Entra directory audit", "group": "Identity and SaaS", "system": "Microsoft", "format": "json", "description": "Directory audit events exported through Azure diagnostics.", "location": "Product audit API or configured diagnostic export.", "collection": "Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.", "uses": [ "Review initiator, target resources and modified properties.", "Compare actor and target context with approved changes and other authentication evidence." ], "limitations": "An audit operation and a successful authentication are different event classes.", "field_notes": { "Event identity": "Use the source event ID and tenant scope to deduplicate.", "Event type": "Select the schema for this category/action.", "Timestamp": "Retain both event and ingestion time where available." }, "tags": [ "microsoft", "json", "identity", "saas", "audit" ], "references": [ { "title": "Learn about the monitoring and health activity log schemas - Microsoft Entra ID | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-azure-monitor-sign-ins-log-schema" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/entra-audit.json", "sha256": "12b07c8ac149412a1c5f5d71e0a3c771e3536fec11e1d079f0b78c9ea5a3463e", "bytes": 1562, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/azure/data_stream/auditlogs/_dev/test/pipeline/test-audit-logs-duration-as-string.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "61e92bc938bc1d79c91d253a1d3063eaf3b1022dbacb1c89cf6cfeccf70b0cff", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "time", "resourceId", "operationName", "operationVersion", "category", "tenantId", "resultSignature", "durationMs", "callerIpAddress", "correlationId", "identity", "Level", "properties" ] }, "reviewed_on": "2026-11-10" }, { "id": "okta-system-log", "title": "Okta System Log", "group": "Identity and SaaS", "system": "Okta", "format": "json", "description": "Identity platform events with actor, client, outcome and target context.", "location": "Product audit API or configured diagnostic export.", "collection": "Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.", "uses": [ "Correlate eventType, transaction, session and outcome across authentication flows.", "Compare actor and target context with approved changes and other authentication evidence." ], "limitations": "An event display message alone is insufficient; inspect structured outcome and context.", "field_notes": { "Event identity": "Use the source event ID and tenant scope to deduplicate.", "Event type": "Select the schema for this category/action.", "Timestamp": "Retain both event and ingestion time where available." }, "tags": [ "okta", "json", "identity", "saas", "audit" ], "references": [ { "title": "System Log", "url": "https://developer.okta.com/docs/reference/api/system-log/" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/okta-system-log.json", "sha256": "06431c40f5d27d24e021d1c59eddbd580903eee94c2468adb7728a8adc46838e", "bytes": 1661, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/okta/data_stream/system/_dev/test/pipeline/test-okta-system-events.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "7b1c85a7edf01da21d7c3309eed49ccd476686f7d12fe0a53b341a40e9dadf9c", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "actor", "authenticationContext", "client", "debugContext", "displayMessage", "eventType", "legacyEventType", "outcome", "published", "request", "securityContext", "severity", "target", "transaction", "uuid", "version" ] }, "reviewed_on": "2026-11-10" }, { "id": "google-workspace-login", "title": "Google Workspace login audit", "group": "Identity and SaaS", "system": "Google", "format": "json", "description": "Admin SDK Reports API login activity.", "location": "Product audit API or configured diagnostic export.", "collection": "Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.", "uses": [ "Inspect event names and typed parameters with actor and source IP.", "Compare actor and target context with approved changes and other authentication evidence." ], "limitations": "A single Activity may contain multiple events and typed parameters.", "field_notes": { "Event identity": "Use the source event ID and tenant scope to deduplicate.", "Event type": "Select the schema for this category/action.", "Timestamp": "Retain both event and ingestion time where available." }, "tags": [ "google", "json", "identity", "saas", "audit" ], "references": [ { "title": "Reports API: Login Activity Report  |  Admin console  |  Google for Developers", "url": "https://developers.google.com/workspace/admin/reports/v1/guides/manage-audit-login" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/google-workspace-login.json", "sha256": "2651d5ec483ba038f8b32efdaadbad62d9dfe02154d215afee462b49571323e0", "bytes": 405, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/google_workspace/data_stream/login/_dev/test/pipeline/test-login.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e3be94e22cd927fce1b61555f5f781944a663a63f84ce1c0cca1ba0344b92edb", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "kind", "id", "actor", "ownerDomain", "ipAddress", "events" ] }, "reviewed_on": "2026-11-10" }, { "id": "google-workspace-admin", "title": "Google Workspace administrator audit", "group": "Identity and SaaS", "system": "Google", "format": "json", "description": "Admin SDK Reports API administrative activity.", "location": "Product audit API or configured diagnostic export.", "collection": "Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.", "uses": [ "Review actor, action parameters and affected configuration.", "Compare actor and target context with approved changes and other authentication evidence." ], "limitations": "Administrative activity does not include every application data-plane operation.", "field_notes": { "Event identity": "Use the source event ID and tenant scope to deduplicate.", "Event type": "Select the schema for this category/action.", "Timestamp": "Retain both event and ingestion time where available." }, "tags": [ "google", "json", "identity", "saas", "audit" ], "references": [ { "title": "Reports API: Login Activity Report  |  Admin console  |  Google for Developers", "url": "https://developers.google.com/workspace/admin/reports/v1/guides/manage-audit-login" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/google-workspace-admin.json", "sha256": "8bd00a0bc6c5bf217d53d47428e3a8a390eb3b848fa99dade85290680c2a345e", "bytes": 640, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-application.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "ed32c7aa90a0f5ae3c4d353fb1e956c889b856078e7a5bef4616faa42907b414", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "kind", "id", "actor", "ownerDomain", "ipAddress", "events" ] }, "reviewed_on": "2026-11-10" }, { "id": "github-audit", "title": "GitHub audit log", "group": "Identity and SaaS", "system": "GitHub", "format": "json", "description": "Organization or enterprise audit event export.", "location": "Product audit API or configured diagnostic export.", "collection": "Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.", "uses": [ "Review action, actor, token context and organization scope.", "Compare actor and target context with approved changes and other authentication evidence." ], "limitations": "Availability and retention depend on product and export; field sets vary by action.", "field_notes": { "Event identity": "Use the source event ID and tenant scope to deduplicate.", "Event type": "Select the schema for this category/action.", "Timestamp": "Retain both event and ingestion time where available." }, "tags": [ "github", "json", "identity", "saas", "audit" ], "references": [ { "title": "Reviewing the audit log for your organization - GitHub Enterprise Cloud Docs", "url": "https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/github-audit.json", "sha256": "5a2c8c7dba45fc665bf5233a50bad84800b74b9d48c0f57233d4d66efc43e86a", "bytes": 549, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/github/data_stream/audit/_dev/test/pipeline/test-api-request-events.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "357e20c6724b3736ea6628d24932c76abe534d63418cc42379a32b7c247db710", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "@timestamp", "_document_id", "action", "actor", "actor_id", "actor_is_bot", "actor_location", "business", "business_id", "created_at", "hashed_token", "org", "org_id", "request_category", "request_method", "route", "status_code", "token_id", "token_scopes", "user_agent" ] }, "reviewed_on": "2026-11-10" }, { "id": "m365-exchange", "title": "Microsoft 365 Exchange audit", "group": "Identity and SaaS", "system": "Microsoft 365", "format": "json", "description": "Unified audit record for the named Microsoft 365 workload.", "location": "Microsoft 365 audit export / Management Activity API.", "collection": "Verify workload auditing, licensing, permissions, subscriptions and retention.", "uses": [ "Review Operation, UserId, workload and affected objects.", "Correlate session and object identifiers with identity and endpoint records." ], "limitations": "Fields vary by workload and RecordType; audit ingestion can be delayed.", "field_notes": { "Operation": "Workload-specific activity.", "RecordType": "Selects the workload record schema.", "CreationTime": "Source activity time.", "UserId": "Actor identity as recorded by the service." }, "tags": [ "microsoft-365", "json", "saas", "audit" ], "references": [ { "title": "Office 365 Management Activity API schema | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/m365-exchange.json", "sha256": "1ecfb3b9b059ff4503f42f0921a9e958f3fe385e356dde20bfe7b2340c8e2e2a", "bytes": 942, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-admin-events.json", "locator": "events[0].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "91da5546e1325aadc81e4ea8f2d9ec6b2742c1a4a8b82cc6d1d7f0c5ee1ac330", "transformation": "Decoded event.original string; collector envelope removed; native JSON values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "AppId", "ClientAppId", "CreationTime", "ExternalAccess", "Id", "ObjectId", "Operation", "OrganizationId", "OrganizationName", "OriginatingServer", "Parameters", "RecordType", "ResultStatus", "UserId", "UserKey", "UserType", "Version", "Workload" ] }, "reviewed_on": "2026-11-10" }, { "id": "m365-sharepoint", "title": "Microsoft 365 SharePoint audit", "group": "Identity and SaaS", "system": "Microsoft 365", "format": "json", "description": "Unified audit record for the named Microsoft 365 workload.", "location": "Microsoft 365 audit export / Management Activity API.", "collection": "Verify workload auditing, licensing, permissions, subscriptions and retention.", "uses": [ "Review Operation, UserId, workload and affected objects.", "Correlate session and object identifiers with identity and endpoint records." ], "limitations": "Fields vary by workload and RecordType; audit ingestion can be delayed.", "field_notes": { "Operation": "Workload-specific activity.", "RecordType": "Selects the workload record schema.", "CreationTime": "Source activity time.", "UserId": "Actor identity as recorded by the service." }, "tags": [ "microsoft-365", "json", "saas", "audit" ], "references": [ { "title": "Office 365 Management Activity API schema | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/m365-sharepoint.json", "sha256": "f966a28fcb04039476b45360cc948cbe63d83776e5dd35c10e8564dddde0dde7", "bytes": 1088, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepointfileop-events.json", "locator": "events[0].event.original", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "bab4267a93102f5fdc730a6682c9a54c0291a36c3c68ed2840f4df2a6b6625ff", "transformation": "Decoded event.original string; collector envelope removed; native JSON values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "ClientIP", "CorrelationId", "CreationTime", "EventSource", "Id", "ItemType", "ListId", "ListItemUniqueId", "ObjectId", "Operation", "OrganizationId", "RecordType", "Site", "SiteUrl", "SourceFileExtension", "SourceFileName", "SourceRelativeUrl", "UserAgent", "UserId", "UserKey", "UserType", "Version", "WebId", "Workload" ] }, "reviewed_on": "2026-11-10" }, { "id": "nginx-access", "title": "NGINX combined access log", "group": "Web and databases", "system": "NGINX", "format": "text", "description": "HTTP requests in the configured combined format.", "location": "Configured service log destination; commonly under /var/log or the service data directory.", "collection": "Record the exact log format directive, rotation policy, time zone and service version.", "uses": [ "Compare URI, status, bytes, referer and user agent with upstream application logs.", "Preserve quoting, escaping and complete multiline records when applicable." ], "limitations": "A proxy address may replace the original client; forwarded headers require an explicit trusted-proxy policy.", "field_notes": { "Timestamp": "May omit year or time zone depending on configuration.", "Message": "Parse according to the exact service format, preserving quoted request fields." }, "tags": [ "nginx", "text", "server", "application" ], "references": [ { "title": "Module ngx_http_log_module", "url": "https://nginx.org/en/docs/http/ngx_http_log_module.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/nginx-access.log", "sha256": "603d747e6cbae640a79457d7d60fe848446f42dd68f1cfbd5c68cb11c52bf4da", "bytes": 198, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/nginx/data_stream/access/_dev/test/pipeline/test-access.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "816a60d2906b043ce188b3062a68495c8851156da1af3e8f77e3254d7f7816d3", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "nginx-error", "title": "NGINX error log", "group": "Web and databases", "system": "NGINX", "format": "text", "description": "NGINX error and diagnostic messages.", "location": "Configured service log destination; commonly under /var/log or the service data directory.", "collection": "Record the exact log format directive, rotation policy, time zone and service version.", "uses": [ "Correlate request context, worker/process and upstream failures.", "Preserve quoting, escaping and complete multiline records when applicable." ], "limitations": "Error format and verbosity differ from access logs; missing errors do not prove success.", "field_notes": { "Timestamp": "May omit year or time zone depending on configuration.", "Message": "Parse according to the exact service format, preserving quoted request fields." }, "tags": [ "nginx", "text", "server", "application" ], "references": [ { "title": "Module ngx_http_log_module", "url": "https://nginx.org/en/docs/http/ngx_http_log_module.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/nginx-error.log", "sha256": "57687bca1d7258d67917326a7c1a3b37bc743550ac4df015645d56fe082b7eac", "bytes": 273, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/nginx/data_stream/error/_dev/test/pipeline/test-error-raw.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "5b07dea7669a7dd3cc674087b8b17c0233130ddfd9c1fa780a8897efc54c834e", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "apache-access", "title": "Apache HTTP Server common access log", "group": "Web and databases", "system": "Apache", "format": "text", "description": "HTTP requests serialized using the Common Log Format.", "location": "Configured service log destination; commonly under /var/log or the service data directory.", "collection": "Record the exact log format directive, rotation policy, time zone and service version.", "uses": [ "Review client, request, response status and bytes.", "Preserve quoting, escaping and complete multiline records when applicable." ], "limitations": "Custom LogFormat directives change the schema; status does not establish application security outcome.", "field_notes": { "Timestamp": "May omit year or time zone depending on configuration.", "Message": "Parse according to the exact service format, preserving quoted request fields." }, "tags": [ "apache", "text", "server", "application" ], "references": [ { "title": "Log Files - Apache HTTP Server Version 2.4", "url": "https://httpd.apache.org/docs/2.4/logs.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/apache-access.log", "sha256": "b6d2fc79528540c5a42ac69a58a1ff09764bdba067b279f2b72898bd0b98caf8", "bytes": 73, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/apache/data_stream/access/_dev/test/pipeline/test-access-basic.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "33e45762ff6d16bd2fcb4beda425f36d2ddf775e1c7402de094e0f13d525807f", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "apache-error", "title": "Apache HTTP Server error log", "group": "Web and databases", "system": "Apache", "format": "text", "description": "Apache diagnostic/error output.", "location": "Configured service log destination; commonly under /var/log or the service data directory.", "collection": "Record the exact log format directive, rotation policy, time zone and service version.", "uses": [ "Correlate module, severity and process context with request records.", "Preserve quoting, escaping and complete multiline records when applicable." ], "limitations": "ErrorLogFormat and server versions change the layout.", "field_notes": { "Timestamp": "May omit year or time zone depending on configuration.", "Message": "Parse according to the exact service format, preserving quoted request fields." }, "tags": [ "apache", "text", "server", "application" ], "references": [ { "title": "Log Files - Apache HTTP Server Version 2.4", "url": "https://httpd.apache.org/docs/2.4/logs.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/apache-error.log", "sha256": "d921355414120238c5ca5cd0fa22d43e4b2f0e18aca78ff5a493647dc1960dc2", "bytes": 130, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/apache/data_stream/error/_dev/test/pipeline/test-error-basic.log", "locator": "line 2", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "08c11982ad643f8bd9e88731c292e32e808b9a3a5751bde19b1db8de4b503421", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "postgres-log", "title": "PostgreSQL server text log", "group": "Web and databases", "system": "PostgreSQL", "format": "text", "description": "Database server diagnostic text including authentication errors.", "location": "Configured service log destination; commonly under /var/log or the service data directory.", "collection": "Record the exact log format directive, rotation policy, time zone and service version.", "uses": [ "Investigate failed authentication alongside connection and database audit evidence.", "Preserve quoting, escaping and complete multiline records when applicable." ], "limitations": "log_line_prefix is configurable; server error logs are not a complete SQL audit trail.", "field_notes": { "Timestamp": "May omit year or time zone depending on configuration.", "Message": "Parse according to the exact service format, preserving quoted request fields." }, "tags": [ "postgresql", "text", "server", "application" ], "references": [ { "title": "PostgreSQL: Documentation: 18: 19.8. Error Reporting and Logging", "url": "https://www.postgresql.org/docs/current/runtime-config-logging.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/postgres-log.log", "sha256": "894da953f9df68cee0fe8dbf1e6373d324bea070d10b89d5e6cb8b8d78d0d955", "bytes": 92, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/postgresql/data_stream/log/_dev/test/pipeline/test-postgresql-10-default.log", "locator": "line 3", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "ae753d55780e5194a19da33eb6cd293d09fe0c538eb315b774e44b0b77fb3b55", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "mysql-error", "title": "MySQL server error log", "group": "Web and databases", "system": "MySQL", "format": "text", "description": "MySQL server diagnostic text from an upstream test fixture.", "location": "Configured service log destination; commonly under /var/log or the service data directory.", "collection": "Record the exact log format directive, rotation policy, time zone and service version.", "uses": [ "Review component severity and startup/security warnings in operational context.", "Preserve quoting, escaping and complete multiline records when applicable." ], "limitations": "This historical text format differs from newer JSON sinks; not every query or login is logged.", "field_notes": { "Timestamp": "May omit year or time zone depending on configuration.", "Message": "Parse according to the exact service format, preserving quoted request fields." }, "tags": [ "mysql", "text", "server", "application" ], "references": [ { "title": "MySQL :: MySQL 8.4 Reference Manual :: 7.4.2.9 Error Log Output Format", "url": "https://dev.mysql.com/doc/refman/8.4/en/error-log-format.html" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/mysql-error.log", "sha256": "33eda147ac8641a057a3fea067fd884a90148e9f805602f59c765fd694ece424", "bytes": 190, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/mysql/data_stream/error/_dev/test/pipeline/test-error.log", "locator": "line 2", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "e81213bac47ed198e92448c8f08043f09b273b332194bf122cbb1c69a0b68490", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "line_count": 1 }, "reviewed_on": "2026-11-10" }, { "id": "mongodb-structured", "title": "MongoDB structured server log", "group": "Web and databases", "system": "MongoDB", "format": "json", "description": "Structured MongoDB diagnostic log object.", "location": "Configured mongod/mongos diagnostic log destination.", "collection": "Record MongoDB version, verbosity and destination. Audit logging is a separate capability.", "uses": [ "Review component, severity, message ID and attributes.", "Correlate diagnostic events with authentication, query and audit records where available." ], "limitations": "This publisher example demonstrates serialization; a diagnostic log is not a complete database audit trail.", "field_notes": { "t": "Extended JSON timestamp object.", "s": "Severity code.", "c": "Component.", "id": "Message identifier.", "attr": "Message-specific structured attributes." }, "tags": [ "mongodb", "json", "database" ], "references": [ { "title": "MongoDB Log Messages - Database Manual - MongoDB Docs", "url": "https://www.mongodb.com/docs/manual/reference/log-messages/" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/mongodb-structured.json", "sha256": "c48e65cbf4fe58e9f35a258083827c171eca3ce47251815d7f7396ddec0f6fe7", "bytes": 167, "kind": "publisher-documentation-example", "source_url": "https://www.mongodb.com/docs/manual/reference/log-messages/", "locator": "preformatted example 1", "source_commit": null, "source_sha256": "792394d4ae22d3e3f1280477c02f68df4c13533794083a9adaf1d155ff8fcaff", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "t", "s", "c", "id", "ctx", "svc", "msg", "attr" ] }, "reviewed_on": "2026-11-10" }, { "id": "kubernetes-audit", "title": "Kubernetes API audit event", "group": "Containers and orchestration", "system": "Kubernetes", "format": "json", "description": "API-server audit Event describing a request stage.", "location": "kube-apiserver audit backend or managed-cluster export.", "collection": "Configure audit policy and backend; inspect level, stage, omitted stages and sensitive payload controls.", "uses": [ "Correlate auditID across stages and inspect verb, user, objectRef and responseStatus.", "Review privileged resource changes and unexpected service-account activity." ], "limitations": "RequestReceived does not prove completion; RequestResponse can expose secrets. Policy determines what is retained.", "field_notes": { "auditID": "Correlates stages for an API request.", "stage": "Request processing stage.", "level": "Audit detail selected by policy.", "user": "Authenticated user context.", "objectRef": "Target object when available." }, "tags": [ "kubernetes", "json", "container", "audit" ], "references": [ { "title": "Auditing | Kubernetes", "url": "https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/" }, { "title": "kube-apiserver Audit Configuration (v1) | Kubernetes", "url": "https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/kubernetes-audit.json", "sha256": "c8ee8d452e5a057a8b80795b29259cdf6f94d37d15908f9888c36caf0196a466", "bytes": 915, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/kubernetes/data_stream/audit_logs/_dev/test/pipeline/test-kube-audit.log", "locator": "line 1 properties.log", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "bf400acfc18bf47b943ce904077ad82f3f75920f37ea483a88d13998df29ce98", "transformation": "Decoded Azure envelope properties.log; native Kubernetes audit JSON preserved.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "kind", "apiVersion", "level", "auditID", "stage", "requestURI", "verb", "user", "sourceIPs", "userAgent", "objectRef", "responseStatus", "requestReceivedTimestamp", "stageTimestamp", "annotations" ] }, "reviewed_on": "2026-11-10" }, { "id": "falco-alert", "title": "Falco JSON alert", "group": "Containers and orchestration", "system": "Falco", "format": "json", "description": "Rule match output from Falco with structured output_fields.", "location": "Configured Falco JSON output destination.", "collection": "Enable JSON output and record engine, source, ruleset and driver configuration.", "uses": [ "Review rule, priority, source and output_fields with runtime context.", "Correlate process and container identifiers with orchestrator audit and workload inventory." ], "limitations": "A rule match is an investigative lead; sources and rule output fields vary.", "field_notes": { "rule": "Matched rule name.", "source": "Event source.", "priority": "Rule priority, not a confirmed incident verdict.", "output_fields": "Rule-selected event fields." }, "tags": [ "falco", "json", "container", "runtime", "alert" ], "references": [ { "title": "Falco Outputs | Falco", "url": "https://falco.org/docs/concepts/outputs/" } ], "telemetry_components": [], "sample": { "path": "/log-sources/samples/falco-alert.json", "sha256": "3c6a888c46eba7b4628bf9a7d77b70875c49679ae6ef2b8e9c4079af506dc8c1", "bytes": 1090, "kind": "upstream-test-fixture", "source_url": "https://raw.githubusercontent.com/elastic/integrations/9ae756f00f82786ac3496ce99c2dd288c5a5c031/packages/falco/data_stream/alerts/_dev/test/pipeline/test-falco.log", "locator": "line 1", "source_commit": "9ae756f00f82786ac3496ce99c2dd288c5a5c031", "source_sha256": "ba8dc7948b03eaad378ababd41f1d3d2a7e93cf0e14a4e957ebe3e4b3be7edb1", "transformation": "One complete record selected; values unchanged.", "capture_status": "Published example; no independent capture provenance claimed." }, "expected": { "keys": [ "hostname", "output", "priority", "rule", "source", "tags", "time", "output_fields" ] }, "reviewed_on": "2026-11-10" } ] }