Skip to content

Instantly share code, notes, and snippets.

@automine

automine/props.conf

Last active July 4, 2017 02:28
Show Gist options
  • Save automine/9e2b55b75a9055cd19f7072951896dae to your computer and use it in GitHub Desktop.
Save automine/9e2b55b75a9055cd19f7072951896dae to your computer and use it in GitHub Desktop.
Download ZIP
Raw
props.conf
[host::10.200.12.115]
TRANSFORMS-rewrite_windows_security = rewrite_windows_security
Raw
transforms.conf
[rewrite_windows_security]
REGEX = \s<\d+>\S+\s+\d+:\s+Microsoft-Windows-Security
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::WinEventLog:Security
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment