Someone should map publicly available EVTX samples to Sigma rules. This would enable us to automatically test the correctness of generated queries.

Known security-related EVTX repositories:

• https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
• https://github.com/Cyb3rWard0g/mordor

Feel free to extend the list.

Mapping should be:

Sigma rule -> Repository/EVTX ( -> expected matched

Currently auth02mozdef.py uses the Auth0 /api/v2/logs endpoint to fetch logs.

Auth0 has, since this was developed, released Auth0 LogStreams which uses AWS EventBridge.

Please switch

Event with ID = 7045 from System log has incorrect source in section "Software and Service Installation" of "Recommended Events to Collect" document.
Correct source for this event is "Service Control Manager":

• Provider
  [ Name] Service Control Manager
  [ Guid] {555908d1-a6d7-4695-8e1e-26931d2012f4}
  [ EventSourceName] Service Control Manager
• EventID 7045
  Also, I create

Is your feature request related to a problem? Please describe.

I have some issues around the "date" and "time" fields which come from syslog, either as pipe-delimited fields or as mapped JSON fields.

The fundamental question is: are these fields actually used for anything, apart from being included in alert messages? And does it matter if the format is not YYYY-MM-DD or HH:MM:SS?

**

Hi DSIEM people,

Not really an issue per-se, but I'm struggling to understand how you actually implement Intel Feeds for DSIEM.

From what I can gather, you are using Wise for Moloch to collect intel from various sources. But what I'm having trouble understanding is how you grab the normalized event, and then check the data in that event against a piece of intel.

I have read https://githu

Was recently added in outliers and I'm not sure that this is properly documented.
@michielmeersmans could provide input too, who developed this.

1. Adding a project wiki
2. Improving the existing documentation and publishing using Github pages for starters
3. For the installation of ELK on platforms like Mac, Linux, Windows we can add an additional section or else we can use a shell script for automating the whole ELK installation process
4. This installation script can be added to docker too