This repository has been archived by the owner on Nov 19, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 22
/
Copy path0811-log_collection_rules.xml
39 lines (38 loc) · 1.66 KB
/
0811-log_collection_rules.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
<group name="logcollect">
<rule id="256100" level="3">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-TerminalServices-LocalSessionManager/Operational$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>
<rule id="256101" level="3">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-SMBServer/Operational$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>
<rule id="256102" level="3">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-SMBServer/Connectivity$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>
<rule id="256103" level="3">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-SMBClient/Operational$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>
<rule id="256104" level="3">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-SmbClient/Connectivity$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>
<rule id="256105" level="3">
<if_sid>60000</if_sid>
<field name="win.system.channel">^Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational$</field>
<options>no_full_log</options>
<description>Group of Windows rules for the System channel</description>
</rule>
</group>