# Plaso event formatters.
---
type: 'conditional'
data_type: 'apache:access_log:entry'
message:
- 'http_request: {http_request}'
- 'from: {ip_address}'
- 'code: {http_response_code}'
- 'referer: {http_request_referer}'
- 'user_agent: {http_request_user_agent}'
- 'server_name: {server_name}'
- 'port: {port_number}'
short_message:
- '{http_request}'
- 'from: {ip_address}'
short_source: 'LOG'
source: 'Apache Access Log'
---
type: 'conditional'
data_type: 'atlassian:bitbucket:access'
message:
- '{http_request_method}'
- '{http_request_uri}'
- 'ssh_repo: {ssh_repository_path}'
- 'from: {remote_address}'
- 'user: {user_name}'
- 'protocol: {protocol}'
- 'code: {http_response_code}'
- 'User agent: {http_request_user_agent}'
- 'labels: {labels}'
- 'Mesh execution identifier: {mesh_execution_identifier}'
short_message:
- '{http_request_method}'
- '{http_request_uri}'
- 'from: {remote_address}'
short_source: 'LOG'
source: 'Atlassian Bitbucket Access Log'
---
type: 'conditional'
data_type: 'atlassian:bitbucket:audit'
message:
- '{event_name}'
- 'by: {user_name}'
- 'from: {remote_address}'
- 'entity: {entity}'
- 'details: {details}'
short_message:
- '{event_name}'
- 'by: {user_name}'
- 'from: {remote_address}'
short_source: 'LOG'
source: 'Atlassian Bitbucket Audit Log'
---
type: 'conditional'
data_type: 'atlassian:bitbucket:line'
message:
- 'level: {level}'
- 'thread: {thread}'
- 'user: {user_name}'
- 'IP address: {ip_address}'
- 'request_identifier: {request_identifier}'
- 'action: {request_action}'
- 'logger_class: {logger_class}'
- 'body: {body}'
short_message:
- '{level}'
- 'from: {logger_class}'
- '{body}'
short_source: 'LOG'
source: 'Atlassian Bitbucket Log'
---
type: 'conditional'
data_type: 'atlassian:confluence:line'
message:
- 'level: {level}'
- 'thread: {thread}'
- 'logger_class: {logger_class}'
- 'logger_method: {logger_method}'
- 'body: {body}'
short_message:
- '{logger_method}'
- 'from: {logger_class}'
short_source: 'LOG'
source: 'Atlassian Confluence Log'
---
type: 'conditional'
data_type: 'atlassian:jira:line'
message:
- 'level: {level}'
- 'thread: {thread}'
- 'logger_class: {logger_class}'
- 'logger_method: {logger_method}'
- 'body: {body}'
short_message:
- '{logger_method}'
- 'from: {logger_class}'
short_source: 'LOG'
source: 'Atlassian Jira Log'
---
type: 'conditional'
data_type: 'aws:cloudtrail:entry'
message:
- 'User {user_name}'
- 'performed {event_name}'
- 'on [{resources}]'
- 'using access key {access_key}'
- 'from IP address {source_ip}'
short_message:
- 'User {user_name}'
- 'performed {event_name}'
- 'on [{resources}]'
short_source: 'LOG'
source: 'AWS CloudTrail Log'
---
type: 'conditional'
data_type: 'aws:elb:access'
message:
- 'type: {type}'
- 'resource_identifier: {resource_identifier}'
- 'source_ip_address: {source_ip_address}'
- 'source_port: {source_port}'
- 'destination_ip_address: {destination_ip_address}'
- 'destination_port: {destination_port}'
- 'destination_status_code: {destination_status_code}'
- 'request: {request}'
- 'user_agent: {user_agent}'
- 'ssl_cipher: {ssl_cipher}'
- 'ssl_protocol: {ssl_protocol}'
- 'domain_name: {domain_name}'
- 'actions_executed: {actions_executed}'
- 'redirect_url: {redirect_url}'
- 'error_reason: {error_reason}'
- 'destination_list: {destination_list}'
- 'classification: {classification}'
- 'classification_reason: {classification_reason}'
short_message:
- 'source_ip_address: {client_ip_address}'
- 'destination_ip_address: {target_ip_address}'
- 'domain_name: {domain_name}'
- 'request: {request}'
- 'user_agent: {user_agent}'
short_source: 'LOG'
source: 'AWS Elastic Load Balancer Access Log'
---
type: 'conditional'
data_type: 'azure:activitylog:entry'
message:
- 'User {caller}'
- 'performed {operation_name}'
- 'on {resource_identifier}'
- 'from IP address {client_ip}'
short_message:
- 'User {caller}'
- 'performed {operation_name}'
- 'on {resource_identifier}'
short_source: 'LOG'
source: 'Azure Activity Log'
---
type: 'conditional'
data_type: 'azure:application_gateway_access:entry'
message:
- 'instance: {instance_identifier}'
- 'client IP address: {client_ip}'
- 'client port: {client_port}'
- 'HTTP method: {http_method}'
- 'original request URI: {original_request_uri}'
- 'request URI: {request_uri}'
- 'request query: {request_query}'
- 'user agent: {user_agent}'
- 'HTTP status: {http_status}'
- 'HTTP version: {http_version}'
- 'received bytes: {received_bytes}'
- 'sent bytes: {sent_bytes}'
- 'client response time: {client_response_time}'
- 'time taken: {time_taken}'
- 'WAF evaluation time: {waf_evaluation_time}'
- 'WAF mode: {waf_mode}'
- 'transaction: {transaction_identifier}'
- 'SSL enabled: {ssl_enabled}'
- 'SSL cipher: {ssl_cipher}'
- 'SSL protocol: {ssl_protocol}'
- 'SSL client verify: {ssl_client_verify}'
- 'SSL client certificate fingerprint: {ssl_client_certificate_fingerprint}'
- 'SSL client certificate issuer name: {ssl_client_certificate_issuer_name}'
- 'server routed: {server_routed}'
- 'server status: {server_status}'
- 'server responsei latency: {server_response_latency}'
- 'original host: {original_host}'
- 'host: {host}'
short_message:
- 'client IP address: {client_ip}'
- 'http method: {http_method}'
- 'original request URI: {original_request_uri}'
- 'http status: {http_status}'
short_source: 'LOG'
source: 'Azure Application Gateway Access Log'
---
type: 'basic'
data_type: 'bash:history:entry'
message: 'Command executed: {command}'
short_message: '{command}'
short_source: 'LOG'
source: 'Bash History'
---
type: 'conditional'
data_type: 'confluence:access'
message:
- 'http_request: {http_request_method} '
- '{http_request_uri}'
- 'from: {remote_name}'
- 'via: {forwarded_for}'
- 'user: {user_name}'
- 'code: {http_response_code}'
- 'referer: {http_request_referer}'
- 'user_agent: {http_request_user_agent}'
- 'thread: {thread_name}'
short_message:
- '{http_request_method}'
- '{http_request_uri}'
- 'from: {remote_name}'
short_source: 'LOG'
source: 'Confluence access log'
---
type: 'conditional'
data_type: 'jira:access'
message:
- 'http_request: {http_request_method} '
- '{http_request_uri}'
- 'from: {remote_name}'
- 'via: {forwarded_for}'
- 'user: {user_name}'
- 'code: {http_response_code}'
- 'referer: {http_request_referer}'
- 'user_agent: {http_request_user_agent}'
- 'thread: {thread_name}'
short_message:
- '{http_request_method}'
- '{http_request_uri}'
- 'from: {remote_name}'
short_source: 'LOG'
source: 'Jira access log'
---
type: 'conditional'
data_type: 'cri:container:log:entry'
message:
- 'Stream: {stream}'
- 'Tag: {tag}'
- 'Body: {body}'
short_message:
- 'Stream: {stream}'
- 'Body: {body}'
short_source: 'CRI'
source: 'Container Runtime Interface Container Log'
---
type: 'conditional'
data_type: 'cups:ipp:event'
message:
- 'Status: {status}'
- 'User: {user}'
- 'Owner: {owner}'
- 'Job Name: {job_name}'
- 'Application: {application}'
- 'Document type: {type_doc}'
- 'Printer: {printer_id}'
short_message:
- 'Status: {status}'
- 'Job Name: {job_name}'
short_source: 'LOG'
source: 'CUPS IPP Log'
---
type: 'conditional'
data_type: 'docker:container:configuration'
message:
- 'Container identifier: {container_identifier}'
- 'Container name: {container_name}'
- 'Action: {action}'
separator: ', '
short_message:
- 'Container identifier: {container_identifier}'
- 'Container name: {container_name}'
- 'Action: {action}'
short_source: 'DOCKER'
source: 'Docker Container'
---
type: 'conditional'
data_type: 'docker:container:log:entry'
message:
- 'Container identifier: {container_identifier}'
- 'Source: {log_source}'
- 'Text: {log_line}'
separator: ', '
short_message:
- 'Container identifier: {container_identifier}'
- 'Source: {log_source}'
- 'Text: {log_line}'
short_source: 'DOCKER'
source: 'Docker Container Log'
---
type: 'conditional'
data_type: 'docker:layer:configuration'
message:
- 'Layer identifier: {layer_identifier}'
- 'Command: {command}'
separator: ', '
short_message:
- 'Layer identifier: {layer_identifier}'
- 'Command: {command}'
short_source: 'DOCKER'
source: 'Docker Layer'
---
type: 'conditional'
data_type: 'dropbox:sync_history:entry'
message:
- 'Path: {local_path}'
- 'File identifier: {file_identifier}'
- 'Event type: {event_type}'
- 'Direction: {direction}'
short_message:
- '{local_path}'
- '{event_type}'
- '{direction}'
short_source: 'HISTORY'
source: 'Dropbox sync history'
---
type: 'basic'
data_type: 'fish:history:entry'
message: 'Command executed: {command}'
short_message: '{command}'
short_source: 'LOG'
source: 'Fish History'
---
type: 'conditional'
data_type: 'fs:bodyfile:entry'
message:
- '{filename}'
- 'Owner identifier: {owner_identifier}'
- 'Group identifier: {group_identifier}'
- 'Mode: {mode_as_string}'
- 'MD5: {md5}'
short_message:
- '{filename}'
short_source: 'FILE'
source: 'Bodyfile'
---
type: 'conditional'
data_type: 'fs:ntfs:usn_change'
custom_helpers:
- identifier: 'ntfs_file_reference'
  output_attribute: 'file_reference'
- identifier: 'ntfs_parent_file_reference'
  output_attribute: 'parent_file_reference'
flags_helpers:
- input_attribute: 'update_reason_flags'
  output_attribute: 'update_reason'
  values:
    0x00000001: 'USN_REASON_DATA_OVERWRITE'
    0x00000002: 'USN_REASON_DATA_EXTEND'
    0x00000004: 'USN_REASON_DATA_TRUNCATION'
    0x00000010: 'USN_REASON_NAMED_DATA_OVERWRITE'
    0x00000020: 'USN_REASON_NAMED_DATA_EXTEND'
    0x00000040: 'USN_REASON_NAMED_DATA_TRUNCATION'
    0x00000100: 'USN_REASON_FILE_CREATE'
    0x00000200: 'USN_REASON_FILE_DELETE'
    0x00000400: 'USN_REASON_EA_CHANGE'
    0x00000800: 'USN_REASON_SECURITY_CHANGE'
    0x00001000: 'USN_REASON_RENAME_OLD_NAME'
    0x00002000: 'USN_REASON_RENAME_NEW_NAME'
    0x00004000: 'USN_REASON_INDEXABLE_CHANGE'
    0x00008000: 'USN_REASON_BASIC_INFO_CHANGE'
    0x00010000: 'USN_REASON_HARD_LINK_CHANGE'
    0x00020000: 'USN_REASON_COMPRESSION_CHANGE'
    0x00040000: 'USN_REASON_ENCRYPTION_CHANGE'
    0x00080000: 'USN_REASON_OBJECT_ID_CHANGE'
    0x00100000: 'USN_REASON_REPARSE_POINT_CHANGE'
    0x00200000: 'USN_REASON_STREAM_CHANGE'
    0x00400000: 'USN_REASON_TRANSACTED_CHANGE'
    0x80000000: 'USN_REASON_CLOSE'
- input_attribute: 'update_source_flags'
  output_attribute: 'update_source'
  values:
    0x00000001: 'USN_SOURCE_DATA_MANAGEMENT'
    0x00000002: 'USN_SOURCE_AUXILIARY_DATA'
    0x00000004: 'USN_SOURCE_REPLICATION_MANAGEMENT'
message:
- '{filename}'
- 'File reference: {file_reference}'
- 'Parent file reference: {parent_file_reference}'
- 'Update source: {update_source}'
- 'Update reason: {update_reason}'
short_message:
- '{filename}'
- '{file_reference}'
- '{update_reason}'
short_source: 'FILE'
source: 'NTFS USN change'
---
type: 'conditional'
data_type: 'fs:stat'
boolean_helpers:
- input_attribute: 'is_allocated'
  output_attribute: 'unallocated'
  value_if_false: 'unallocated'
message:
- '{display_name}'
- 'Type: {file_entry_type}'
- 'Owner identifier: {owner_identifier}'
- 'Group identifier: {group_identifier}'
- 'Mode: 0o{mode:03o}'
- 'Number of links: {number_of_links}'
- '({unallocated})'
short_message:
- '{filename}'
short_source: 'FILE'
source: 'File stat'
---
type: 'conditional'
data_type: 'fs:stat:ntfs'
boolean_helpers:
- input_attribute: 'is_allocated'
  output_attribute: 'unallocated'
  value_if_false: 'unallocated'
custom_helpers:
- identifier: 'ntfs_file_reference'
  output_attribute: 'file_reference'
- identifier: 'ntfs_parent_file_reference'
  output_attribute: 'parent_file_reference'
- identifier: 'ntfs_path_hints'
  output_attribute: 'path_hints'
enumeration_helpers:
- input_attribute: 'attribute_type'
  output_attribute: 'attribute_name'
  default_value: 'UNKNOWN'
  values:
    0x00000010: '$STANDARD_INFORMATION'
    0x00000030: '$FILE_NAME'
message:
- '{display_name}'
- 'File reference: {file_reference}'
- 'Attribute name: {attribute_name}'
- 'Name: {name}'
- 'Parent file reference: {parent_file_reference}'
- '({unallocated})'
- 'Path hints: {path_hints}'
short_message:
- '{filename}'
- '{file_reference}'
- '{attribute_name}'
short_source: 'FILE'
source: 'NTFS file stat'
---
type: 'conditional'
data_type: 'gcp:log:entry'
message:
- '{text_payload}'
- 'User {principal_email}'
- 'performed {event_subtype}'
- 'on {resource_name}'
short_message:
- '{text_payload}'
- 'User {principal_email}'
- 'performed {event_subtype}'
- 'on {resource_name}'
short_source: 'LOG'
source: 'Google Cloud Log'
---
type: 'conditional'
data_type: 'gdrive:snapshot:cloud_entry'
boolean_helpers:
- input_attribute: 'shared'
  output_attribute: 'shared'
  value_if_false: 'Private'
  value_if_true: 'Shared'
enumeration_helpers:
- input_attribute: 'document_type'
  output_attribute: 'document_type'
  default_value: 'UNKNOWN'
  values:
    0: 'FOLDER'
    1: 'FILE'
    2: 'PRESENTATION'
    3: 'UNKNOWN'
    4: 'SPREADSHEET'
    5: 'DRAWING'
    6: 'DOCUMENT'
    7: 'TABLE'
message:
- 'File Path: {path}'
- '[{shared}]'
- 'Size: {size}'
- 'URL: {url}'
- 'Type: {document_type}'
short_message:
- '{path}'
short_source: 'LOG'
source: 'Google Drive (cloud entry)'
---
type: 'conditional'
data_type: 'gdrive:snapshot:local_entry'
message:
- 'File Path: {path}'
- 'Size: {size}'
short_message:
- '{path}'
short_source: 'LOG'
source: 'Google Drive (local entry)'
---
type: 'conditional'
data_type: 'google_drive_sync_log:entry'
message:
- '[{level}'
- '{process_identifier}'
- '{thread}'
- '{source_code}]'
- '{message}'
short_message:
- '{message}'
short_source: 'LOG'
source: 'Google Drive Sync Log'
---
type: 'conditional'
data_type: 'googlelog:log'
message:
- '{file_name}:'
- '{line_number}]'
- '{message}'
short_message:
- '{message}'
short_source: 'LOG'
source: 'Google Log'
---
type: 'conditional'
data_type: 'java:download:idx'
message:
- 'IDX Version: {idx_version}'
- 'Host IP address: ({ip_address})'
- 'Download URL: {url}'
short_message:
- 'IDX Version: {idx_version}'
- 'Host IP address: ({ip_address})'
- 'Download URL: {url}'
short_source: 'JAVA_IDX'
source: 'Java Cache IDX'
---
type: 'conditional'
data_type: 'kodi:videos:viewing'
message:
- 'Video: {filename}'
- 'Play Count: {play_count}'
short_message:
- '{filename}'
short_source: 'KODI'
source: 'Kodi Video Viewed'
---
type: 'conditional'
data_type: 'microsoft365:audit_log:entry'
message:
- 'User {user_identifier}'
- 'performed {operation_name}'
- 'from {client_ip}'
- 'on {workload}'
- 'Result Status: {result_status}'
- 'Record Type: {record_type}'
short_message:
- 'User {user_identifier}'
- 'performed {operation_name}'
- 'from {client_ip}'
- 'on {workload}'
- 'Result Status: {result_status}'
- 'Record Type: {record_type}'
short_source: 'LOG'
source: 'Microsoft (Office) 365 Audit Log'
---
type: 'conditional'
data_type: 'networkminer:fileinfos:file'
message:
- 'Source IP: {source_ip}'
- 'Source Port: {source_port}'
- 'Destination IP: {destination_ip}'
- 'Destination Port: {destination_port}'
- '{filename}'
- '{file_path}'
- '{file_size}'
- '{file_md5}'
- '{file_details}'
short_message:
- 'Source IP: {source_ip}'
- 'Destination IP: {destination_ip}'
- '{filename}'
- '{file_path}'
- '{file_md5}'
short_source: 'NetworkMiner'
source: 'NetworkMiner fileinfos'
---
type: 'conditional'
data_type: 'olecf:dest_list:entry'
enumeration_helpers:
- input_attribute: 'pin_status'
  output_attribute: 'pin_status'
  default_value: 'UNKNOWN'
  values:
    -1: 'Unpinned'
    0: 'Pinned'
message:
- 'Entry: {entry_number}'
- 'Pin status: {pin_status}'
- 'Hostname: {hostname}'
- 'Path: {path}'
- 'Droid volume identifier: {droid_volume_identifier}'
- 'Droid file identifier: {droid_file_identifier}'
- 'Birth droid volume identifier: {birth_droid_volume_identifier}'
- 'Birth droid file identifier: {birth_droid_file_identifier}'
short_message:
- 'Entry: {entry_number}'
- 'Pin status: {pin_status}'
- 'Path: {path}'
short_source: 'OLECF'
source: 'OLECF Dest list entry'
---
type: 'conditional'
data_type: 'olecf:document_summary_info'
message:
- 'Number of bytes: {number_of_bytes}'
- 'Number of lines: {number_of_lines}'
- 'Number of paragraphs: {number_of_paragraphs}'
- 'Number of slides: {number_of_slides}'
- 'Number of notes: {number_of_notes}'
- 'Number of hidden slides: {number_of_hidden_slides}'
- 'Number of multi-media clips: {number_of_clips}'
- 'Company: {company}'
- 'Manager: {manager}'
- 'Shared document: {shared_document}'
- 'Application version: {application_version}'
- 'Content type: {content_type}'
- 'Content status: {content_status}'
- 'Language: {language}'
- 'Document version: {document_version}'
short_message:
- 'Company: {company}'
short_source: 'OLECF'
source: 'OLECF Document Summary Info'
---
type: 'basic'
data_type: 'olecf:item'
message: 'Name: {name}'
short_message: 'Name: {name}'
short_source: 'OLECF'
source: 'OLECF Item'
---
type: 'conditional'
data_type: 'olecf:summary_info'
flags_helpers:
- input_attribute: 'security_flags'
  output_attribute: 'security_flags_description'
  values:
    0x00000001: 'Password protected'
    0x00000002: 'Read-only recommended'
    0x00000004: 'Read-only enforced'
    0x00000008: 'Locked for annotations'
message:
- 'Title: {title}'
- 'Subject: {subject}'
- 'Author: {author}'
- 'Keywords: {keywords}'
- 'Comments: {comments}'
- 'Template: {template}'
- 'Revision number: {revision_number}'
- 'Last saved by: {last_saved_by}'
- 'Total edit time (secs): {edit_duration}'
- 'Number of pages: {number_of_pages}'
- 'Number of words: {number_of_words}'
- 'Number of characters: {number_of_characters}'
- 'Application: {application}'
- 'Security flags: 0x{security_flags:08x}'
- '[{security_flags_description}]'
short_message:
- 'Title: {title}'
- 'Subject: {subject}'
- 'Author: {author}'
- 'Revision number: {revision_number}'
short_source: 'OLECF'
source: 'OLECF Summary Info'
---
type: 'conditional'
data_type: 'openxml:metadata'
message:
- 'Application: {application}'
- '{application_version}'
- 'Title: {title}'
- 'Subject: {subject}'
- 'Last saved by: {last_saved_by}'
- 'Author: {author}'
- 'Total edit time (secs): {edit_duration}'
- 'Keywords: {keywords}'
- 'Comments: {comments}'
- 'Revision number: {revision_number}'
- 'Template: {template}'
- 'Number of pages: {number_of_pages}'
- 'Number of words: {number_of_words}'
- 'Number of characters: {number_of_characters}'
- 'Number of characters with spaces: {number_of_characters_with_spaces}'
- 'Number of lines: {number_of_lines}'
- 'Number of slides: {number_of_slides}'
- 'Number of hidden slides: {number_of_hidden_slides}'
- 'Number of multi-media clips: {number_of_clips}'
- 'Company: {company}'
- 'Manager: {manager}'
- 'Shared: {shared}'
- 'Security flags: 0x{security_flags:08x}'
- 'Hyperlinks changed: {hyperlinks_changed}'
- 'Links up to date: {links_up_to_date}'
- 'Scale: {scale}'
- 'Digital signature: {digital_signature}'
- 'Presentation format: {presentation_format}'
- 'Notes: {notes}'
short_message:
- 'Title: {title}'
- 'Subject: {subject}'
- 'Author: {author}'
short_source: 'META'
source: 'Open XML Metadata'
---
type: 'conditional'
data_type: 'p2p:bittorrent:transmission'
message:
- 'Saved to {destination}'
- 'Minutes seeded: {seedtime}'
separator: '; '
short_message:
- 'Saved to {destination}'
- 'Minutes seeded: {seedtime}'
short_source: 'TORRENT'
source: 'Transmission Active Torrents'
---
type: 'conditional'
data_type: 'p2p:bittorrent:utorrent'
message:
- 'Torrent {caption}'
- 'Saved to {destination}'
- 'Minutes seeded: {seedtime}'
separator: '; '
short_message:
- 'Torrent {caption}'
- 'Saved to {destination}'
- 'Minutes seeded: {seedtime}'
short_source: 'TORRENT'
source: 'uTorrent Active Torrents'
---
type: 'conditional'
data_type: 'pe_coff:dll_import'
message:
- 'Name: {name}'
- 'Delayed import: {delayed_import}'
short_message:
- '{name}'
short_source: 'PE'
source: 'PE/COFF DLL import table'
---
type: 'conditional'
data_type: 'pe_coff:file'
message:
- 'PE Type: {pe_type}'
- 'Import hash: {imphash}'
- 'Export DLL name: {export_dll_name}'
short_message:
- '{pe_type}'
- '{export_dll_name}'
short_source: 'PE'
source: 'PE/COFF file'
---
type: 'conditional'
data_type: 'pe_coff:resource'
message:
- 'Identifier: {identifier}'
- 'Name: {name}'
short_message:
- '{identifier}'
- '{name}'
short_source: 'PE'
source: 'PE/COFF DLL resource section'
---
type: 'conditional'
data_type: 'pls_recall:entry'
message:
- 'Sequence number: {sequence_number}'
- 'Username: {username}'
- 'Database name: {database_name}'
- 'Query: {query}'
short_message:
- '{sequence_number}'
- '{username}'
- '{database_name}'
- '{query}'
short_source: 'PLSRecall'
source: 'PL/SQL Developer Recall file'
---
type: 'conditional'
data_type: 'postgresql:application_log:entry'
message:
- 'PID {pid}'
- '{user}'
- '{severity}'
- '{log_line}'
short_message:
- '{severity}'
- '{log_line}'
short_source: 'LOG'
source: 'PostgreSQL Log'
---
type: 'conditional'
data_type: 'powershell:transcript_log:entry'
message:
- '{commands} executed'
- 'by host application {host_application}'
- 'as user {runas_user}'
- 'in process {process_identifier}'
short_message:
- '{host_application} executed: '
- '{commands}'
short_source: 'LOG'
source: 'PowerShell Transcript Event'
---
type: 'conditional'
data_type: 'santa:diskmount'
message:
- 'Santa {action}'
- 'on ({mount})'
- 'serial: ({serial})'
- 'for ({dmg_path})'
short_message:
- '{action}'
- '{volume}'
short_source: 'LOG'
source: 'Santa disk mount'
---
type: 'conditional'
data_type: 'santa:execution'
message:
- 'Santa {decision}'
- 'process: {process_path}'
- 'hash: {process_hash}'
short_message:
- '{decision}'
- 'process: {process_path}'
short_source: 'LOG'
source: 'Santa Execution'
---
type: 'conditional'
data_type: 'santa:file_system_event'
message:
- 'Santa {action} event'
- '{file_path}'
- 'by process: {process_path}'
short_message:
- 'File {action}'
- 'on: {file_path}'
short_source: 'LOG'
source: 'Santa FSEvent'
---
type: 'conditional'
data_type: 'shell:zsh:history'
message:
- '{command}'
- 'Time elapsed: {elapsed_seconds} seconds'
short_message:
- '{command}'
short_source: 'HIST'
source: 'Santa FSEvent'
---
type: 'conditional'
data_type: 'skydrive:log:entry'
message:
- '[{module}'
- '{source_code}'
- '{log_level}]'
- '{detail}'
short_message:
- '{detail}'
short_source: 'LOG'
source: 'SkyDrive Log File'
---
type: 'conditional'
data_type: 'skype:event:account'
message:
- '[{display_name}]'
- '{fullname}'
- '<{email}>'
- 'Country: {country}'
short_message:
- '[{display_name}]'
- '{fullname}'
- '<{email}>'
- 'Country: {country}'
short_source: 'LOG'
source: 'Skype Account'
---
type: 'conditional'
data_type: 'skype:event:call'
message:
- 'From: {src_call}'
- 'To: {dst_call}'
- '[{call_type}]'
short_message:
- 'From: {src_call}'
- 'To: {dst_call}'
- '[{call_type}]'
short_source: 'LOG'
source: 'Skype Call'
---
type: 'conditional'
data_type: 'skype:event:chat'
message:
- 'From: {from_account}'
- 'To: {to_account}'
- '[{title}]'
- 'Message: [{text}]'
short_message:
- 'From: {from_account}'
- 'To: {to_account}'
short_source: 'LOG'
source: 'Skype Chat Message'
---
type: 'conditional'
data_type: 'skype:event:sms'
message:
- 'To: {number}'
- '[{text}]'
short_message:
- 'To: {number}'
- '[{text}]'
short_source: 'LOG'
source: 'Skype Text Message (SMS)'
---
type: 'conditional'
data_type: 'skype:event:transferfile'
message:
- 'Source: {source}'
- 'Destination: {destination}'
- 'File: {transferred_filename}'
short_message:
- 'Source: {source}'
- 'Destination: {destination}'
- 'File: {transferred_filename}'
short_source: 'LOG'
source: 'Skype File Transfer'
---
type: 'conditional'
data_type: 'snort:fastlog:alert'
message:
- 'Message: {message}'
- 'Source IP: {source_ip}'
- 'Source Port: {source_port}'
- 'Destination IP: {destination_ip}'
- 'Destination Port: {destination_port}'
- 'Protocol: {protocol}'
- 'Classification: {classification}'
- 'Rule: {rule_identifier}'
- 'Priority: {priority}'
short_message:
- 'Message: {message}'
- 'Source-IP: {source_ip}'
- 'Destination-IP: {destination_ip}'
- 'Rule: {rule_identifier}'
short_source: 'LOG'
source: 'Snort3/Suricata fast-log alert log'
---
type: 'conditional'
data_type: 'syslog:cron:task_run'
message:
- 'Cron ran: {command}'
- 'for user: {username}'
- 'pid: {pid}'
short_message:
- '{body}'
short_source: 'LOG'
source: 'Cron log'
---
type: 'conditional'
data_type: 'syslog:line'
message:
- '{severity} '
- '['
- '{reporter}'
- ', pid: {pid}'
- '] {body}'
separator: ''
short_message:
- '{severity} '
- '['
- '{reporter}'
- ', pid: {pid}'
- '] {body}'
short_source: 'LOG'
source: 'Log File'
---
type: 'conditional'
data_type: 'syslog:ssh:failed_connection'
message:
- 'Unsuccessful connection of user: {username} '
- 'from {ip_address}:'
- '{port} '
- 'using authentication method: {authentication_method} '
- 'ssh pid: {pid}'
separator: ''
short_message:
- '{body}'
short_source: 'LOG'
source: 'SSH Log'
---
type: 'conditional'
data_type: 'syslog:ssh:login'
message:
- 'Successful login of user: {username} '
- 'from {ip_address}:'
- '{port} '
- 'using authentication method: {authentication_method} '
- 'ssh pid: {pid}'
separator: ''
short_message:
- '{body}'
short_source: 'LOG'
source: 'SSH Log'
---
type: 'conditional'
data_type: 'syslog:ssh:opened_connection'
message:
- 'Connection opened {ip_address}:'
- '{port} '
- 'ssh pid: {pid}'
separator: ''
short_message:
- '{body}'
short_source: 'LOG'
source: 'SSH Log'
---
# It would be nice to have the _MACHINE_ID field, which is an unique identifier
# for the system, and hopefully more unique than the _HOSTNAME field.
# Unfortunately, journal files that have not been closed cleanly may contain
# entries that have no _MACHINE_ID field.
type: 'conditional'
data_type: 'systemd:journal'
message:
- '{hostname} '
- '['
- '{reporter}'
- ', pid: {pid}'
- '] {body}'
separator: ''
short_message:
- '{hostname} '
- '['
- '{reporter}'
- ', pid: {pid}'
- '] {body}'
short_source: 'LOG'
source: 'Systemd journal'
---
type: 'conditional'
data_type: 'teamviewer:application_log:entry'
message:
- '[pid: {process_identifier}]'
- '{body}'
short_message:
- '{body}'
source: 'TeamViewer application log'
short_source: 'LOG'
---
type: 'conditional'
data_type: 'teamviewer:connections_incoming:entry'
message:
- 'Source TeamViewer identifier: {source_identifier}'
- 'Connection identifier: {connection_identifier}'
- 'Activity type: {activity_type}'
- 'Display name: {display_name}'
- 'Local account: {local_account}'
short_message:
- '{source_identifier}'
- '{connection_identifier}'
- '{activity_type}'
- '{display_name}'
- '{local_account}'
source: 'TeamViewer incoming connections log'
short_source: 'LOG'
---
type: 'conditional'
data_type: 'teamviewer:connections_outgoing:entry'
message:
- 'Destination TeamViewer identifier: {destination_identifier}'
- 'Connection identifier: {connection_identifier}'
- 'Activity type: {activity_type}'
- 'Local account: {local_account}'
short_message:
- '{destination_identifier}'
- '{connection_identifier}'
- '{activity_type}'
- '{local_account}'
source: 'TeamViewer outgoing connections log'
short_source: 'LOG'
---
type: 'conditional'
data_type: 'viminfo:history'
message:
- '['
- 'History type: {history_type}'
- 'item number: {item_number}'
- ']'
- 'value: {history_value}'
- 'filename: {filename}'
short_message:
- '[{history_type}]'
- '{history_value}'
- '{filename}'
short_source: 'HISTORY'
source: 'viminfo'
---
type: 'conditional'
data_type: 'vsftpd:log'
message:
- '{text}'
short_message:
- '{text}'
short_source: 'LOG'
source: 'vsftpd log'
---
type: 'conditional'
data_type: 'xchat:log:line'
message:
- '[nickname: {nickname}]'
- '{text}'
short_message:
- '[nickname: {nickname}]'
- '{text}'
short_source: 'LOG'
source: 'XChat Log'
---
type: 'conditional'
data_type: 'xchat:scrollback:line'
message:
- '['
- 'nickname: {nickname}'
- ']'
- ' {text}'
separator: ''
short_message:
- '['
- 'nickname: {nickname}'
- ']'
- ' {text}'
short_source: 'LOG'
source: 'XChat Scrollback Log'
---
type: 'basic'
data_type: 'zeitgeist:activity'
message: '{subject_uri}'
short_message: '{subject_uri}'
short_source: 'LOG'
source: 'Zeitgeist Activity Log'
