# Windows related event formatters.

type: 'basic'
data_type: 'ccleaner:configuration'
message: '[{key_path}] {configuration}'
short_message: '[{key_path}] {configuration}'
---
type: 'conditional'
data_type: 'ccleaner:update'
message:
- 'Origin: {key_path}'
short_message:
- 'Origin: {key_path}'
---
type: 'conditional'
data_type: 'iis:log:line'
message:
- '{http_method}'
- '{requested_uri_stem}'
- '['
- '{source_ip}'
- '>'
- '{dest_ip}'
- ':'
- '{dest_port}'
- ']'
- 'HTTP Status: {http_status}'
- 'Bytes Sent: {sent_bytes}'
- 'Bytes Received: {received_bytes}'
- 'User Agent: {user_agent}'
- 'Protocol Version: {protocol_version}'
short_message:
- '{http_method}'
- '{requested_uri_stem}'
- '['
- '{source_ip}'
- '>'
- '{dest_ip}'
- ':'
- '{dest_port}'
- ']'
---
type: 'conditional'
data_type: 'setupapi:log:line'
message:
- '{entry_type}'
- '{exit_status}'
separator: ' - '
# Reversing fields for short description to prevent truncating the status
short_message:
- '{exit_status}'
- '{entry_type}'
---
type: 'conditional'
data_type: 'software_management:sccm:log'
message:
- '{component}'
- '{text}'
short_message:
- '{text}'
---
type: 'conditional'
data_type: 'task_scheduler:task_cache:entry'
message:
- '[{key_path}]'
- 'Task: {task_name}'
- '[Identifier: {task_identifier}]'
short_message:
- 'Task: {task_name}'
---
type: 'conditional'
data_type: 'windows:distributed_link_tracking:creation'
message:
- '{uuid}'
- 'MAC address: {mac_address}'
- 'Origin: {origin}'
short_message:
- '{uuid}'
- 'Origin: {origin}'
---
# TODO: Add more "elegant" formatting, as in transform ICMP code/type into
# a more human readable format as well as translating the additional info
# column (meaning may depend on action field).
type: 'conditional'
data_type: 'windows:firewall:log_entry'
message:
- '{action}'
- '['
- '{protocol}'
- '{path}'
- ']'
- 'From: {source_ip}'
- ':{source_port}'
- '>'
- '{dest_ip}'
- ':{dest_port}'
- 'Size (bytes): {size}'
- 'Flags [{flags}]'
- 'TCP Seq Number: {tcp_seq}'
- 'TCP ACK Number: {tcp_ack}'
- 'TCP Window Size (bytes): {tcp_win}'
- 'ICMP type: {icmp_type}'
- 'ICMP code: {icmp_code}'
- 'Additional info: {info}'
short_message:
- '{action}'
- '[{protocol}]'
- '{source_ip}'
- ': {source_port}'
- '>'
- '{dest_ip}'
- ': {dest_port}'
---
type: 'conditional'
data_type: 'windows:metadata:deleted_item'
enumeration_helpers:
- input_attribute: 'drive_number'
  output_attribute: 'drive_letter'
  default_value: 'UNKNOWN'
  values:
    0: 'A'
    1: 'B'
    2: 'C'
    3: 'D'
    4: 'E'
    5: 'F'
    6: 'G'
    7: 'H'
    8: 'I'
    9: 'J'
    10: 'K'
    11: 'L'
    12: 'M'
    13: 'N'
    14: 'O'
    15: 'P'
    16: 'Q'
    17: 'R'
    18: 'S'
    19: 'T'
    20: 'U'
    21: 'V'
    22: 'W'
    23: 'X'
    24: 'Y'
    25: 'Z'
message:
- 'DC{record_index} ->'
- '{original_filename}'
- '[{short_filename}]'
- '(from drive: {drive_letter})'
short_message:
- 'Deleted file: {original_filename}'
---
type: 'conditional'
data_type: 'windows:registry:explorer:programcache'
message:
- 'Key: {key_path}'
- 'Value: {value_name}'
- 'Entries: [{entries}]'
short_message:
- 'Key: {key_path}'
- 'Value: {value_name}'
- 'Entries: [{entries}]'
---
type: 'conditional'
data_type: 'windows:registry:amcache'
message:
- 'path: {full_path}'
- 'file_reference: {file_reference}'
- 'sha1: {sha1}'
- 'product_name: {product_name}'
- 'company_name: {company_name}'
- 'file_version: {file_version}'
- 'language_code: {language_code}'
- 'file_size: {file_size}'
- 'file_description: {file_description}'
- 'program_identifier: {program_identifier}'
short_message:
- 'path: {full_path}'
---
type: 'conditional'
data_type: 'windows:registry:amcache:programs'
message:
- 'name: {name}'
- 'version: {version}'
- 'publisher: {publisher}'
- 'language_code: {language_code}'
- 'entry_type: {entry_type}'
- 'uninstall_key: {uninstall_key}'
- 'file_paths: {file_paths}'
- 'product_code: {product_code}'
- 'package_code: {package_code}'
- 'msi_product_code: {msi_product_code}'
- 'msi_package_code: {msi_package_code}'
- 'files: {files}'
short_message:
- 'name: {name}'
---
type: 'conditional'
data_type: 'windows:registry:appcompatcache'
message:
- '[{key_path}]'
- 'Cached entry: {entry_index}'
- 'Path: {path}'
short_message:
- 'Path: {path}'
---
type: 'basic'
data_type: 'windows:registry:bagmru'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'conditional'
data_type: 'windows:registry:bam'
message:
- '{binary_path}'
- '[{user_sid}]'
short_message:
- '{binary_path}'
---
type: 'basic'
data_type: 'windows:registry:boot_execute'
message: '[{key_path}] BootExecute: {value}'
short_message: '[{key_path}] BootExecute: {value}'
---
type: 'basic'
data_type: 'windows:registry:boot_verification'
message: '[{key_path}] ImagePath: {image_path}'
short_message: '[{key_path}] ImagePath: {image_path}'
---
type: 'conditional'
data_type: 'windows:registry:installation'
message:
- '{product_name}'
- '{version}'
- '{build_number}'
- '{service_pack}'
- 'Owner: {owner}'
- 'Origin: {key_path}'
short_message:
- '{product_name}'
- '{version}'
- '{build_number}'
- '{service_pack}'
- 'Origin: {key_path}'
---
type: 'conditional'
data_type: 'windows:registry:mount_points2'
message:
- '[{key_path}]'
- 'Label: {label}'
- 'Remote_Server: {server_name}'
- 'Share_Name: {share_name}'
- 'Type: {type}'
- 'Volume: {name}'
short_message:
- '[{key_path}]'
- 'Label: {label}'
- 'Remote_Server: {server_name}'
- 'Share_Name: {share_name}'
- 'Type: {type}'
- 'Volume: {name}'
---
type: 'basic'
data_type: 'windows:registry:mrulist'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'basic'
data_type: 'windows:registry:mrulistex'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'basic'
data_type: 'windows:registry:msie_zone_settings'
message: '[{key_path}] {settings}'
short_message: '[{key_path}] {settings}'
---
type: 'conditional'
data_type: 'windows:registry:network'
message:
- 'SSID: {ssid}'
- 'Description: {description}'
- 'Connection Type: {connection_type}'
- 'Default Gateway Mac: {default_gateway_mac}'
- 'DNS Suffix: {dns_suffix}'
short_message:
- 'SSID: {ssid}'
- 'Description: {description}'
- 'Connection Type: {connection_type}'
- 'Default Gateway Mac: {default_gateway_mac}'
- 'DNS Suffix: {dns_suffix}'
---
type: 'conditional'
data_type: 'windows:registry:network_drive'
message:
- '[{key_path}]'
- 'DriveLetter: {drive_letter}'
- 'RemoteServer: {server_name}'
- 'ShareName: {share_name}'
- 'Type: Mapped Drive'
short_message:
- '[{key_path}]'
- 'DriveLetter: {drive_letter}'
- 'RemoteServer: {server_name}'
- 'ShareName: {share_name}'
- 'Type: Mapped Drive'
---
type: 'conditional'
data_type: 'windows:registry:office_mru'
message:
- '[{key_path}]'
- 'Value: {value_string}'
short_message:
- '{value_string}'
---
type: 'basic'
data_type: 'windows:registry:office_mru_list'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'basic'
data_type: 'windows:registry:outlook_search_mru'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'basic'
data_type: 'windows:registry:run'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'conditional'
data_type: 'windows:registry:sam_users'
message:
- '[{key_path}]'
- 'Username: {username}'
- 'Full name: {fullname}'
- 'Comments: {comments}'
- 'RID: {account_rid}'
- 'Login count: {login_count}'
short_message:
- '{username}'
- 'RID: {account_rid}'
- 'Login count: {login_count}'
---
type: 'conditional'
data_type: 'windows:registry:service'
enumeration_helpers:
- input_attribute: 'error_control'
  output_attribute: 'error_control'
  default_value: 'UNKNOWN'
  values:
    0: 'Ignore (0)'
    1: 'Normal (1)'
    2: 'Severe (2)'
    3: 'Critical (3)'
- input_attribute: 'service_type'
  output_attribute: 'service_type'
  default_value: 'UNKNOWN'
  values:
    1: 'Kernel Device Driver (0x1)'
    2: 'File System Driver (0x2)'
    4: 'Adapter (0x4)'
    16: 'Service - Own Process (0x10)'
    32: 'Service - Share Process (0x20)'
- input_attribute: 'start_type'
  output_attribute: 'start_type'
  default_value: 'UNKNOWN'
  values:
    0: 'Boot (0)'
    1: 'System (1)'
    2: 'Auto Start (2)'
    3: 'Manual (3)'
    4: 'Disabled (4)'
message:
- '[{key_path}]'
- 'Type: {service_type}'
- 'Start: {start_type}'
- 'Image path: {image_path}'
- 'Error control: {error_control}'
- '{values}'
short_message:
- '[{key_path}]'
- 'Type: {service_type}'
- 'Start: {start_type}'
- 'Image path: {image_path}'
- 'Error control: {error_control}'
- '{values}'
---
type: 'conditional'
data_type: 'windows:registry:shutdown'
message:
- '[{key_path}]'
- 'Description: {value_name}'
short_message:
- '{value_name}'
---
type: 'conditional'
data_type: 'windows:registry:mstsc:connection'
message:
- '[{key_path}]'
- 'Username hint: {username}'
short_message:
- '[{key_path}]'
---
type: 'basic'
data_type: 'windows:registry:mstsc:mru'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'basic'
data_type: 'windows:registry:timezone'
message: '[{key_path}] {configuration}'
short_message: '[{key_path}] {configuration}'
---
type: 'basic'
data_type: 'windows:registry:typedurls'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'conditional'
data_type: 'windows:registry:usb'
message:
- '[{key_path}]'
- 'Product: {product}'
- 'Serial: {serial}'
- 'Subkey name: {subkey_name}'
- 'Vendor: {vendor}'
short_message:
- '[{key_path}]'
- 'Product: {product}'
- 'Serial: {serial}'
- 'Subkey name: {subkey_name}'
- 'Vendor: {vendor}'
---
type: 'conditional'
data_type: 'windows:registry:usbstor'
message:
- '[{key_path}]'
- 'Device type: {device_type}'
- 'Display name: {display_name}'
- 'Product: {product}'
- 'Revision: {revision}'
- 'Serial: {serial}'
- 'Subkey name: {subkey_name}'
- 'Vendor: {vendor}'
short_message:
- '[{key_path}]'
- 'Device type: {device_type}'
- 'Display name: {display_name}'
- 'Product: {product}'
- 'Revision: {revision}'
- 'Serial: {serial}'
- 'Subkey name: {subkey_name}'
- 'Vendor: {vendor}'
---
type: 'conditional'
data_type: 'windows:registry:userassist'
message:
- '[{key_path}]'
- 'UserAssist entry: {entry_index}'
- 'Value name: {value_name}'
- 'Count: {number_of_executions}'
- 'Application focus count: {application_focus_count}'
- 'Application focus duration: {application_focus_duration}'
short_message:
- '{value_name}'
- 'Count: {number_of_executions}'
---
type: 'conditional'
data_type: 'windows:registry:winlogon'
message:
- '[{key_path}]'
- 'Application: {application}'
- 'Command: {command}'
- 'Handler: {handler}'
- 'Trigger: {trigger}'
short_message:
- '[{key_path}]'
- 'Application: {application}'
- 'Command: {command}'
- 'Handler: {handler}'
- 'Trigger: {trigger}'
---
type: 'conditional'
data_type: 'windows:restore_point:info'
enumeration_helpers:
- input_attribute: 'restore_point_event_type'
  output_attribute: 'restore_point_event_type'
  default_value: 'UNKNOWN'
  values:
    100: 'BEGIN_SYSTEM_CHANGE'
    101: 'END_SYSTEM_CHANGE'
    102: 'BEGIN_NESTED_SYSTEM_CHANGE'
    103: 'END_NESTED_SYSTEM_CHANGE'
- input_attribute: 'restore_point_type'
  output_attribute: 'restore_point_type'
  default_value: 'UNKNOWN'
  values:
    0: 'APPLICATION_INSTALL'
    1: 'APPLICATION_UNINSTALL'
    10: 'DEVICE_DRIVER_INSTALL'
    12: 'MODIFY_SETTINGS'
    13: 'CANCELLED_OPERATION'
message:
- '{description}'
- 'Event type: {restore_point_event_type}'
- 'Restore point type: {restore_point_type}'
short_message:
- '{description}'
---
type: 'conditional'
data_type: 'windows:tasks:job'
enumeration_helpers:
- input_attribute: 'trigger_type'
  output_attribute: 'trigger_type'
  default_value: 'UNKNOWN'
  values:
    0x0000: 'ONCE'
    0x0001: 'DAILY'
    0x0002: 'WEEKLY'
    0x0003: 'MONTHLYDATE'
    0x0004: 'MONTHLYDOW'
    0x0005: 'EVENT_ON_IDLE'
    0x0006: 'EVENT_AT_SYSTEMSTART'
    0x0007: 'EVENT_AT_LOGON'
message:
- 'Application: {application}'
- '{parameters}'
- 'Scheduled by: {username}'
- 'Working directory: {working_directory}'
- 'Trigger type: {trigger_type}'
short_message:
- 'Application: {application}'
- '{parameters}'
- 'Scheduled by: {username}'
- 'Working directory: {working_directory}'
- 'Trigger type: {trigger_type}'
---
type: 'basic'
data_type: 'winrar:history'
message: '[{key_path}] {entries}'
short_message: '[{key_path}] {entries}'
---
type: 'conditional'
data_type: 'windows:srum:application_usage'
message:
- 'Application: {application}'
short_message:
- '{application}'
---
type: 'conditional'
data_type: 'windows:srum:network_usage'
message:
- 'Application: {application}'
- 'Bytes received: {bytes_received}'
- 'Bytes sent: {bytes_sent}'
- 'Interface LUID: {interface_luid}'
- 'User identifier: {user_identifier}'
short_message:
- '{application}'
---
type: 'conditional'
data_type: 'windows:srum:network_connectivity'
message:
- 'Application: {application}'
short_message:
- '{application}'
---
type: 'conditional'
data_type: 'windows:timeline:generic'
message:
- 'Application Display Name: {application_display_name}'
- 'Package Identifier: {package_identifier}'
- 'Description: {description}'
short_message:
- '{package_identifier}'
---
type: 'conditional'
data_type: 'windows:timeline:user_engaged'
message:
- 'Package Identifier: {package_identifier}'
- 'Active Duration (seconds): {active_duration_seconds}'
- 'Reporting App: {reporting_app}'
short_message:
- '{package_identifier}'
---
type: 'conditional'
data_type: 'windows:volume:creation'
message:
- '{device_path}'
- 'Serial number: 0x{serial_number:08X}'
- 'Origin: {origin}'
short_message:
- '{device_path}'
- 'Origin: {origin}'
