[get_parent_process_create]
display_location = both
eventtypes = ms-sysmon-*
fields = ParentProcessGuid, host
label = Get parent process creation event
search.app = search
search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$ParentProcessGuid$ $ParentProcessGuid$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose
search.target = blank
type = search
search.earliest = -35d@d
search.latest = now

[get_process_create]
display_location = both
eventtypes = ms-sysmon-*
fields = ProcessGuid, host
label = Get process creation event
search.app = search
search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$ProcessGuid$ $ProcessGuid$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose
search.target = blank
type = search
search.earliest = -35d@d
search.latest = now

[get_process_create_sysmon_create_remote_thread]
display_location = both
eventtypes = ms-sysmon-*
fields = SourceProcessGuid, host
label = Get process creation event
search.app = search
search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$SourceProcessGuid$ $SourceProcessGuid$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose
search.target = blank
type = search
search.earliest = -35d@d
search.latest = now

[get_process_create_sysmon_process_access]
display_location = both
eventtypes = ms-sysmon-*
fields = SourceProcessGUID, host
label = Get process creation event
search.app = search
search.search_string = source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 host=$host$ ProcessGuid=$SourceProcessGUID$ $SourceProcessGUID$ | head 1 | table _time host EventCode EventDescription LogonId User IntegrityLevel process ProcessId Image CommandLine CurrentDirectory Hashes ParentImage ParentCommandLine | transpose
search.target = blank
type = search
search.earliest = -35d@d
search.latest = now
