S1

evtx/Maps/SentinelOne-Operational_26.map

@@ -0,0 +1,39 @@
+Author: Tony Knutson
+Description: File Quarantine Already Quarantined
+EventId: 26
+Channel: "SentinelOne/Operational"
+Provider: SentinelOne
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "%FilePath%"
+    Values:
+      -
+        Name: FilePath
+        Value: "/Event/EventData/Data[@Name=\"FilePath\"]"
+
+# Documentation:
+# N/A
+#
+# Example Event Data:
+# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
+#   <System>
+#    	<Provider Name="SentinelOne" Guid="{GUID ID}" />
+#    	<EventID>26</EventID>
+#    	<Version>0</Version>
+#    	<Level>3</Level>
+#    	<Task>1</Task>
+#    	<Opcode>0</Opcode>
+#    	<Keywords>0x8000000000000000</Keywords>
+#    	<TimeCreated SystemTime="YYYY-MM-DDTHH:MM:00.0000Z" />
+#  	<EventRecordID>491</EventRecordID>
+#  	<Correlation />
+#  	<Execution ProcessID="12020" ThreadID="8276" />
+#  	<Channel>SentinelOne/Operational</Channel>
+#  	<Computer>COMPUTERNAME</Computer>
+#  	<Security UserID="SID" />
+#    </System>
+#    <EventData>
+#       <Data Name="FilePath">PATH TO THE FILE</Data>
+#    </EventData>
+#  </Event>

evtx/Maps/SentinelOne-Operational_31.map

@@ -0,0 +1,56 @@
+Author: Tony Knutson
+Description: Sentinel Threat Detected
+EventId: 31
+Channel: "SentinelOne/Operational"
+Provider: SentinelOne
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "Program: %Name%"
+    Values:
+      -
+        Name: Name
+        Value: "/Event/EventData/Data[@Name=\"Name\"]"
+  -
+    Property: PayloadData2
+    PropertyValue: "%Path%"
+    Values:
+      -
+        Name: Path
+        Value: "/Event/EventData/Data[@Name=\"Path\"]"
+  -
+    Property: PayloadData3
+    PropertyValue: "%DetectionEngine%"
+    Values:
+      -
+        Name: DetectionEngine
+        Value: "/Event/EventData/Data[@Name=\"DetectionEngine\"]"
+
+# Documentation:
+# N/A
+#
+# Example Event Data:
+# <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
+#  <System>
+#  <Provider Name="SentinelOne" Guid="{GUID}" />
+#  <EventID>31</EventID>
+#  <Version>0</Version>
+#  <Level>3</Level>
+#  <Task>1</Task>
+#  <Opcode>0</Opcode>
+#  <Keywords>0x8000000000000000</Keywords>
+#  <TimeCreated SystemTime="YYYY-MM-DD hh:mm:ss.0000" />
+#  <EventRecordID>305</EventRecordID>
+#  <Correlation />
+#  <Execution ProcessID="1132" ThreadID="2472" />
+#  <Channel>SentinelOne/Operational</Channel>
+#  <Computer>COMPUTERNAME</Computer>
+#  <Security UserID="S-1-5-18" />
+#  </System>
+# <EventData>
+#  <Data Name="TrueContextID">745B8EA53F832640</Data>
+#  <Data Name="Name">name</Data>
+#  <Data Name="Path">PATH</Data>
+#  <Data Name="DetectionEngine">windows.reputation</Data>
+#  </EventData>
+#  </Event>

evtx/Maps/SentinelOne-Operational_32.map

@@ -0,0 +1,48 @@
+Author: Tony Knutson
+Description: Sentinel Mitigation Report
+EventId: 32
+Channel: "SentinelOne/Operational"
+Provider: SentinelOne
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "Action: %Action%"
+    Values:
+      -
+        Name: Action
+        Value: "/Event/EventData/Data[@Name=\"Action\"]"
+  -
+    Property: PayloadData2
+    PropertyValue: "Result: %Result%"
+    Values:
+      -
+        Name: Result
+        Value: "/Event/EventData/Data[@Name=\"Result\"]"
+
+# Documentation:
+# N/A
+#
+# Example Event Data:
+#- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
+#- <System>
+#  <Provider Name="SentinelOne" Guid="{GUID}" />
+#  <EventID>32</EventID>
+#  <Version>0</Version>
+#  <Level>3</Level>
+#  <Task>1</Task>
+#  <Opcode>0</Opcode>
+#  <Keywords>0x8000000000000000</Keywords>
+#  <TimeCreated SystemTime="YYYY-MM-DD hh:mm:ss" />
+#  <EventRecordID>253</EventRecordID>
+#  <Correlation />
+#  <Execution ProcessID="1132" ThreadID="2472" />
+#  <Channel>SentinelOne/Operational</Channel>
+#  <Computer>COMPUTER NAME</Computer>
+#  <Security UserID="S-1-5-18" />
+#  </System>
+#- <EventData>
+#  <Data Name="TrueContextID">D69E3E5659219301</Data>
+#  <Data Name="Action">Quarantine</Data>
+#  <Data Name="Result">Success</Data>
+#  </EventData>
+#  </Event>

evtx/Maps/SentinelOne-Operational_81.map

@@ -0,0 +1,74 @@
+Author: Tony Knutson
+Description: Sentinel Scan Ended
+EventId: 81
+Channel: "SentinelOne/Operational"
+Provider: SentinelOne
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "ScanStartTime: %ScanStartTime%"
+    Values:
+      -
+        Name: ScanStartTime
+        Value: "/Event/EventData/Data[@Name=\"ScanStartTime\"]"
+  -
+    Property: PayloadData2
+    PropertyValue: "ScanStopTime: %ScanStopTime%"
+    Values:
+      -
+        Name: ScanStopTime
+        Value: "/Event/EventData/Data[@Name=\"ScanStopTime\"]"
+  -
+    Property: PayloadData3
+    PropertyValue: "ScannedPath: %ScannedPath%"
+    Values:
+      -
+        Name: ScannedPath
+        Value: "/Event/EventData/Data[@Name=\"ScannedPath\"]"
+  -
+    Property: PayloadData4
+    PropertyValue: "%Result%"
+    Values:
+      -
+        Name: Result
+        Value: "/Event/EventData/Data[@Name=\"Result\"]"
+  -
+    Property: PayloadData5
+    PropertyValue: "MaliciousCount: %MaliciousCount%"
+    Values:
+      -
+        Name: MaliciousCount
+        Value: "/Event/EventData/Data[@Name=\"MaliciousCount\"]"
+
+# Documentation:
+# N/A
+#
+# Example Event Data:
+#- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
+#- <System>
+#  <Provider Name="SentinelOne" Guid="{GUID}" />
+#  <EventID>81</EventID>
+#  <Version>0</Version>
+#  <Level>4</Level>
+#  <Task>1</Task>
+#  <Opcode>0</Opcode>
+#  <Keywords>0x8000000000000000</Keywords>
+#  <TimeCreated SystemTime="YYYY-MM-DD hh:mm:ss" />
+#  <EventRecordID>333</EventRecordID>
+#  <Correlation />
+#  <Execution ProcessID="1132" ThreadID="2428" />
+#  <Channel>SentinelOne/Operational</Channel>
+#  <Computer>COMPUTER NAME</Computer>
+#  <Security UserID="S-1-5-18" />
+# </System>
+#- <EventData>
+#  <Data Name="ScanStartTime">YYYY-MM-DD hh:mm:ss</Data>
+#  <Data Name="ScanEndTime">YYYY-MM-DD hh:mm:ss</Data>
+#  <Data Name="ScannedPath">All Volumes</Data>
+#  <Data Name="TriggerType">Management</Data>
+#  <Data Name="ScannedCount">NN</Data>
+#  <Data Name="MaliciousCount">NN</Data>
+# <Data Name="ExcludedMaliciousCount">NN</Data>
+#  <Data Name="Status">Completed</Data>
+# </EventData>
+#  </Event>