diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a0dc1c43..475eb37f4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -163,6 +163,8 @@ Thankyou! --> 1. Added `count`, `created_time`, `desc`, `first_seen_time`, `last_seen_time`, `modified_time`, `product`, `severity`, `severity_id`, `tags` & `title` to `related_event` object. #1271 1. Added `drive_type` and `drive_type_id` to the `file` object. #1287 1. Added `cpu_architecture` and `cpu_architecture_id` to `device_hw_info` object. #1278 + 1. Added `name` to `script` object. #1284 + ### Bugfixes 1. Added sibling definition to `confidence_id` in dictionary, accurately associating `confidence` as its sibling. #1180 diff --git a/objects/script.json b/objects/script.json index 6ccd15eef..0b74bc1ba 100644 --- a/objects/script.json +++ b/objects/script.json @@ -13,6 +13,10 @@ "description": "An array of the script's cryptographic hashes. Note that these hashes are calculated on the script in its original encoding, and not on the normalized UTF-8 encoding found in the script_content attribute.", "requirement": "recommended" }, + "name": { + "description": "Unique identifier for the script or macro, independent of the containing file, used for tracking, auditing, and security analysis.", + "requirement": "optional" + }, "parent_uid": { "description": "This attribute relates a sub-script to a parent script having the matching uid attribute. In the case of PowerShell, sub-script execution can be identified by matching the activity correlation ID of the raw ETW events provided by the OS.", "requirement": "optional"