Skip to content

Latest commit

 

History

History
19 lines (17 loc) · 610 Bytes

pC_symantecendpointprotectionjsonappactivityappactivity.md

File metadata and controls

19 lines (17 loc) · 610 Bytes

Parser Content

{
Name = symantec-endpointprotection-json-app-activity-appactivity
  Vendor = Symantec
  Product = Symantec Endpoint Protection
  TimeFormat = "yyyy-MM-dd HH:mm:ss"
  Conditions = [ """ SymantecServer: Site: """, """,Server: """ ]
  Fields = [
    """({host}[\w\-.]+)\s+SymantecServer:""",
    """SymantecServer:([^,]*,){2}({event_name}[^\.,]+?)\s*(<|$)""",
    """,Domain:\s*({web_domain}[^,]+?),Admin:\s*({user}[^,]+?),({event_name}.+?)\s*(<|$)""",
    """,Domain:\s*({web_domain}[^,\s]+),\s*({event_name}[^,]+),[^,]*,(|({user}[^,\s]+)),""",
  ]
  ParserVersion = "v1.0.0"


}