[
  {
    "id": 1,
    "name": "transform:winlogbeat:sysmon with necessary fields",
    "description": "Transform winlogbeat sysmon events to keep relevant fields only",
    "function": "PDL_EXPRESSION",
    "definition": {
      "pdl": "| fields keep event.code,event.created,winlog.event_data,winlog.computer_name,message"
    }
  },
  {
    "id":101,
    "name":"transform:winlogbeat:sysmon to match padas data model",
    "description":"Transform and add fields to sysmon event to match Padas data model",
    "function":"PDL_EXPRESSION",
    "definition": {
        "pdl":"eval parent_process_path = if(event.code=\"1\", winlog.event_data.ParentImage, \"\")
              | eval parent_process_path = if((event.code=\"7\"), winlog.event_data.Image, \"\")
              | eval process = if(event.code=\"5\", winlog.event_data.Image, \"\")
              | eval process_path = if((event.code=\"1\" OR event.code=\"2\" OR event.code=\"5\" OR event.code=\"9\" OR event.code=\"11\" OR event.code=\"12\" OR event.code=\"13\" OR event.code=\"14\" OR event.code=\"15\" OR event.code=\"17\" OR event.code=\"18\" OR event.code=\"23\" OR event.code=\"24\" OR event.code=\"25\" OR event.code=\"26\"), winlog.event_data.Image, \"\")
              | eval parent_process_path = if((event.code=\"8\" OR event.code=\"10\"), winlog.event_data.SourceImage, \"\")
              | eval parent_process_guid = if((event.code=\"1\"), winlog.event_data.ParentProcessGuid, if((event.code=\"7\"), winlog.event_data.ProcessGuid, if((event.code=\"8\" OR event.code=\"10\"), winlog.event_data.SourceProcessGuid, \"\")))
              | eval parent_process_id = if((event.code=\"1\"), winlog.event_data.ParentProcessId, if((event.code=\"7\"), winlog.event_data.ProcessId, if((event.code=\"8\" OR event.code=\"10\"), winlog.event_data.SourceProcessId, \"\")))
              | eval process_id = if((NOT (event.code=\"8\" OR event.code=\"10\")), winlog.event_data.ProcessId, if((event.code=\"8\" OR event.code=\"10\"), winlog.event_data.TargetProcessId, \"\"))
              | eval process = if((event.code=\"1\"), winlog.event_data.CommandLine, \"\")
              | eval process_path = if((event.code=\"6\" OR event.code=\"7\"), winlog.event_data.ImageLoaded, if((event.code=\"8\" OR event.code=\"10\"), winlog.event_data.TargetImage, \"\"))
              | eval process_guid = if((event.code=\"8\" OR event.code=\"10\"), winlog.event_data.TargetProcessGuid, winlog.event_data.ProcessGuid)
              | eval dest = if((event.code=\"3\"), winlog.event_data.DestinationHostname, winlog.event_data.computer_name)
              | eval registry_key = if((event.code=\"12\" OR event.code=\"13\" OR event.code=\"14\"), winlog.event_data.TargetObject, \"\")
              | eval registry_hive = if(((event.code=\"12\" OR event.code=\"13\" OR event.code=\"14\") AND winlog.event_data.TargetObject=\"HKLM\\\\System\\\\*\"), HKEY_LOCAL_MACHINE\\\\System, if((event.code=\"12\" OR event.code=\"13\" OR event.code=\"14\") AND winlog.event_data.TargetObject=\"HKU\\\\*\"), HKEY_CURRENT_USER, \"\"))
              | eval registry_value_data = if((event.code=\"12\" OR event.code=\"13\" OR event.code=\"14\"), winlog.event_data.Details, \"\")
              | eval registry_value_type = if((event.code=\"12\" OR event.code=\"13\" OR event.code=\"14\"), winlog.event_data.RegistryValueType, \"\")
              | eval action=if((event.code=\"1\" OR event.code=\"3\" OR event.code=\"6\" OR event.code=\"8\" OR event.code=\"9\" OR event.code=\"10\" OR event.code=\"15\" OR event.code=\"17\" OR event.code=\"18\" OR event.code=\"24\" OR event.code=\"25\"), \"allowed\", if((event.code=\"5\"), \"blocked\", if((event.code=\"11\" OR (event.code=\"12\" AND winlog.event_data.EventType=\"CreateKey\") OR event.code=\"19\" OR ((event.code=\"20\" OR event.code=\"21\") AND winlog.event_data.Operation=\"Created\")), \"create\", if((event.code=\"11\" OR (event.code=\"12\" AND winlog.event_data.EventType=\"DeleteKey\") OR ((event.code=\"20\" OR event.code=\"21\") AND winlog.event_data.Operation=\"Deleted\") OR event.code=\"23\" OR event.code=\"26\"), \"delete\", if((event.code=\"2\" OR event.code=\"13\" OR event.code=\"14\"), \"modify\", \"\")))))
              | rename file_name AS winlog.event_data.TargetFilename, file_path AS winlog.event_data.TargetFilename,  timestamp AS event.created, hostname AS winlog.computer_name, user AS winlog.event_data.User, parent_process AS winlog.event_data.ParentCommandLine, file_creation_time AS winlog.event_data.CreationUtcTime
              | fields keep process, process_path, parent_process_path, parent_process_guid, parent_process_id, process_id, process, process_path, process_guid, dest, registry_key, registry_hive, registry_value_data, registry_value_type, action, file_name, file_path, timestamp, hostname, user, parent_process, file_creation_time"
    }
  },
  {
    "id": 102,
    "name": "transform:winlogbeat:extract process exec",
    "description": "Extract process exec field from EndpointProcess fields",
    "function": "PDL_EXPRESSION",
    "definition": {
      "pdl": "eval process_path = if((process_path=\"*\"), (.*\\\\)(?<ProcessExec>(.*(\\.\\w*)$|(\\w+)$)), \"\")
              | eval parent_process_path = if((parent_process_path=\"*\"), (.*\\)(?<ParentProcessExec>(.*(\\.\\w*)$|(\\w+)$)), \"\")"
    }
  },
  {
    "id": 103,
    "name": "transform:endpoint:process exec name",
    "description": "Rename extracted process and parent process exec fields for EndpointProcess",
    "function": "PDL_EXPRESSION",
    "definition": {
      "pdl": "eval process_exec = if(ProcessExec=\"*\", ProcessExec, \"\")
              | eval parent_process_exec = if(ParentProcessExec=\"*\", ParentProcessExec, \"\")"
            }

  }
]