EventHorizon/config.json at main · HullaBrian/EventHorizon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
[
	{
		"provider": "Microsoft-Windows-Threat-Intelligence",
		"provider_guid": "{f4e1897c-bb5d-5668-f1d8-040f4d8dd344}",
		"event_names": [
			"KERNEL_THREATINT_TASK_PROTECTVM"
		],
		"enabled": true
	},
	{
		"provider": "Microsoft-Windows-Kernel-Process",
		"provider_guid": "{22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716}",
		"event_names": [
			"ProcessStart"
		],
		"enabled": false
	},
	{
		"provider": "Microsoft-Windows-PowerShell",
		"provider_guid": "{a0c1853b-5c40-4b15-8766-3cf1c58f985a}",
		"event_names": [
			"StartingCommand"
		],
		"enabled": false
	},
	{
		"provider": "Microsoft-Windows-Sysmon",
		"provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
		"event_names": [
			"Registryvalueset(rule:RegistryEvent)"
		],
		"enabled": false
	},
	{
		"provider": "Microsoft-Windows-RPC",
		"provider_guid": "{6AD52B32-D609-4BE9-AE07-CE8DAE937E39}",
		"event_names": [
			"RpcClientCall"
		],
		"enabled": false
	}
]