{
  "Name": "Windows Security Events",
  "Author": "Microsoft - support@microsoft.com",
  "Logo": "<img src ='https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg' width='75px' height='75px'>",
  "Description": "The Windows Security Events solution for Microsoft Sentinel allows you to ingest Security events from your Windows machines using the Windows Agent into Microsoft Sentinel. This solution includes two (2) data connectors to help ingest the logs.\n\r\n1. **Windows Security Events via AMA** - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Security Events via Legacy Agent** - This data connector helps in ingesting Security Events logs into your Log Analytics Workspace using the legacy Log Analytics agent.",
  "Data Connectors": [
    "Data Connectors/template_SecurityEvents.JSON",
    "Data Connectors/template_WindowsSecurityEvents.JSON"
  ],
  "Analytic Rules": [
    "Analytic Rules/ADFSDBNamedPipeConnection.yaml",
    "Analytic Rules/ADFSRemoteAuthSyncConnection.yaml",
    "Analytic Rules/ADFSRemoteHTTPNetworkConnection.yaml",
    "Analytic Rules/ExcessiveLogonFailures.yaml",
    "Analytic Rules/ExchangeOABVirtualDirectoryAttributeContainingPotentialWebshell.yaml",
    "Analytic Rules/GainCodeExecutionADFSViaSMB.yaml",
    "Analytic Rules/LocalDeviceJoinInfoAndTransportKeyRegKeysAccess.yaml",
    "Analytic Rules/MultipleFailedFollowedBySuccess.yaml",
    "Analytic Rules/NewEXEdeployedviaDefaultDomainorDefaultDomainControllerPolicies.yaml",
    "Analytic Rules/NonDCActiveDirectoryReplication.yaml",
    "Analytic Rules/NRT_base64_encoded_pefile.yaml",
    "Analytic Rules/NRT_execute_base64_decodedpayload.yaml",
    "Analytic Rules/NRT_SecurityEventLogCleared.yaml",
    "Analytic Rules/password_not_set.yaml",
    "Analytic Rules/PotentialFodhelperUACBypass.yaml",
    "Analytic Rules/Potentialre-namedsdeleteusage.yaml",
    "Analytic Rules/ScheduleTaskHide.yaml",
    "Analytic Rules/SdeletedeployedviaGPOandrunrecursively.yaml",
    "Analytic Rules/StartStopHealthService.yaml",
    "Analytic Rules/TimeSeriesAnomaly-ProcessExecutions.yaml",
    "Analytic Rules/WMI-Abuse.yaml"
  ],
  "Workbooks": [
    "Workbooks/EventAnalyzer.json",
    "Workbooks/IdentityAndAccess.json"
  ],
  "Hunting Queries": [
    "Hunting Queries/CommandsexecutedbyWMIonnewhosts-potentialImpacket.yaml",
    "Hunting Queries/Crashdumpdisabledonhost.yaml",
    "Hunting Queries/cscript_summary.yaml",
    "Hunting Queries/CustomUserList_FailedLogons.yaml",
    "Hunting Queries/DecoyUserAccountAuthenticationAttempt.yaml",
    "Hunting Queries/Discorddownloadinvokedfromcmdline.yaml",
    "Hunting Queries/enumeration_user_and_group.yaml",
    "Hunting Queries/ExchangePowerShellSnapin.yaml",
    "Hunting Queries/FailedUserLogons.yaml",
    "Hunting Queries/GroupAddedToPrivlegeGroup.yaml",
    "Hunting Queries/HostExportingMailboxAndRemovingExport.yaml",
    "Hunting Queries/HostsWithNewLogons.yaml",
    "Hunting Queries/Invoke-PowerShellTcpOneLine.yaml",
    "Hunting Queries/Least_Common_Parent_Child_Process.yaml",
    "Hunting Queries/Least_Common_Process_Command_Lines.yaml",
    "Hunting Queries/Least_Common_Process_With_Depth.yaml",
    "Hunting Queries/masquerading_files.yaml",
    "Hunting Queries/MSRPRN_Printer_Bug_Exploitation.yaml",
    "Hunting Queries/MultipleExplicitCredentialUsage4648Events.yaml",
    "Hunting Queries/NewChildProcessOfW3WP.yaml",
    "Hunting Queries/new_processes.yaml",
    "Hunting Queries/NishangReverseTCPShellBase64.yaml",
    "Hunting Queries/persistence_create_account.yaml",
    "Hunting Queries/PowerCatDownload.yaml",
    "Hunting Queries/powershell_downloads.yaml",
    "Hunting Queries/powershell_newencodedscipts.yaml",
    "Hunting Queries/ProcessEntropy.yaml",
    "Hunting Queries/RareProcbyServiceAccount.yaml",
    "Hunting Queries/RareProcessPath.yaml",
    "Hunting Queries/RareProcessWithCmdLine.yaml",
    "Hunting Queries/RareProcess_forWinHost.yaml",
    "Hunting Queries/ServiceInstallationFromUsersWritableDirectory.yaml",
    "Hunting Queries/SuspectedLSASSDump.yaml",
    "Hunting Queries/Suspicious_enumeration_using_adfind.yaml",
    "Hunting Queries/Suspicious_Windows_Login_outside_normal_hours.yaml",
    "Hunting Queries/uncommon_processes.yaml",
    "Hunting Queries/User Logons By Logon Type.yaml",
    "Hunting Queries/UserAccountAddedToPrivlegeGroup.yaml",
    "Hunting Queries/UserAccountCreatedDeleted.yaml",
    "Hunting Queries/UserAdd_RemToGroupByUnauthorizedUser.yaml",
    "Hunting Queries/UserCreatedByUnauthorizedUser.yaml",
    "Hunting Queries/VIPAccountFailedLogons.yaml",
    "Hunting Queries/WindowsSystemTimeChange.yaml",
    "Hunting Queries/CreateDCInstallationMedia.yaml",
    "Hunting Queries/InternalProxies.yaml",
    "Hunting Queries/ADAccountLockouts.yaml",
    "Hunting Queries/KrbRelayUpServiceCreation.yaml",
    "Hunting Queries/RemoteScheduledTaskCreationUpdateviaSchtasks.yaml",
    "Hunting Queries/SuspiciousCommandlineTokenLolbas.yaml",
    "Hunting Queries/WindowsSystemShutdownReboot.yaml"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Windows Security Events\\",
  "Version": "3.0.13",
  "TemplateSpec": true,
  "StaticDataConnector": true,
  "Metadata": "SolutionMetadata.json"
}