Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Antivirus Maps #236

Merged
merged 5 commits into from
Jun 1, 2024
Merged

Antivirus Maps #236

merged 5 commits into from
Jun 1, 2024

Conversation

reece394
Copy link
Contributor

@reece394 reece394 commented Jun 1, 2024

Description

Added Trellix Endpoint Security Map based on the work from Peter Snyder on McAfee Endpoint Security (Worked without changes beyond the Provider Name)
Added F-Secure Anti-Virus 12 Security Maps (May work on other versions but 12 was the only one tested for these rules)
Added F-Secure Anti-Virus 11 Security Map (May work on other versions but 11 was the only one tested for these rules)

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

  • I have ensured a Provider is listed for the new Map(s) being submitted
  • I have ensured the filename(s) of any new Map(s) being submitted follows the approved format, i.e. Channel-Name_Provider-Name_EventID.map. In summary, all spaces and special characters are replaced with a hyphen with an underscore separates Channel Name, Provider Name, and Event ID
  • I have tested and validated the new Map(s) work with my test data and achieve the desired output
  • I have provided example event data (# Example Event Data:) at the bottom of my Map(s), if possible
  • I have consulted the Guide/Template to ensure my Map(s) follow the same format

Thank you for your submission and for contributing to the DFIR community!

@AndrewRathbun AndrewRathbun self-assigned this Jun 1, 2024
Copy link
Collaborator

@AndrewRathbun AndrewRathbun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good stuff, thank you for your work!

Copy link
Collaborator

@AndrewRathbun AndrewRathbun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Linter should be happy now

@AndrewRathbun AndrewRathbun merged commit b5c15d3 into EricZimmerman:master Jun 1, 2024
5 checks passed
@reece394 reece394 deleted the avmaps branch June 1, 2024 23:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants