diff --git a/microsoft-sentinel/src/openbas_microsoft_sentinel.py b/microsoft-sentinel/src/openbas_microsoft_sentinel.py index 3a9c4ac..5b72471 100644 --- a/microsoft-sentinel/src/openbas_microsoft_sentinel.py +++ b/microsoft-sentinel/src/openbas_microsoft_sentinel.py @@ -96,6 +96,7 @@ def __init__(self): "parent_process_name", "process_name", "command_line", + "command_line_base64", "file_name", "hostname", "ipv4_address", @@ -226,6 +227,12 @@ def _match_alert(self, endpoint, columns_index, alert, expectation): "data": self._extract_command_lines(columns_index, alert), "score": 60, } + elif type == "command_line_base64": + alert_data[type] = { + "type": "fuzzy", + "data": self._extract_command_lines(columns_index, alert), + "score": 60, + } elif type == "file_name": alert_data[type] = { "type": "fuzzy",