from typing import Dict, List
from sigma.rule import SigmaLogSource

file_pattern_version: str = "20240809"
ref_sigmahq_logsource_filepattern: Dict[SigmaLogSource, str] = {
    SigmaLogSource(
        category=None,
        product="aws",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "aws",
    SigmaLogSource(
        category=None,
        product="azure",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "azure_",
    SigmaLogSource(
        category=None,
        product="bitbucket",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "bitbucket_audit_",
    SigmaLogSource(
        category=None,
        product="cisco",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "cisco_",
    SigmaLogSource(
        category="application",
        product="django",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "appframework_django_",
    SigmaLogSource(
        category=None,
        product="fortios",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "fortios_",
    SigmaLogSource(
        category=None,
        product="gcp",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "gcp_",
    SigmaLogSource(
        category=None,
        product="github",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "github_",
    SigmaLogSource(
        category=None,
        product="huawei",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "huawei_",
    SigmaLogSource(
        category=None,
        product="juniper",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "juniper_",
    SigmaLogSource(
        category="application",
        product="jvm",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "java_",
    SigmaLogSource(
        category="application",
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "kubernetes_audit_",
    SigmaLogSource(
        category=None,
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "kubernetes_audit_",
    SigmaLogSource(
        category=None,
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_",
    SigmaLogSource(
        category="file_event",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_event_lnx_",
    SigmaLogSource(
        category="network_connection",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "net_connection_lnx_",
    SigmaLogSource(
        category=None,
        product="linux",
        service="auditd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_auditd_",
    SigmaLogSource(
        category=None,
        product="linux",
        service="auth",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_auth_",
    SigmaLogSource(
        category=None,
        product="linux",
        service="clamav",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_clamav",
    SigmaLogSource(
        category=None,
        product="linux",
        service="cron",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_cron_",
    SigmaLogSource(
        category=None,
        product="linux",
        service="guacamole",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_guacamole_",
    SigmaLogSource(
        category=None,
        product="linux",
        service="sshd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_sshd_",
    SigmaLogSource(
        category=None,
        product="linux",
        service="sudo",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_sudo",
    SigmaLogSource(
        category=None,
        product="linux",
        service="syslog",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_syslog_",
    SigmaLogSource(
        category=None,
        product="linux",
        service="vsftpd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "lnx_vsftpd_",
    SigmaLogSource(
        category="process_creation",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "proc_creation_lnx_",
    SigmaLogSource(
        category=None,
        product="m365",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "microsoft365_",
    SigmaLogSource(
        category=None,
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "macos_",
    SigmaLogSource(
        category="file_event",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_event_macos_",
    SigmaLogSource(
        category="process_creation",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "proc_creation_macos_",
    SigmaLogSource(
        category="application",
        product="nodejs",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "nodejs_",
    SigmaLogSource(
        category="antivirus",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "av_",
    SigmaLogSource(
        category="database",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "db_",
    SigmaLogSource(
        category="dns",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "net_dns_",
    SigmaLogSource(
        category="firewall",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "net_firewall_",
    SigmaLogSource(
        category=None,
        product=None,
        service="apache",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "web_apache_",
    SigmaLogSource(
        category=None,
        product=None,
        service="nginx",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "web_nginx_",
    SigmaLogSource(
        category="proxy",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "proxy_",
    SigmaLogSource(
        category="webserver",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "web_",
    SigmaLogSource(
        category=None,
        product="okta",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "okta_",
    SigmaLogSource(
        category=None,
        product="onelogin",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "onelogin_",
    SigmaLogSource(
        category="application",
        product="opencanary",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "opencanary_",
    SigmaLogSource(
        category="appliance",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "paloalto_globalprotect_",
    SigmaLogSource(
        category="file_event",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_event_paloalto_globalprotect_",
    SigmaLogSource(
        category="application",
        product="python",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "app_python_",
    SigmaLogSource(
        category="application",
        product="rpc_firewall",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "rpc_firewall_",
    SigmaLogSource(
        category="application",
        product="ruby_on_rails",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "appframework_ruby_",
    SigmaLogSource(
        category="application",
        product="spring",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "spring_",
    SigmaLogSource(
        category="application",
        product="velocity",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "velocity_",
    SigmaLogSource(
        category="create_remote_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "create_remote_thread_win_",
    SigmaLogSource(
        category="create_stream_hash",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "create_stream_hash_",
    SigmaLogSource(
        category="dns_query",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "dns_query_win_",
    SigmaLogSource(
        category="driver_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "driver_load_win_",
    SigmaLogSource(
        category="file_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_access_win_",
    SigmaLogSource(
        category="file_change",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_change_win_",
    SigmaLogSource(
        category="file_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_delete_win_",
    SigmaLogSource(
        category="file_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_event_win_",
    SigmaLogSource(
        category="file_executable_detected",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_executable_detected_win_",
    SigmaLogSource(
        category="file_rename",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "file_rename_win_",
    SigmaLogSource(
        category="image_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "image_load_",
    SigmaLogSource(
        category="network_connection",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "net_connection_win_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="applocker",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_applocker_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="appmodel-runtime",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_appmodel_runtime_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxdeployment-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_appxdeployment_server_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxpackaging-om",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_appxpackaging_om_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="bits-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_bits_client_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="capi2",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_capi2_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="certificateservicesclient-lifecycle-system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_certificateservicesclient_lifecycle_system_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="codeintegrity-operational",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_codeintegrity_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="diagnosis-scripted",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_diagnosis_scripted",
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_dns_client",
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_dns_server",
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server-analytic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_dns_analytic_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="firewall-as",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_firewall_as_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="ldap",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_ldap_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="lsa-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_lsa_server_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="msexchange-management",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_exchange_",
    SigmaLogSource(
        category=None,
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="openssh",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_sshd_openssh_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="powershell-classic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "posh_pc_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_security_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="security-mitigations",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_security_mitigations_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="shell-core",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_shell_core",
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-connectivity",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_smbclient_connectivity_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_smbclient_security_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="sysmon",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "sysmon_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_system_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="taskscheduler",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_taskscheduler_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="terminalservices-localsessionmanager",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_terminalservices_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="windefend",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_defender_",
    SigmaLogSource(
        category=None,
        product="windows",
        service="wmi",
        definition=None,
        source=None,
        custom_attributes=None,
    ): "win_wmi_",
    SigmaLogSource(
        category="pipe_created",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "pipe_created_",
    SigmaLogSource(
        category="process_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "proc_access_win_",
    SigmaLogSource(
        category="process_creation",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "proc_creation_win_",
    SigmaLogSource(
        category="process_tampering",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "proc_tampering_",
    SigmaLogSource(
        category="ps_classic_provider_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "posh_pc_",
    SigmaLogSource(
        category="ps_classic_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "posh_pc_",
    SigmaLogSource(
        category="ps_module",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "posh_pm_",
    SigmaLogSource(
        category="ps_script",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "posh_ps_",
    SigmaLogSource(
        category="raw_access_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "raw_access_thread_",
    SigmaLogSource(
        category="registry_add",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "registry_add_",
    SigmaLogSource(
        category="registry_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "registry_delete_",
    SigmaLogSource(
        category="registry_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "registry_event_",
    SigmaLogSource(
        category="registry_set",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "registry_set_",
    SigmaLogSource(
        category="sysmon_error",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "sysmon_",
    SigmaLogSource(
        category="sysmon_status",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "sysmon_",
    SigmaLogSource(
        category="wmi_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "sysmon_wmi_",
    SigmaLogSource(
        category=None,
        product="zeek",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "zeek_",
}

taxonomy_version: str = "20250422"
ref_sigmahq_fieldsname: Dict[SigmaLogSource, List[str]] = {
    SigmaLogSource(
        category=None,
        product="zeek",
        service="x509",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="rdp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="smb_files",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="http",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="kerberos",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="dce_rpc",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="dns",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="sysmon_status",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "Configuration",
        "ConfigurationFileHash",
        "EventID",
        "Provider_Name",
        "SchemaVersion",
        "Security_UserID",
        "State",
        "Version",
    ],
    SigmaLogSource(
        category="wmi_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "Consumer",
        "Destination",
        "EventID",
        "EventNamespace",
        "EventType",
        "Filter",
        "Name",
        "Operation",
        "Provider_Name",
        "Query",
        "Security_UserID",
        "Type",
        "User",
    ],
    SigmaLogSource(
        category="registry_set",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "Details",
        "EventID",
        "EventType",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetObject",
        "User",
    ],
    SigmaLogSource(
        category="sysmon_error",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="registry_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "Details",
        "EventID",
        "EventType",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetObject",
    ],
    SigmaLogSource(
        category="registry_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "Details",
        "EventID",
        "EventType",
        "Image",
        "NewName",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetObject",
        "User",
    ],
    SigmaLogSource(
        category="raw_access_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "Device",
        "EventID",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "User",
    ],
    SigmaLogSource(
        category="registry_add",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "EventType",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetObject",
        "User",
    ],
    SigmaLogSource(
        category="ps_module",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "ContextInfo",
        "EventID",
        "Payload",
        "Provider_Name",
        "Security_UserID",
        "UserData",
    ],
    SigmaLogSource(
        category="ps_script",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "MessageNumber",
        "MessageTotal",
        "Path",
        "Provider_Name",
        "ScriptBlockId",
        "ScriptBlockText",
        "Security_UserID",
    ],
    SigmaLogSource(
        category="ps_classic_provider_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="ps_classic_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="process_creation",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "CommandLine",
        "Company",
        "Computer",
        "CurrentDirectory",
        "Description",
        "EventID",
        "FileVersion",
        "GrandParentImage",
        "Hashes",
        "Image",
        "IntegrityLevel",
        "LogonGuid",
        "LogonId",
        "OriginalFileName",
        "ParentCommandLine",
        "ParentImage",
        "ParentProcessGuid",
        "ParentProcessId",
        "ParentUser",
        "ProcessGuid",
        "ProcessId",
        "Product",
        "Provider_Name",
        "Security_UserID",
        "TerminalSessionId",
        "User",
        "GrandparentCommandLine",
        "Imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="process_tampering",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "Type",
        "User",
    ],
    SigmaLogSource(
        category="pipe_created",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "EventType",
        "Image",
        "PipeName",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "User",
    ],
    SigmaLogSource(
        category="process_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "CallTrace",
        "Channel",
        "Computer",
        "EventID",
        "GrantedAccess",
        "Provider_Name",
        "Security_UserID",
        "SourceImage",
        "SourceProcessGUID",
        "SourceProcessId",
        "SourceThreadId",
        "SourceUser",
        "TargetImage",
        "TargetProcessGUID",
        "TargetProcessId",
        "TargetUser",
        "CallTraceExtended",
        "SourceCommandLine",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="windefend",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="wmi",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="taskscheduler",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "Path",
        "Priority",
        "ProcessID",
        "Provider_Name",
        "Security_UserID",
        "TaskName",
        "UserContext",
        "UserName",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="terminalservices-localsessionmanager",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Address",
        "Channel",
        "Computer",
        "EventID",
        "Provider_Name",
        "Security_UserID",
        "SessionID",
        "User",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="sysmon",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-connectivity",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "ObjectName",
        "ObjectNameLength",
        "Provider_Name",
        "Reason",
        "Security_UserID",
        "ServerName",
        "ServerNameLength",
        "ShareName",
        "ShareNameLength",
        "Status",
        "UserName",
        "UserNameLength",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="security-mitigations",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "ImageName",
        "ImageNameLength",
        "ProcessCommandLine",
        "ProcessCommandLineLength",
        "ProcessCreateTime",
        "ProcessId",
        "ProcessPath",
        "ProcessPathLength",
        "ProcessProtection",
        "ProcessSectionSignatureLevel",
        "ProcessSignatureLevel",
        "ProcessStartKey",
        "Provider_Name",
        "RequiredSignatureLevel",
        "Security_UserID",
        "SignatureLevel",
        "TargetThreadCreateTime",
        "TargetThreadId",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="shell-core",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "AppID",
        "Channel",
        "Computer",
        "EventID",
        "Flags",
        "Name",
        "Provider_Name",
        "Security_UserID",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="printservice-operational",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="powershell-classic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="printservice-admin",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="ntlm",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "CallerPID",
        "Channel",
        "ClientDomainName",
        "ClientLUID",
        "ClientUserName",
        "Computer",
        "DomainName",
        "EventID",
        "MechanismOID",
        "ProcessName",
        "Provider_Name",
        "SChannelName",
        "SChannelType",
        "Security_UserID",
        "TargetName",
        "UserName",
        "WorkstationName",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="openssh",
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Channel", "Computer", "EventID", "Provider_Name", "Security_UserID", "payload", "process"],
    SigmaLogSource(
        category=None,
        product="windows",
        service="msexchange-management",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="lsa-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventCountTotal",
        "EventID",
        "EventOrginal",
        "Provider_Name",
        "Security_UserID",
        "SidList",
        "TargetDomainName",
        "TargetLogonGuid",
        "TargetLogonId",
        "TargetUserName",
        "TargetUserSid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="microsoft-servicebus-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="iis-configuration",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "PhysicalPath",
        "ConfigPath",
        "EffectiveLocationPath",
        "EventID",
        "Configuration",
        "TokenCacheModule",
        "EditOperationType",
        "OldValue",
        "NewValue",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="ldap",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "AttributeList",
        "Channel",
        "Computer",
        "DistinguishedName",
        "EventID",
        "ProcessId",
        "Provider_Name",
        "ScopeOfSearch",
        "SearchFilter",
        "Security_UserID",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="driver-framework",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="firewall-as",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Action",
        "ApplicationPath",
        "Channel",
        "Computer",
        "EventID",
        "ModifyingApplication",
        "Provider_Name",
        "Security_UserID",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server-analytic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="diagnosis-scripted",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "PackageId",
        "PackagePath",
        "Provider_Name",
        "Security_UserID",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Address",
        "AddressLength",
        "Channel",
        "ClientPID",
        "Computer",
        "DnsServerIpAddress",
        "EventID",
        "InterfaceIndex",
        "NetworkIndex",
        "Provider_Name",
        "QueryBlob",
        "QueryName",
        "QueryOptions",
        "QueryResults",
        "QueryStatus",
        "QueryType",
        "ResponseStatus",
        "Security_UserID",
        "SendBlob",
        "SendBlobContext",
        "Status",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="certificateservicesclient-lifecycle-system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="codeintegrity-operational",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "FileDescription",
        "FileDescriptionLength",
        "FileName",
        "FileNameBuffer",
        "FileNameLength",
        "FileVersion",
        "InternalName",
        "InternalNameLength",
        "OriginalFileName",
        "OriginalFileNameLength",
        "PackageFamilyName",
        "PackageFamilyNameLength",
        "PolicyGUID",
        "PolicyHash",
        "PolicyHashSize",
        "PolicyID",
        "PolicyIDLength",
        "PolicyName",
        "PolicyNameLength",
        "ProcessName",
        "ProcessNameBuffer",
        "ProcessNameLength",
        "ProcessNameLength",
        "ProductName",
        "ProductNameLength",
        "Provider_Name",
        "RequestedPolicy",
        "RequestedSigningLevel",
        "Security_UserID",
        "SHA1FlatHash",
        "SHA1FlatHashSize",
        "SHA1Hash",
        "SHA1HashSize",
        "SHA256FlatHash",
        "SHA256FlatHashSize",
        "SHA256Hash",
        "SHA256HashSize",
        "SISigningScenario",
        "Status",
        "Status",
        "UserWriteable",
        "USN",
        "ValidatedPolicy",
        "ValidatedSigningLevel",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="bits-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "LocalName",
        "Provider_Name",
        "RemoteName",
        "Security_UserID",
        "processId",
        "processPath",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="capi2",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxdeployment-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "AppId",
        "CallingProcess",
        "Channel",
        "Computer",
        "DeploymentOperation",
        "ErrorCode",
        "EventID",
        "FilePath",
        "PackageDisplayName",
        "PackageFullName",
        "PackageSourceUri",
        "Path",
        "Provider_Name",
        "Security_UserID",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxpackaging-om",
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Channel", "Computer", "EventID", "Provider_Name", "Security_UserID", "subjectName"],
    SigmaLogSource(
        category=None,
        product="windows",
        service="applocker",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="appmodel-runtime",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "ApplicationName",
        "Channel",
        "Computer",
        "EventID",
        "ImageName",
        "Message",
        "PackageName",
        "ProcessID",
        "Provider_Name",
        "Security_UserID",
    ],
    SigmaLogSource(
        category="network_connection",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "DestinationHostname",
        "DestinationIp",
        "DestinationIsIpv6",
        "DestinationPort",
        "DestinationPortName",
        "EventID",
        "Image",
        "Initiated",
        "ProcessGuid",
        "ProcessId",
        "Protocol",
        "Provider_Name",
        "Security_UserID",
        "SourceHostname",
        "SourceIp",
        "SourceIsIpv6",
        "SourcePort",
        "SourcePortName",
        "User",
        "CommandLine",
        "ParentImage",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="application",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_rename",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "ExtraInformation",
        "FileKey",
        "FileObject",
        "FilePath",
        "InfoClass",
        "Irp",
        "IssuingThreadId",
        "Provider_Name",
        "Security_UserID",
        "CommandLine",
        "Image",
        "MagicHeader",
        "OriginalFileName",
        "ParentCommandLine",
        "ParentImage",
        "SourceFilename",
        "TargetFilename",
        "User",
    ],
    SigmaLogSource(
        category="image_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Company",
        "Computer",
        "Description",
        "EventID",
        "FileVersion",
        "Hashes",
        "Image",
        "ImageLoaded",
        "OriginalFileName",
        "ProcessGuid",
        "ProcessId",
        "Product",
        "Provider_Name",
        "Security_UserID",
        "Signature",
        "SignatureStatus",
        "Signed",
        "User",
        "CommandLine",
        "Imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="file_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "CreationUtcTime",
        "EventID",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetFilename",
        "User",
        "CommandLine",
        "IntegrityLevel",
        "MagicHeader",
        "ParentCommandLine",
        "ParentImage",
    ],
    SigmaLogSource(
        category="file_executable_detected",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "Hashes",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetFilename",
        "User",
        "Imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="file_change",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "CreationUtcTime",
        "EventID",
        "Image",
        "PreviousCreationUtcTime",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetFilename",
        "User",
    ],
    SigmaLogSource(
        category="file_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Archived",
        "Channel",
        "Computer",
        "EventID",
        "Hashes",
        "Image",
        "IsExecutable",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetFilename",
        "User",
        "CommandLine",
        "Imphash",
        "ParentCommandLine",
        "ParentImage",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="driver_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "Hashes",
        "ImageLoaded",
        "Provider_Name",
        "Security_UserID",
        "Signature",
        "SignatureStatus",
        "Signed",
        "Imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="file_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "CreateAttributes",
        "CreateOptions",
        "EventID",
        "FileName",
        "FileObject",
        "Irp",
        "IssuingThreadId",
        "Provider_Name",
        "Security_UserID",
        "ShareAccess",
        "CommandLine",
        "Image",
        "ParentCommandLine",
        "ParentImage",
        "TargetFilename",
        "User",
    ],
    SigmaLogSource(
        category="create_stream_hash",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "Contents",
        "CreationUtcTime",
        "EventID",
        "Hash",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "Security_UserID",
        "TargetFilename",
        "User",
        "Imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="dns_query",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "Image",
        "ProcessGuid",
        "ProcessId",
        "Provider_Name",
        "QueryName",
        "QueryResults",
        "QueryStatus",
        "Security_UserID",
        "User",
    ],
    SigmaLogSource(
        category="application",
        product="velocity",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="create_remote_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Channel",
        "Computer",
        "EventID",
        "NewThreadId",
        "Provider_Name",
        "Security_UserID",
        "SourceImage",
        "SourceProcessGuid",
        "SourceProcessId",
        "SourceUser",
        "StartAddress",
        "StartFunction",
        "StartModule",
        "TargetCommandLine",
        "TargetImage",
        "TargetProcessGuid",
        "TargetProcessId",
        "TargetUser",
        "IsInitialThread",
        "RemoteCreation",
        "SourceCommandLine",
        "SourceParentCommandLine",
        "SourceParentImage",
        "SourceParentProcessId",
        "TargetParentCommandLine",
        "TargetParentImage",
        "TargetParentProcessId",
        "User",
    ],
    SigmaLogSource(
        category="application",
        product="spring",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="sql",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="rpc_firewall",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="ruby_on_rails",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="python",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="qualys",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="appliance",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_event",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="onelogin",
        service="onelogin.events",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="opencanary",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="webserver",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "c-ip",
        "cs-bytes",
        "cs-cookie",
        "cs-host",
        "cs-method",
        "cs-method",
        "cs-referer",
        "cs-uri-query",
        "cs-uri-stem",
        "cs-user-agent",
        "cs-username",
        "cs-version",
        "date",
        "s-computername",
        "s-ip",
        "s-port",
        "s-sitename",
        "sc-bytes",
        "sc-status",
        "sc-win32-status",
        "time",
        "time-taken",
    ],
    SigmaLogSource(
        category=None,
        product="okta",
        service="okta",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product=None,
        service="nginx",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="proxy",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "c-uri",
        "c-uri-extension",
        "c-uri-query",
        "c-uri-stem",
        "c-useragent",
        "cs-bytes",
        "cs-cookie",
        "cs-host",
        "cs-method",
        "cs-referrer",
        "cs-uri",
        "cs-version",
        "dst_ip",
        "r-dns",
        "sc-bytes",
        "sc-status",
        "src_ip",
    ],
    SigmaLogSource(
        category=None,
        product=None,
        service="apache",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product=None,
        service="netflow",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="dns",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="firewall",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="antivirus",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="database",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="process_creation",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "CommandLine",
        "Company",
        "CurrentDirectory",
        "Description",
        "FileVersion",
        "Hashes",
        "Image",
        "IntegrityLevel",
        "LogonGuid",
        "LogonId",
        "OriginalFileName",
        "ParentCommandLine",
        "ParentImage",
        "ParentProcessGuid",
        "ParentProcessId",
        "ParentUser",
        "ProcessGuid",
        "ProcessId",
        "Product",
        "TerminalSessionId",
        "User",
        "Imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="application",
        product="nodejs",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="m365",
        service="threat_management",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_event",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["CreationUtcTime", "Image", "ProcessGuid", "ProcessId", "TargetFilename", "User"],
    SigmaLogSource(
        category=None,
        product="m365",
        service="exchange",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="m365",
        service="threat_detection",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="process_creation",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "CommandLine",
        "Company",
        "CurrentDirectory",
        "Description",
        "FileVersion",
        "Hashes",
        "Image",
        "IntegrityLevel",
        "LogonGuid",
        "LogonId",
        "OriginalFileName",
        "ParentCommandLine",
        "ParentImage",
        "ParentProcessGuid",
        "ParentProcessId",
        "ParentUser",
        "ProcessGuid",
        "ProcessId",
        "Product",
        "TerminalSessionId",
        "User",
        "Imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category=None,
        product="m365",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="syslog",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="vsftpd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="sshd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="sudo",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="guacamole",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="clamav",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="cron",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="auditd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "a0",
        "a1",
        "a2",
        "a3",
        "a4",
        "a5",
        "a6",
        "a7",
        "a8",
        "a9",
        "acct",
        "acl",
        "action",
        "added",
        "addr",
        "apparmor",
        "arch",
        "argc",
        "audit_backlog_limit",
        "audit_backlog_wait_time",
        "audit_enabled",
        "audit_failure",
        "auid",
        "banners",
        "bool",
        "bus",
        "cap_fe,cap_fi",
        "cap_fp",
        "cap_fver",
        "cap_pa",
        "cap_pe",
        "cap_pi",
        "cap_pp",
        "capability",
        "category",
        "cgroup",
        "changed",
        "cipher",
        "class",
        "cmd",
        "code",
        "comm",
        "compat",
        "cwd",
        "daddr",
        "data",
        "default-context",
        "dev",
        "dev",
        "device",
        "dir",
        "direction",
        "dmac",
        "dport",
        "egid",
        "enforcing",
        "entries",
        "errno",
        "euid",
        "exe",
        "exit",
        "fam",
        "family",
        "fd",
        "fe",
        "feature",
        "fi",
        "file",
        "flags",
        "format",
        "fp",
        "fsgid",
        "fsuid",
        "fver",
        "gid",
        "grantors",
        "grp",
        "hook",
        "hostname",
        "icmp_type",
        "id",
        "igid",
        "img-ctx",
        "inif",
        "ino",
        "inode",
        "inode_gid",
        "inode_uid",
        "invalid_context",
        "ioctlcmd",
        "ip",
        "ipid",
        "ipx-net",
        "item",
        "items",
        "iuid",
        "kernel",
        "key",
        "kind",
        "ksize",
        "laddr",
        "len",
        "list",
        "lport",
        "mac",
        "macproto",
        "maj",
        "major",
        "minor",
        "mode",
        "model",
        "msg",
        "name",
        "nametype",
        "nargs",
        "net",
        "new",
        "new-chardev",
        "new-disk",
        "new-enabled",
        "new-fs",
        "new-level",
        "new-log_passwd",
        "new-mem",
        "new-net",
        "new-range",
        "new-rng",
        "new-role",
        "new-seuser",
        "new-vcpu",
        "new_gid",
        "new_lock",
        "new_pe",
        "new_pi",
        "new_pp",
        "nlnk-fam",
        "nlnk-grp",
        "nlnk-pid",
        "oauid",
        "obj",
        "obj_gid",
        "obj_uid",
        "ocomm",
        "oflag",
        "ogid",
        "old",
        "old-auid",
        "old-chardev",
        "old-disk",
        "old-enabled",
        "old-fs",
        "old-level",
        "old-log_passwd",
        "old-mem",
        "old-net",
        "old-range",
        "old-rng",
        "old-role",
        "old-ses",
        "old-seuser",
        "old-vcpu",
        "old_enforcing",
        "old_lock",
        "old_pa",
        "old_pe",
        "old_pi",
        "old_pp",
        "old_prom",
        "old_val",
        "op",
        "opid",
        "oses",
        "ouid",
        "outif",
        "pa",
        "parent",
        "path",
        "pe",
        "per",
        "perm",
        "perm_mask",
        "permissive",
        "pfs",
        "pi",
        "pid",
        "pp",
        "ppid",
        "printer",
        "proctitle",
        "prom",
        "proto",
        "qbytes",
        "range",
        "rdev",
        "reason",
        "removed",
        "res",
        "resrc",
        "result",
        "role",
        "rport",
        "saddr",
        "sauid",
        "scontext",
        "selected-context",
        "seperm",
        "seperms",
        "seqno",
        "seresult",
        "ses",
        "seuser",
        "sgid",
        "sig",
        "sigev_signo",
        "smac",
        "spid",
        "sport",
        "state",
        "subj",
        "success",
        "suid",
        "syscall",
        "table",
        "tclass",
        "tcontext",
        "terminal",
        "tty",
        "type",
        "uid",
        "unit",
        "uri",
        "user",
        "uuid",
        "val",
        "val",
        "ver",
        "virt",
        "vm",
        "vm-ctx",
        "vm-pid",
        "watch",
    ],
    SigmaLogSource(
        category=None,
        product="linux",
        service="auth",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_event",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["CreationUtcTime", "Image", "ProcessGuid", "ProcessId", "TargetFilename", "User"],
    SigmaLogSource(
        category="network_connection",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "DestinationHostname",
        "DestinationIp",
        "DestinationIsIpv6",
        "DestinationPort",
        "DestinationPortName",
        "Image",
        "Initiated",
        "ProcessGuid",
        "ProcessId",
        "Protocol",
        "SourceHostname",
        "SourceIp",
        "SourceIsIpv6",
        "SourcePort",
        "SourcePortName",
        "User",
    ],
    SigmaLogSource(
        category="application",
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="juniper",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="jvm",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="github",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="huawei",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="gcp",
        service="gcp.audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="gcp",
        service="google_workspace.admin",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="django",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="fortios",
        service="sslvpnd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="ldp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="syslog",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="duo",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="bitbucket",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="aaa",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="riskdetection",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="signinlogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="auditlogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="pim",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="aws",
        service="cloudtrail",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="activitylogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
}
ref_sigmahq_fieldsname_unicast: Dict[SigmaLogSource, List[str]] = {
    SigmaLogSource(
        category=None,
        product="zeek",
        service="x509",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="rdp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="smb_files",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="http",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="kerberos",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="dce_rpc",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="zeek",
        service="dns",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="sysmon_status",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "configuration",
        "configurationfilehash",
        "eventid",
        "provider_name",
        "schemaversion",
        "security_userid",
        "state",
        "version",
    ],
    SigmaLogSource(
        category="wmi_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "consumer",
        "destination",
        "eventid",
        "eventnamespace",
        "eventtype",
        "filter",
        "name",
        "operation",
        "provider_name",
        "query",
        "security_userid",
        "type",
        "user",
    ],
    SigmaLogSource(
        category="registry_set",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "details",
        "eventid",
        "eventtype",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetobject",
        "user",
    ],
    SigmaLogSource(
        category="sysmon_error",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="registry_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "details",
        "eventid",
        "eventtype",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetobject",
    ],
    SigmaLogSource(
        category="registry_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "details",
        "eventid",
        "eventtype",
        "image",
        "newname",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetobject",
        "user",
    ],
    SigmaLogSource(
        category="raw_access_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "device",
        "eventid",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "user",
    ],
    SigmaLogSource(
        category="registry_add",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "eventtype",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetobject",
        "user",
    ],
    SigmaLogSource(
        category="ps_module",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "contextinfo",
        "eventid",
        "payload",
        "provider_name",
        "security_userid",
        "userdata",
    ],
    SigmaLogSource(
        category="ps_script",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "messagenumber",
        "messagetotal",
        "path",
        "provider_name",
        "scriptblockid",
        "scriptblocktext",
        "security_userid",
    ],
    SigmaLogSource(
        category="ps_classic_provider_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="ps_classic_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="process_creation",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "commandline",
        "company",
        "computer",
        "currentdirectory",
        "description",
        "eventid",
        "fileversion",
        "grandparentimage",
        "hashes",
        "image",
        "integritylevel",
        "logonguid",
        "logonid",
        "originalfilename",
        "parentcommandline",
        "parentimage",
        "parentprocessguid",
        "parentprocessid",
        "parentuser",
        "processguid",
        "processid",
        "product",
        "provider_name",
        "security_userid",
        "terminalsessionid",
        "user",
        "grandparentcommandline",
        "imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="process_tampering",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "type",
        "user",
    ],
    SigmaLogSource(
        category="pipe_created",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "eventtype",
        "image",
        "pipename",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "user",
    ],
    SigmaLogSource(
        category="process_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "calltrace",
        "channel",
        "computer",
        "eventid",
        "grantedaccess",
        "provider_name",
        "security_userid",
        "sourceimage",
        "sourceprocessguid",
        "sourceprocessid",
        "sourcethreadid",
        "sourceuser",
        "targetimage",
        "targetprocessguid",
        "targetprocessid",
        "targetuser",
        "calltraceextended",
        "sourcecommandline",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="windefend",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="wmi",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="taskscheduler",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "path",
        "priority",
        "processid",
        "provider_name",
        "security_userid",
        "taskname",
        "usercontext",
        "username",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="terminalservices-localsessionmanager",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "address",
        "channel",
        "computer",
        "eventid",
        "provider_name",
        "security_userid",
        "sessionid",
        "user",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="sysmon",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-connectivity",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "objectname",
        "objectnamelength",
        "provider_name",
        "reason",
        "security_userid",
        "servername",
        "servernamelength",
        "sharename",
        "sharenamelength",
        "status",
        "username",
        "usernamelength",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="security-mitigations",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "imagename",
        "imagenamelength",
        "processcommandline",
        "processcommandlinelength",
        "processcreatetime",
        "processid",
        "processpath",
        "processpathlength",
        "processprotection",
        "processsectionsignaturelevel",
        "processsignaturelevel",
        "processstartkey",
        "provider_name",
        "requiredsignaturelevel",
        "security_userid",
        "signaturelevel",
        "targetthreadcreatetime",
        "targetthreadid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="shell-core",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "appid",
        "channel",
        "computer",
        "eventid",
        "flags",
        "name",
        "provider_name",
        "security_userid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="printservice-operational",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="powershell-classic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="printservice-admin",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="ntlm",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "callerpid",
        "channel",
        "clientdomainname",
        "clientluid",
        "clientusername",
        "computer",
        "domainname",
        "eventid",
        "mechanismoid",
        "processname",
        "provider_name",
        "schannelname",
        "schanneltype",
        "security_userid",
        "targetname",
        "username",
        "workstationname",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="openssh",
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["channel", "computer", "eventid", "provider_name", "security_userid", "payload", "process"],
    SigmaLogSource(
        category=None,
        product="windows",
        service="msexchange-management",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="lsa-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventcounttotal",
        "eventid",
        "eventorginal",
        "provider_name",
        "security_userid",
        "sidlist",
        "targetdomainname",
        "targetlogonguid",
        "targetlogonid",
        "targetusername",
        "targetusersid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="microsoft-servicebus-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="iis-configuration",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "physicalpath",
        "configpath",
        "effectivelocationpath",
        "eventid",
        "configuration",
        "tokencachemodule",
        "editoperationtype",
        "oldvalue",
        "newvalue",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="ldap",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "attributelist",
        "channel",
        "computer",
        "distinguishedname",
        "eventid",
        "processid",
        "provider_name",
        "scopeofsearch",
        "searchfilter",
        "security_userid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="driver-framework",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="firewall-as",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "action",
        "applicationpath",
        "channel",
        "computer",
        "eventid",
        "modifyingapplication",
        "provider_name",
        "security_userid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server-analytic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="diagnosis-scripted",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "packageid",
        "packagepath",
        "provider_name",
        "security_userid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "address",
        "addresslength",
        "channel",
        "clientpid",
        "computer",
        "dnsserveripaddress",
        "eventid",
        "interfaceindex",
        "networkindex",
        "provider_name",
        "queryblob",
        "queryname",
        "queryoptions",
        "queryresults",
        "querystatus",
        "querytype",
        "responsestatus",
        "security_userid",
        "sendblob",
        "sendblobcontext",
        "status",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="certificateservicesclient-lifecycle-system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="codeintegrity-operational",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "filedescription",
        "filedescriptionlength",
        "filename",
        "filenamebuffer",
        "filenamelength",
        "fileversion",
        "internalname",
        "internalnamelength",
        "originalfilename",
        "originalfilenamelength",
        "packagefamilyname",
        "packagefamilynamelength",
        "policyguid",
        "policyhash",
        "policyhashsize",
        "policyid",
        "policyidlength",
        "policyname",
        "policynamelength",
        "processname",
        "processnamebuffer",
        "processnamelength",
        "processnamelength",
        "productname",
        "productnamelength",
        "provider_name",
        "requestedpolicy",
        "requestedsigninglevel",
        "security_userid",
        "sha1flathash",
        "sha1flathashsize",
        "sha1hash",
        "sha1hashsize",
        "sha256flathash",
        "sha256flathashsize",
        "sha256hash",
        "sha256hashsize",
        "sisigningscenario",
        "status",
        "status",
        "userwriteable",
        "usn",
        "validatedpolicy",
        "validatedsigninglevel",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="bits-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "localname",
        "provider_name",
        "remotename",
        "security_userid",
        "processid",
        "processpath",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="capi2",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxdeployment-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "appid",
        "callingprocess",
        "channel",
        "computer",
        "deploymentoperation",
        "errorcode",
        "eventid",
        "filepath",
        "packagedisplayname",
        "packagefullname",
        "packagesourceuri",
        "path",
        "provider_name",
        "security_userid",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxpackaging-om",
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["channel", "computer", "eventid", "provider_name", "security_userid", "subjectname"],
    SigmaLogSource(
        category=None,
        product="windows",
        service="applocker",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="windows",
        service="appmodel-runtime",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "applicationname",
        "channel",
        "computer",
        "eventid",
        "imagename",
        "message",
        "packagename",
        "processid",
        "provider_name",
        "security_userid",
    ],
    SigmaLogSource(
        category="network_connection",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "destinationhostname",
        "destinationip",
        "destinationisipv6",
        "destinationport",
        "destinationportname",
        "eventid",
        "image",
        "initiated",
        "processguid",
        "processid",
        "protocol",
        "provider_name",
        "security_userid",
        "sourcehostname",
        "sourceip",
        "sourceisipv6",
        "sourceport",
        "sourceportname",
        "user",
        "commandline",
        "parentimage",
    ],
    SigmaLogSource(
        category=None,
        product="windows",
        service="application",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_rename",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "extrainformation",
        "filekey",
        "fileobject",
        "filepath",
        "infoclass",
        "irp",
        "issuingthreadid",
        "provider_name",
        "security_userid",
        "commandline",
        "image",
        "magicheader",
        "originalfilename",
        "parentcommandline",
        "parentimage",
        "sourcefilename",
        "targetfilename",
        "user",
    ],
    SigmaLogSource(
        category="image_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "company",
        "computer",
        "description",
        "eventid",
        "fileversion",
        "hashes",
        "image",
        "imageloaded",
        "originalfilename",
        "processguid",
        "processid",
        "product",
        "provider_name",
        "security_userid",
        "signature",
        "signaturestatus",
        "signed",
        "user",
        "commandline",
        "imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="file_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "creationutctime",
        "eventid",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetfilename",
        "user",
        "commandline",
        "integritylevel",
        "magicheader",
        "parentcommandline",
        "parentimage",
    ],
    SigmaLogSource(
        category="file_executable_detected",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "hashes",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetfilename",
        "user",
        "imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="file_change",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "creationutctime",
        "eventid",
        "image",
        "previouscreationutctime",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetfilename",
        "user",
    ],
    SigmaLogSource(
        category="file_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "archived",
        "channel",
        "computer",
        "eventid",
        "hashes",
        "image",
        "isexecutable",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetfilename",
        "user",
        "commandline",
        "imphash",
        "parentcommandline",
        "parentimage",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="driver_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "hashes",
        "imageloaded",
        "provider_name",
        "security_userid",
        "signature",
        "signaturestatus",
        "signed",
        "imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="file_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "createattributes",
        "createoptions",
        "eventid",
        "filename",
        "fileobject",
        "irp",
        "issuingthreadid",
        "provider_name",
        "security_userid",
        "shareaccess",
        "commandline",
        "image",
        "parentcommandline",
        "parentimage",
        "targetfilename",
        "user",
    ],
    SigmaLogSource(
        category="create_stream_hash",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "contents",
        "creationutctime",
        "eventid",
        "hash",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "security_userid",
        "targetfilename",
        "user",
        "imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="dns_query",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "image",
        "processguid",
        "processid",
        "provider_name",
        "queryname",
        "queryresults",
        "querystatus",
        "security_userid",
        "user",
    ],
    SigmaLogSource(
        category="application",
        product="velocity",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="create_remote_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "channel",
        "computer",
        "eventid",
        "newthreadid",
        "provider_name",
        "security_userid",
        "sourceimage",
        "sourceprocessguid",
        "sourceprocessid",
        "sourceuser",
        "startaddress",
        "startfunction",
        "startmodule",
        "targetcommandline",
        "targetimage",
        "targetprocessguid",
        "targetprocessid",
        "targetuser",
        "isinitialthread",
        "remotecreation",
        "sourcecommandline",
        "sourceparentcommandline",
        "sourceparentimage",
        "sourceparentprocessid",
        "targetparentcommandline",
        "targetparentimage",
        "targetparentprocessid",
        "user",
    ],
    SigmaLogSource(
        category="application",
        product="spring",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="sql",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="rpc_firewall",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="ruby_on_rails",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="python",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="qualys",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="appliance",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_event",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="onelogin",
        service="onelogin.events",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="opencanary",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="webserver",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "c-ip",
        "cs-bytes",
        "cs-cookie",
        "cs-host",
        "cs-method",
        "cs-method",
        "cs-referer",
        "cs-uri-query",
        "cs-uri-stem",
        "cs-user-agent",
        "cs-username",
        "cs-version",
        "date",
        "s-computername",
        "s-ip",
        "s-port",
        "s-sitename",
        "sc-bytes",
        "sc-status",
        "sc-win32-status",
        "time",
        "time-taken",
    ],
    SigmaLogSource(
        category=None,
        product="okta",
        service="okta",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product=None,
        service="nginx",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="proxy",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "c-uri",
        "c-uri-extension",
        "c-uri-query",
        "c-uri-stem",
        "c-useragent",
        "cs-bytes",
        "cs-cookie",
        "cs-host",
        "cs-method",
        "cs-referrer",
        "cs-uri",
        "cs-version",
        "dst_ip",
        "r-dns",
        "sc-bytes",
        "sc-status",
        "src_ip",
    ],
    SigmaLogSource(
        category=None,
        product=None,
        service="apache",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product=None,
        service="netflow",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="dns",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="firewall",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="antivirus",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="database",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="process_creation",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "commandline",
        "company",
        "currentdirectory",
        "description",
        "fileversion",
        "hashes",
        "image",
        "integritylevel",
        "logonguid",
        "logonid",
        "originalfilename",
        "parentcommandline",
        "parentimage",
        "parentprocessguid",
        "parentprocessid",
        "parentuser",
        "processguid",
        "processid",
        "product",
        "terminalsessionid",
        "user",
        "imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category="application",
        product="nodejs",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="m365",
        service="threat_management",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_event",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["creationutctime", "image", "processguid", "processid", "targetfilename", "user"],
    SigmaLogSource(
        category=None,
        product="m365",
        service="exchange",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="m365",
        service="threat_detection",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="process_creation",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "commandline",
        "company",
        "currentdirectory",
        "description",
        "fileversion",
        "hashes",
        "image",
        "integritylevel",
        "logonguid",
        "logonid",
        "originalfilename",
        "parentcommandline",
        "parentimage",
        "parentprocessguid",
        "parentprocessid",
        "parentuser",
        "processguid",
        "processid",
        "product",
        "terminalsessionid",
        "user",
        "imphash",
        "md5",
        "sha1",
        "sha256",
    ],
    SigmaLogSource(
        category=None,
        product="m365",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="syslog",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="vsftpd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="sshd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="sudo",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="guacamole",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="clamav",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="cron",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="linux",
        service="auditd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "a0",
        "a1",
        "a2",
        "a3",
        "a4",
        "a5",
        "a6",
        "a7",
        "a8",
        "a9",
        "acct",
        "acl",
        "action",
        "added",
        "addr",
        "apparmor",
        "arch",
        "argc",
        "audit_backlog_limit",
        "audit_backlog_wait_time",
        "audit_enabled",
        "audit_failure",
        "auid",
        "banners",
        "bool",
        "bus",
        "cap_fe,cap_fi",
        "cap_fp",
        "cap_fver",
        "cap_pa",
        "cap_pe",
        "cap_pi",
        "cap_pp",
        "capability",
        "category",
        "cgroup",
        "changed",
        "cipher",
        "class",
        "cmd",
        "code",
        "comm",
        "compat",
        "cwd",
        "daddr",
        "data",
        "default-context",
        "dev",
        "dev",
        "device",
        "dir",
        "direction",
        "dmac",
        "dport",
        "egid",
        "enforcing",
        "entries",
        "errno",
        "euid",
        "exe",
        "exit",
        "fam",
        "family",
        "fd",
        "fe",
        "feature",
        "fi",
        "file",
        "flags",
        "format",
        "fp",
        "fsgid",
        "fsuid",
        "fver",
        "gid",
        "grantors",
        "grp",
        "hook",
        "hostname",
        "icmp_type",
        "id",
        "igid",
        "img-ctx",
        "inif",
        "ino",
        "inode",
        "inode_gid",
        "inode_uid",
        "invalid_context",
        "ioctlcmd",
        "ip",
        "ipid",
        "ipx-net",
        "item",
        "items",
        "iuid",
        "kernel",
        "key",
        "kind",
        "ksize",
        "laddr",
        "len",
        "list",
        "lport",
        "mac",
        "macproto",
        "maj",
        "major",
        "minor",
        "mode",
        "model",
        "msg",
        "name",
        "nametype",
        "nargs",
        "net",
        "new",
        "new-chardev",
        "new-disk",
        "new-enabled",
        "new-fs",
        "new-level",
        "new-log_passwd",
        "new-mem",
        "new-net",
        "new-range",
        "new-rng",
        "new-role",
        "new-seuser",
        "new-vcpu",
        "new_gid",
        "new_lock",
        "new_pe",
        "new_pi",
        "new_pp",
        "nlnk-fam",
        "nlnk-grp",
        "nlnk-pid",
        "oauid",
        "obj",
        "obj_gid",
        "obj_uid",
        "ocomm",
        "oflag",
        "ogid",
        "old",
        "old-auid",
        "old-chardev",
        "old-disk",
        "old-enabled",
        "old-fs",
        "old-level",
        "old-log_passwd",
        "old-mem",
        "old-net",
        "old-range",
        "old-rng",
        "old-role",
        "old-ses",
        "old-seuser",
        "old-vcpu",
        "old_enforcing",
        "old_lock",
        "old_pa",
        "old_pe",
        "old_pi",
        "old_pp",
        "old_prom",
        "old_val",
        "op",
        "opid",
        "oses",
        "ouid",
        "outif",
        "pa",
        "parent",
        "path",
        "pe",
        "per",
        "perm",
        "perm_mask",
        "permissive",
        "pfs",
        "pi",
        "pid",
        "pp",
        "ppid",
        "printer",
        "proctitle",
        "prom",
        "proto",
        "qbytes",
        "range",
        "rdev",
        "reason",
        "removed",
        "res",
        "resrc",
        "result",
        "role",
        "rport",
        "saddr",
        "sauid",
        "scontext",
        "selected-context",
        "seperm",
        "seperms",
        "seqno",
        "seresult",
        "ses",
        "seuser",
        "sgid",
        "sig",
        "sigev_signo",
        "smac",
        "spid",
        "sport",
        "state",
        "subj",
        "success",
        "suid",
        "syscall",
        "table",
        "tclass",
        "tcontext",
        "terminal",
        "tty",
        "type",
        "uid",
        "unit",
        "uri",
        "user",
        "uuid",
        "val",
        "val",
        "ver",
        "virt",
        "vm",
        "vm-ctx",
        "vm-pid",
        "watch",
    ],
    SigmaLogSource(
        category=None,
        product="linux",
        service="auth",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="file_event",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["creationutctime", "image", "processguid", "processid", "targetfilename", "user"],
    SigmaLogSource(
        category="network_connection",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "destinationhostname",
        "destinationip",
        "destinationisipv6",
        "destinationport",
        "destinationportname",
        "image",
        "initiated",
        "processguid",
        "processid",
        "protocol",
        "sourcehostname",
        "sourceip",
        "sourceisipv6",
        "sourceport",
        "sourceportname",
        "user",
    ],
    SigmaLogSource(
        category="application",
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="juniper",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="jvm",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="github",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="huawei",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="gcp",
        service="gcp.audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="gcp",
        service="google_workspace.admin",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category="application",
        product="django",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="fortios",
        service="sslvpnd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="ldp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="syslog",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="duo",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="bitbucket",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="cisco",
        service="aaa",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="riskdetection",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="signinlogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="auditlogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="pim",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="aws",
        service="cloudtrail",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
    SigmaLogSource(
        category=None,
        product="azure",
        service="activitylogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): [],
}
ref_sigmahq_logsource_definition: Dict[SigmaLogSource, str] = {
    SigmaLogSource(
        category=None,
        product="zeek",
        service="x509",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="zeek",
        service="rdp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="zeek",
        service="smb_files",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="zeek",
        service="http",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="zeek",
        service="kerberos",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="zeek",
        service="dce_rpc",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="zeek",
        service="dns",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="sysmon_status",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="wmi_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="registry_set",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="sysmon_error",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="registry_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="registry_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="raw_access_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="registry_add",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="ps_module",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="ps_script",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="ps_classic_provider_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="ps_classic_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="process_creation",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="process_tampering",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="pipe_created",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="process_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="windefend",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="wmi",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="taskscheduler",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="terminalservices-localsessionmanager",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="sysmon",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-connectivity",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="smbclient-security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="security-mitigations",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="shell-core",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="printservice-operational",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="security",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="powershell-classic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="printservice-admin",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="ntlm",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="openssh",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="msexchange-management",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="lsa-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="microsoft-servicebus-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="iis-configuration",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="ldap",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="driver-framework",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="firewall-as",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-server-analytic",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="diagnosis-scripted",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="dns-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="certificateservicesclient-lifecycle-system",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="codeintegrity-operational",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="bits-client",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="capi2",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxdeployment-server",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="appxpackaging-om",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="applocker",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="appmodel-runtime",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="network_connection",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="windows",
        service="application",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_rename",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="image_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_executable_detected",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_change",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="driver_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): "Requirements: Microsoft-Windows-Kernel-File ETW provider",
    SigmaLogSource(
        category="create_stream_hash",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="dns_query",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="velocity",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="create_remote_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="spring",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="sql",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="rpc_firewall",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="ruby_on_rails",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="python",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="qualys",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="appliance",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_event",
        product="paloalto",
        service="globalprotect",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="onelogin",
        service="onelogin.events",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="opencanary",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="webserver",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="okta",
        service="okta",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product=None,
        service="nginx",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="proxy",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product=None,
        service="apache",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product=None,
        service="netflow",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="dns",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="firewall",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="antivirus",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="database",
        product=None,
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="process_creation",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="nodejs",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="m365",
        service="threat_management",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_event",
        product="macos",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="m365",
        service="exchange",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="m365",
        service="threat_detection",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="process_creation",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="m365",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="syslog",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="vsftpd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="sshd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="sudo",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="guacamole",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="clamav",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="cron",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="auditd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="linux",
        service="auth",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="file_event",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="network_connection",
        product="linux",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="kubernetes",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="juniper",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="jvm",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="github",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="huawei",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="gcp",
        service="gcp.audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="gcp",
        service="google_workspace.admin",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category="application",
        product="django",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="fortios",
        service="sslvpnd",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="cisco",
        service="ldp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="cisco",
        service="syslog",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="cisco",
        service="bgp",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="cisco",
        service="duo",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="bitbucket",
        service="audit",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="cisco",
        service="aaa",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="azure",
        service="riskdetection",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="azure",
        service="signinlogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="azure",
        service="auditlogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="azure",
        service="pim",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="aws",
        service="cloudtrail",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
    SigmaLogSource(
        category=None,
        product="azure",
        service="activitylogs",
        definition=None,
        source=None,
        custom_attributes=None,
    ): None,
}

windows_version: str = "20240809"
ref_windows_provider_name: Dict[SigmaLogSource, List[str]] = {
    SigmaLogSource(
        category="sysmon_status",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="wmi_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="sysmon_error",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="registry_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="registry_set",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="registry_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="registry_rename",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="registry_add",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="ps_classic_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["PowerShell"],
    SigmaLogSource(
        category="raw_access_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="ps_module",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-PowerShell"],
    SigmaLogSource(
        category="ps_script",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-PowerShell"],
    SigmaLogSource(
        category="ps_classic_script",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["PowerShell"],
    SigmaLogSource(
        category="process_creation",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): [
        "Microsoft-Windows-Sysmon",
        "Microsoft-Windows-Security-Auditing",
        "Microsoft-Windows-Kernel-Process",
        "SystemTraceProvider-Process",
    ],
    SigmaLogSource(
        category="ps_classic_provider_start",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["PowerShell"],
    SigmaLogSource(
        category="process_tampering",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="process_termination",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="image_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="process_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon", "Microsoft-Windows-Kernel-Audit-API-Calls"],
    SigmaLogSource(
        category="network_connection",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon", "Microsoft-Windows-TCPIP"],
    SigmaLogSource(
        category="pipe_created",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="file_event",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="driver_load",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="file_delete",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="file_access",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="file_change",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="clipboard_capture",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="dns_query",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="create_remote_thread",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
    SigmaLogSource(
        category="create_stream_hash",
        product="windows",
        service=None,
        definition=None,
        source=None,
        custom_attributes=None,
    ): ["Microsoft-Windows-Sysmon"],
}
ref_windows_no_eventid: List[str] = [
    "clipboard_capture",
    "create_remote_thread",
    "create_stream_hash",
    "dns_query",
    "driver_load",
    "file_access",
    "file_change",
    "file_delete",
    "file_event",
    "image_load",
    "network_connection",
    "pipe_created",
    "process_access",
    "process_creation",
    "process_tampering",
    "process_termination",
    "ps_classic_provider_start",
    "ps_classic_script",
    "ps_classic_start",
    "ps_module",
    "ps_script",
    "raw_access_thread",
    "registry_add",
    "registry_delete",
    "registry_rename",
    "registry_set",
    "sysmon_error",
    "sysmon_status",
]
