deepbluecli for siem

[sans-blue-team]

deepbluecli for siem

[besimorhino]

Yes, this can be done.

Please review the code. The detection logic begins on line 98 of the PowerShell script.

DeepBlueCLI/DeepBlue.ps1

Line 98 in 5c0c972

if ($event.id -eq 4688){

I hope this helps, please let us know... I'd like to be sure you're OK with this response before I close this.

[TheHmadQureshi]

Hey @besimorhino, thanks for replying. seems like i will have to manually identify and create signatures/siem searches based on this script.
Yes you may close this ticket.