Windows Event Log Normalization (Security and Event Logs)
This rule extracts and normalizes Windows Event Logs from both SecurityEvent and Event tables within a 24-hour window. It serves as a foundational query to gather general Windows event logs, similar to what a 'wineventlog' source would provide, and normalizes key fields for consistent security hunting and analysis. The rule specifically projects fields such as TimeGenerated, Computer, EventLog, EventID, SourceName, Level, and Message from both log sources.
Microsoft Sentinel (KQL)
