splunk · P4T12ICK · Jul 7, 2026 · Jul 7, 2026 · Jul 7, 2026 · Jul 8, 2026
diff --git a/.gitignore b/.gitignore
@@ -9,6 +9,7 @@ __pycache__/
 
 # C extensions
 *.so
+.env
 
 # Distribution / packaging
 .Python

diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -0,0 +1,8 @@
+{
+    "yaml.schemas": {
+        "file:///Users/pbareiss/.cursor/extensions/your-publisher-id.strt-bot-detection-yaml-0.1.1/schema/detection.schema.json": [
+            "**/detections/**/*.yml",
+            "**/detections/**/*.yaml"
+        ]
+    }
+}
diff --git a/datasets/attack_techniques/T1003.001/atomic_red_team/T1003.001_atomic_red_team.yml b/datasets/attack_techniques/T1003.001/atomic_red_team/T1003.001_atomic_red_team.yml
@@ -0,0 +1,25 @@
+author: STRT
+id: 6d7d5c48-17a5-4502-81ac-00f5c023a9b1
+date: '2026-07-11'
+description: Curated attack data generated for detection Access LSASS Memory for Dump
+  Creation
+environment: attack_range
+directory: atomic_red_team
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: crowdstrike_falcon
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
+  sourcetype: crowdstrike:events:sensor
+  source: crowdstrike
+- name: createdump_windows-sysmon
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/createdump_windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: windows-sysmon_creddump
+  path: /datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/...03.001/atomic_red_team/createdump_windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/...03.001/atomic_red_team/createdump_windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
diff --git a/...ues/T1003.001/atomic_red_team/crowdstrike_falcon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/...ues/T1003.001/atomic_red_team/crowdstrike_falcon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
diff --git a/...hniques/T1003.001/atomic_red_team/windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/...hniques/T1003.001/atomic_red_team/windows-sysmon-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
diff --git a/...1003.001/atomic_red_team/windows-sysmon_creddump-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log b/...1003.001/atomic_red_team/windows-sysmon_creddump-6d7d5c48-17a5-4502-81ac-00f5c023a9b1.log
diff --git a/datasets/attack_techniques/T1003.002/atomic_red_team/T1003.002_atomic_red_team.yml b/datasets/attack_techniques/T1003.002/atomic_red_team/T1003.002_atomic_red_team.yml
@@ -0,0 +1,12 @@
+author: STRT
+id: a9d698d4-4bb3-4316-8502-470b22ab31c0
+date: '2026-07-11'
+description: Curated attack data generated for detection Esentutl SAM Copy
+environment: attack_range
+directory: atomic_red_team
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon-a9d698d4-4bb3-4316-8502-470b22ab31c0.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/...hniques/T1003.002/atomic_red_team/windows-sysmon-a9d698d4-4bb3-4316-8502-470b22ab31c0.log b/...hniques/T1003.002/atomic_red_team/windows-sysmon-a9d698d4-4bb3-4316-8502-470b22ab31c0.log
diff --git a/...th_script_block_logging/T1003.002_detect_copy_of_shadowcopy_with_script_block_logging.yml b/...th_script_block_logging/T1003.002_detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 18d97431-2aab-4c9c-99d6-518c9884a35c
+date: '2026-07-10'
+description: Curated attack data generated for detection Detect Copy of ShadowCopy
+  with Script Block Logging
+environment: attack_range
+directory: detect_copy_of_shadowcopy_with_script_block_logging
+mitre_technique: []
+datasets:
+- name: windows-xml
+  path: /datasets/attack_techniques/T1003.002/detect_copy_of_shadowcopy_with_script_block_logging/windows-xml-18d97431-2aab-4c9c-99d6-518c9884a35c.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
diff --git a/...shadowcopy_with_script_block_logging/windows-xml-18d97431-2aab-4c9c-99d6-518c9884a35c.log b/...shadowcopy_with_script_block_logging/windows-xml-18d97431-2aab-4c9c-99d6-518c9884a35c.log
diff --git a/datasets/attack_techniques/T1003.003/atomic_red_team/T1003.003_atomic_red_team.yml b/datasets/attack_techniques/T1003.003/atomic_red_team/T1003.003_atomic_red_team.yml
@@ -0,0 +1,16 @@
+author: STRT
+id: bfc0b9bd-d736-43b8-ba0e-6e112367acb5
+date: '2026-07-10'
+description: Curated attack data generated for detection Creation of Shadow Copy
+environment: attack_range
+directory: atomic_red_team
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: crowdstrike_falcon
+  path: /datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log
+  sourcetype: crowdstrike:events:sensor
+  source: crowdstrike
diff --git a/...ues/T1003.003/atomic_red_team/crowdstrike_falcon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log b/...ues/T1003.003/atomic_red_team/crowdstrike_falcon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log
diff --git a/...hniques/T1003.003/atomic_red_team/windows-sysmon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log b/...hniques/T1003.003/atomic_red_team/windows-sysmon-bfc0b9bd-d736-43b8-ba0e-6e112367acb5.log
diff --git a/datasets/attack_techniques/T1003.004/NoLMHash/T1003.004_NoLMHash.yml b/datasets/attack_techniques/T1003.004/NoLMHash/T1003.004_NoLMHash.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 92614a55-d3a7-4ac7-9e61-ae0155a287b6
+date: '2026-07-11'
+description: Curated attack data generated for detection Windows LSA Secrets NoLMhash
+  Registry
+environment: attack_range
+directory: NoLMHash
+mitre_technique: []
+datasets:
+- name: lsa-reg-settings-sysmon
+  path: /datasets/attack_techniques/T1003.004/NoLMHash/lsa-reg-settings-sysmon-92614a55-d3a7-4ac7-9e61-ae0155a287b6.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/...iques/T1003.004/NoLMHash/lsa-reg-settings-sysmon-92614a55-d3a7-4ac7-9e61-ae0155a287b6.log b/...iques/T1003.004/NoLMHash/lsa-reg-settings-sysmon-92614a55-d3a7-4ac7-9e61-ae0155a287b6.log
diff --git a/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/T1003.008_copy_file_stdoutpipe.yml b/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/T1003.008_copy_file_stdoutpipe.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 6c16ae83-66f1-4ca4-a89f-95f431b4cddd
+date: '2026-07-10'
+description: Curated attack data generated for detection Linux Possible Access To
+  Credential Files
+environment: attack_range
+directory: copy_file_stdoutpipe
+mitre_technique: []
+datasets:
+- name: sysmon_linux
+  path: /datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux-6c16ae83-66f1-4ca4-a89f-95f431b4cddd.log
+  sourcetype: sysmon:linux
+  source: Syslog:Linux-Sysmon/Operational
diff --git a/...ques/T1003.008/copy_file_stdoutpipe/sysmon_linux-6c16ae83-66f1-4ca4-a89f-95f431b4cddd.log b/...ques/T1003.008/copy_file_stdoutpipe/sysmon_linux-6c16ae83-66f1-4ca4-a89f-95f431b4cddd.log
diff --git a/datasets/attack_techniques/T1003.008/esxi_sensitive_files/T1003.008_esxi_sensitive_files.yml b/datasets/attack_techniques/T1003.008/esxi_sensitive_files/T1003.008_esxi_sensitive_files.yml
@@ -0,0 +1,12 @@
+author: STRT
+id: 15efa630-4509-455c-8711-5edae8e2353e
+date: '2026-07-13'
+description: Curated attack data generated for detection ESXi Sensitive Files Accessed
+environment: attack_range
+directory: esxi_sensitive_files
+mitre_technique: []
+datasets:
+- name: esxi_sensitive_files
+  path: /datasets/attack_techniques/T1003.008/esxi_sensitive_files/esxi_sensitive_files-15efa630-4509-455c-8711-5edae8e2353e.log
+  sourcetype: vmw-syslog
+  source: vmware:esxlog
diff --git a/...03.008/esxi_sensitive_files/esxi_sensitive_files-15efa630-4509-455c-8711-5edae8e2353e.log b/...03.008/esxi_sensitive_files/esxi_sensitive_files-15efa630-4509-455c-8711-5edae8e2353e.log
diff --git a/datasets/attack_techniques/T1003/credential_extraction/T1003_credential_extraction.yml b/datasets/attack_techniques/T1003/credential_extraction/T1003_credential_extraction.yml
@@ -0,0 +1,12 @@
+author: STRT
+id: 0a47b4ab-1057-4aff-b5cd-f58483f6b9a4
+date: '2026-07-11'
+description: Curated attack data generated for detection Windows Mimikatz Binary Execution
+environment: attack_range
+directory: credential_extraction
+mitre_technique: []
+datasets:
+- name: mimikatzwindows-sysmon
+  path: /datasets/attack_techniques/T1003/credential_extraction/mimikatzwindows-sysmon-0a47b4ab-1057-4aff-b5cd-f58483f6b9a4.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/...003/credential_extraction/mimikatzwindows-sysmon-0a47b4ab-1057-4aff-b5cd-f58483f6b9a4.log b/...003/credential_extraction/mimikatzwindows-sysmon-0a47b4ab-1057-4aff-b5cd-f58483f6b9a4.log
diff --git a/datasets/attack_techniques/T1005/esxi_vm_download/T1005_esxi_vm_download.yml b/datasets/attack_techniques/T1005/esxi_vm_download/T1005_esxi_vm_download.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 09c0196a-4a9f-4946-8cfd-28fa543af951
+date: '2026-07-13'
+description: Curated attack data generated for detection ESXi VM Exported via Remote
+  Tool
+environment: attack_range
+directory: esxi_vm_download
+mitre_technique: []
+datasets:
+- name: esxi_vm_download
+  path: /datasets/attack_techniques/T1005/esxi_vm_download/esxi_vm_download-09c0196a-4a9f-4946-8cfd-28fa543af951.log
+  sourcetype: vmw-syslog
+  source: vmware:esxlog
diff --git a/...chniques/T1005/esxi_vm_download/esxi_vm_download-09c0196a-4a9f-4946-8cfd-28fa543af951.log b/...chniques/T1005/esxi_vm_download/esxi_vm_download-09c0196a-4a9f-4946-8cfd-28fa543af951.log
diff --git a/datasets/attack_techniques/T1011/snapattack/T1011_snapattack.yml b/datasets/attack_techniques/T1011/snapattack/T1011_snapattack.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121
+date: '2026-07-11'
+description: Curated attack data generated for detection Windows Network Connection
+  From Program In Suspect Location
+environment: attack_range
+directory: snapattack
+mitre_technique: []
+datasets:
+- name: snapattack
+  path: /datasets/attack_techniques/T1011/snapattack/snapattack-ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/...ts/attack_techniques/T1011/snapattack/snapattack-ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121.log b/...ts/attack_techniques/T1011/snapattack/snapattack-ba2652f7-3ef4-4e0c-a0eb-cca67e9bf121.log
diff --git a/datasets/attack_techniques/T1014/attack_techniques_T1014.yml b/datasets/attack_techniques/T1014/attack_techniques_T1014.yml
@@ -0,0 +1,17 @@
+author: STRT
+id: 0cfe8283-b7e2-47cc-8578-1691011330b6
+date: '2026-07-11'
+description: Curated attack data generated for detection Windows Drivers Loaded by
+  Signature
+environment: attack_range
+directory: T1014
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1014/windows-sysmon-0cfe8283-b7e2-47cc-8578-1691011330b6.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+- name: windows-system
+  path: /datasets/attack_techniques/T1014/windows-system-0cfe8283-b7e2-47cc-8578-1691011330b6.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:System
diff --git a/datasets/attack_techniques/T1014/medusa_rootkit/T1014_medusa_rootkit.yml b/datasets/attack_techniques/T1014/medusa_rootkit/T1014_medusa_rootkit.yml
@@ -0,0 +1,12 @@
+author: STRT
+id: 53940b7e-9094-44dc-b8a3-b89fa6a2325b
+date: '2026-07-10'
+description: Curated attack data generated for detection Linux Medusa Rootkit
+environment: attack_range
+directory: medusa_rootkit
+mitre_technique: []
+datasets:
+- name: sysmon_linux
+  path: /datasets/attack_techniques/T1014/medusa_rootkit/sysmon_linux-53940b7e-9094-44dc-b8a3-b89fa6a2325b.log
+  sourcetype: sysmon:linux
+  source: Syslog:Linux-Sysmon/Operational
diff --git a/...ack_techniques/T1014/medusa_rootkit/sysmon_linux-53940b7e-9094-44dc-b8a3-b89fa6a2325b.log b/...ack_techniques/T1014/medusa_rootkit/sysmon_linux-53940b7e-9094-44dc-b8a3-b89fa6a2325b.log
diff --git a/datasets/attack_techniques/T1014/windows-sysmon-0cfe8283-b7e2-47cc-8578-1691011330b6.log b/datasets/attack_techniques/T1014/windows-sysmon-0cfe8283-b7e2-47cc-8578-1691011330b6.log
diff --git a/datasets/attack_techniques/T1014/windows-system-0cfe8283-b7e2-47cc-8578-1691011330b6.log b/datasets/attack_techniques/T1014/windows-system-0cfe8283-b7e2-47cc-8578-1691011330b6.log
diff --git a/...hniques/T1016/atomic_red_team/linux_net_discovery/atomic_red_team_linux_net_discovery.yml b/...hniques/T1016/atomic_red_team/linux_net_discovery/atomic_red_team_linux_net_discovery.yml
@@ -0,0 +1,12 @@
+author: STRT
+id: 3eb5f12e-a0aa-41e1-9cb1-59c5c461245c
+date: '2026-07-10'
+description: Curated attack data generated for detection Linux System Network Discovery
+environment: attack_range
+directory: linux_net_discovery
+mitre_technique: []
+datasets:
+- name: sysmon_linux
+  path: /datasets/attack_techniques/T1016/atomic_red_team/linux_net_discovery/sysmon_linux-3eb5f12e-a0aa-41e1-9cb1-59c5c461245c.log
+  sourcetype: sysmon:linux
+  source: Syslog:Linux-Sysmon/Operational
diff --git a/...atomic_red_team/linux_net_discovery/sysmon_linux-3eb5f12e-a0aa-41e1-9cb1-59c5c461245c.log b/...atomic_red_team/linux_net_discovery/sysmon_linux-3eb5f12e-a0aa-41e1-9cb1-59c5c461245c.log
diff --git a/datasets/attack_techniques/T1016/discovery_commands/T1016_discovery_commands.yml b/datasets/attack_techniques/T1016/discovery_commands/T1016_discovery_commands.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 1c6354b2-2af5-4e83-aae5-99218e445a6d
+date: '2026-07-10'
+description: Curated attack data generated for detection Potential System Network
+  Configuration Discovery Activity
+environment: attack_range
+directory: discovery_commands
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1016/discovery_commands/windows-sysmon-1c6354b2-2af5-4e83-aae5-99218e445a6d.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/...chniques/T1016/discovery_commands/windows-sysmon-1c6354b2-2af5-4e83-aae5-99218e445a6d.log b/...chniques/T1016/discovery_commands/windows-sysmon-1c6354b2-2af5-4e83-aae5-99218e445a6d.log
diff --git a/datasets/attack_techniques/T1018/AD_discovery/T1018_AD_discovery.yml b/datasets/attack_techniques/T1018/AD_discovery/T1018_AD_discovery.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 1f3f5855-ab0f-45d1-af33-e17d9c224cfe
+date: '2026-07-10'
+description: Curated attack data generated for detection Domain Controller Discovery
+  with Nltest
+environment: attack_range
+directory: AD_discovery
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1018/AD_discovery/windows-sysmon-1f3f5855-ab0f-45d1-af33-e17d9c224cfe.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/...ack_techniques/T1018/AD_discovery/windows-sysmon-1f3f5855-ab0f-45d1-af33-e17d9c224cfe.log b/...ack_techniques/T1018/AD_discovery/windows-sysmon-1f3f5855-ab0f-45d1-af33-e17d9c224cfe.log
diff --git a/datasets/attack_techniques/T1018/atomic_red_team/T1018_atomic_red_team.yml b/datasets/attack_techniques/T1018/atomic_red_team/T1018_atomic_red_team.yml
@@ -0,0 +1,12 @@
+author: STRT
+id: 295970dd-7a56-48bb-8e50-1daec5fab25e
+date: '2026-07-11'
+description: Curated attack data generated for detection Windows AdFind Exe
+environment: attack_range
+directory: atomic_red_team
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon-295970dd-7a56-48bb-8e50-1daec5fab25e.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/..._techniques/T1018/atomic_red_team/windows-sysmon-295970dd-7a56-48bb-8e50-1daec5fab25e.log b/..._techniques/T1018/atomic_red_team/windows-sysmon-295970dd-7a56-48bb-8e50-1daec5fab25e.log
diff --git a/..._delegation_discovery/T1018_windows_get_adcomputer_unconstrained_delegation_discovery.yml b/..._delegation_discovery/T1018_windows_get_adcomputer_unconstrained_delegation_discovery.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: f1ff11e3-18bb-42bf-998e-857e48728ee5
+date: '2026-07-11'
+description: Curated attack data generated for detection Windows Get-AdComputer Unconstrained
+  Delegation Discovery
+environment: attack_range
+directory: windows_get_adcomputer_unconstrained_delegation_discovery
+mitre_technique: []
+datasets:
+- name: windows-xml
+  path: /datasets/attack_techniques/T1018/windows_get_adcomputer_unconstrained_delegation_discovery/windows-xml-f1ff11e3-18bb-42bf-998e-857e48728ee5.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
diff --git a/...r_unconstrained_delegation_discovery/windows-xml-f1ff11e3-18bb-42bf-998e-857e48728ee5.log b/...r_unconstrained_delegation_discovery/windows-xml-f1ff11e3-18bb-42bf-998e-857e48728ee5.log
diff --git a/...trained_delegation_discovery/T1018_windows_powerview_constrained_delegation_discovery.yml b/...trained_delegation_discovery/T1018_windows_powerview_constrained_delegation_discovery.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 05171fd9-87f0-4140-a4ae-54413921df2e
+date: '2026-07-11'
+description: Curated attack data generated for detection Windows PowerView Constrained
+  Delegation Discovery
+environment: attack_range
+directory: windows_powerview_constrained_delegation_discovery
+mitre_technique: []
+datasets:
+- name: windows-xml
+  path: /datasets/attack_techniques/T1018/windows_powerview_constrained_delegation_discovery/windows-xml-05171fd9-87f0-4140-a4ae-54413921df2e.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
diff --git a/...iew_constrained_delegation_discovery/windows-xml-05171fd9-87f0-4140-a4ae-54413921df2e.log b/...iew_constrained_delegation_discovery/windows-xml-05171fd9-87f0-4140-a4ae-54413921df2e.log
diff --git a/datasets/attack_techniques/T1020/attack_techniques_T1020.yml b/datasets/attack_techniques/T1020/attack_techniques_T1020.yml
@@ -0,0 +1,13 @@
+author: STRT
+id: 6fabdda1-f8d1-4c08-b7a1-601f999c4435
+date: '2026-07-10'
+description: Curated attack data generated for detection Detect RClone Command-Line
+  Usage
+environment: attack_range
+directory: T1020
+mitre_technique: []
+datasets:
+- name: windows-sysmon
+  path: /datasets/attack_techniques/T1020/windows-sysmon-6fabdda1-f8d1-4c08-b7a1-601f999c4435.log
+  sourcetype: XmlWinEventLog
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
diff --git a/datasets/attack_techniques/T1020/windows-sysmon-6fabdda1-f8d1-4c08-b7a1-601f999c4435.log b/datasets/attack_techniques/T1020/windows-sysmon-6fabdda1-f8d1-4c08-b7a1-601f999c4435.log
-Original file line number
+Diff line change
@@ Expand Up / @@ -9,6 +9,7 @@ __pycache__/ @@
     # C extensions
     *.so
+    .env
     # Distribution / packaging
     .Python
@@ Expand Down @@