add sysmon files to blobl mappigs

[zschmerber]

i do not have time to make sample data yet but can get to that later

[mavam]

This is a custom event class. Do you have a pointer to it?

[zschmerber]

When the windows extension is enabled it shows up

[mavam]

What if we didn't have your extension, would this be reasonable summary of mapping of event IDs to classes?

Sysmon Event ID	Sysmon Event Description (from Microsoft)	OCSF Event Class Name
1	Process creation	Process Activity
2	A process changed a file creation time	File System Activity
3	Network connection	Network Activity
4	Sysmon service state changed	Process Activity
5	Process terminated	Process Activity
6	Driver loaded	Kernel Activity
7	Image loaded	Process Activity
8	CreateRemoteThread	Process Activity
9	RawAccessRead	Process Activity
10	ProcessAccess	Process Activity
11	FileCreate	File System Activity
12	RegistryEvent (Object create and delete)	Registry Activity
13	RegistryEvent (Value Set)	Registry Activity
14	RegistryEvent (Key and Value Rename)	Registry Activity
15	FileCreateStreamHash	File System Activity
16	ServiceConfigurationChange	Device Config State
17	PipeEvent (Pipe Created)	File System Activity
18	PipeEvent (Pipe Connected)	File System Activity
19	WmiEvent (WmiEventFilter activity detected)	Process Activity
20	WmiEvent (WmiEventConsumer activity detected)	Process Activity
21	WmiEvent (WmiEventConsumerToFilter activity detected)	Process Activity
22	DNSEvent (DNS query)	DNS Activity
23	FileDelete (File Delete archived)	File System Activity
25	ProcessTampering (Process image change)	Process Activity
26	FileDeleteDetected (File Delete logged)	File System Activity
27	FileBlockExecutable	File System Activity
28	FileBlockShredding	File System Activity
29	FileExecutableDetected	File System Activity

[zschmerber]

  ## System Activity
  # File System - EventId 11
  # File System - EventId 15
  # File System - EventId 23
  # File System - EventId 26
  # Kernel Extension - EventId 6
  # Module  - EventId 7
  # Process - EventId 1
  # Process - EventId 5
  # Process - EventId 8
  # Process - EventId 10
  # Process - EventId 25
  # registry_key_activity - EventID 12
  # registry_key_activity - EventID 13
  # System Activity - EventId 17
  # Windows Resource Activity - EventId 18

  ## Network Activity
  # Network  - EventId 3
  # DNS  - EventId 22

  ## Discovery
  # Device Config state - EventID 4
  # Device Config state - EventID 16
  # Device Config state - EventID 255