Overview

This pack maps Windows security events to the UDM schema in Google Security Operations.

What this pack does:

• Maps security events to UDM
• Covers logon, process, and accounts
• Sets type and action per EventID