indexer_patterns_sample.yml

windows:evtx:powershell:
    name_rex: Windows_PowerShell.*\.jsonl$
    path_suffix: evtx
    host_path: "Event.System.Computer" # Extract the host from the event
    timestamp_path:  # Extract the timestamp from the event
      - "Event.System.TimeCreated.#attributes.SystemTime"
      - "Event.Timestamp"
    timestamp_format: "%Y-%m-%dT%H:%M:%S.%fZ" # Specify the timestamp format
    artifact: EVTX
evtx:
    name_rex: \.jsonl$
    path_suffix: evtx
    sourcetype: _json
    host_path: "Event.System.Computer"
    timestamp_path: 
        - "Event.System.TimeCreated.#attributes.SystemTime"
    timestamp_format: "%Y-%m-%dT%H:%M:%S.%fZ"
prefetch:
    name_rex: \.jsonl$
    path_rex: ".*prefetch"
    sourcetype: _json
    host_rex: (^[\w-]+)--
    timestamp_path: 
        - LastRun
    timestamp_format: "%Y-%m-%d %H:%M:%S"
reg:
    path_suffix: registry
    sourcetype: _json
    host_rex: (^[\w-]+)--