{
  "id": "windows-core",
  "name": "Windows Core Security",
  "description": "Hochwertige Windows-System- und Audit-Ereignisse mit geringer Grundlautstärke.",
  "version": 1,
  "enabled": true,
  "rules": [
    {
      "id": "win-audit-log-cleared",
      "title": "Security Audit Log gelöscht",
      "description": "Windows Security Event 1102.",
      "severity": "critical",
      "score": 9.8,
      "enabled": true,
      "kind": "event",
      "channels": ["Security"],
      "event_codes": [1102],
      "group_by": ["host"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "Security Audit Log auf {host} wurde gelöscht",
      "tags": ["windows", "audit", "defense-evasion"],
      "mitre": ["T1070.001"]
    },
    {
      "id": "win-service-installed",
      "title": "Neuer Windows-Dienst installiert",
      "description": "Service Control Manager Event 7045.",
      "severity": "high",
      "score": 8.0,
      "enabled": true,
      "kind": "event",
      "event_codes": [7045],
      "group_by": ["host", "process_path"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "Neuer Dienst auf {host} installiert: {process}",
      "tags": ["windows", "persistence", "service"],
      "mitre": ["T1543.003"]
    },
    {
      "id": "win-scheduled-task-created",
      "title": "Scheduled Task erstellt",
      "description": "Windows Security Event 4698.",
      "severity": "high",
      "score": 7.8,
      "enabled": true,
      "kind": "event",
      "channels": ["Security"],
      "event_codes": [4698],
      "group_by": ["host", "user"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "Scheduled Task auf {host} durch {user} erstellt",
      "tags": ["windows", "persistence", "scheduled-task"],
      "mitre": ["T1053.005"]
    },
    {
      "id": "win-audit-policy-changed",
      "title": "Audit Policy geändert",
      "description": "Windows Security Event 4719.",
      "severity": "high",
      "score": 8.2,
      "enabled": true,
      "kind": "event",
      "channels": ["Security"],
      "event_codes": [4719],
      "group_by": ["host", "user"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "Audit Policy auf {host} durch {user} geändert",
      "tags": ["windows", "audit", "policy"],
      "mitre": ["T1562.002"]
    },
    {
      "id": "win-firewall-rule-change",
      "title": "Windows Firewall-Regel geändert",
      "description": "Firewall-Regeln hinzugefügt, geändert oder gelöscht.",
      "severity": "medium",
      "score": 5.5,
      "enabled": true,
      "kind": "threshold",
      "channels": ["Security"],
      "event_codes": [4946, 4947, 4948],
      "group_by": ["host", "user"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "Windows Firewall-Regel auf {host} geändert ({count} Ereignisse)",
      "tags": ["windows", "firewall", "configuration"],
      "mitre": ["T1562.004"]
    }
  ]
}