Rules/queries with log source category process_creation can be applied to Microsoft Windows and Sysmon. However, Windows and Sysmon have different field taxonomy.
For Splunk, most process_creation rules are translated into Windows taxonomy. To apply these rules and queries to Sysmon, use the Global Custom Field Mapping "Splunk Win 4688 process_creation to Sysmon taxonomy".
To be able to use it in Attack Detective, follow these steps:
Go to the Custom Field Mapping page and open the Global tab.
Find the Global Custom Field Mapping "Splunk Win 4688 process_creation to Sysmon taxonomy" and click the Copy icon.
Update the profile name and enable the Make Default switch.
Click Save Changes to save your copy of the profile.
Go to the My tab and open the newly created profile for editing by clicking the Edit icon.
Select your Data Plane(s) to be used in Attack Detective for which you want to apply this profile, and enable the Share to Company switch.
Click Save Changes.
During all the next scans in Attack Detective, all process_creation queries will be changed from Windows taxonomy to Sysmon accordingly.