pC_kiteworksfailedapplogin1.md

Parser Content

{
Name = kiteworks-failed-app-login-1
  Vendor = Accellion
  Product = Kiteworks
  Lms = Direct
  DataType = "failed-app-login"
  TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
  Conditions = [ """, Activity Group:""", """Activity Type: user_login_failed""", """login failed""" ]
  Fields = [
    """exabeam_time=({time}\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d)""",
    """\w+\s{1,100}\d{1,100}\s\d\d:\d\d:\d\d\s({host}[^\s]{1,2000}?)\s[^\s]{1,2000}([^=]{1,2000}=[^,]{1,2000

}