pC_l4722.md

Parser Content

{
Name = l-4722
  Vendor = Microsoft
  Product = Windows
  Lms = Direct
  DataType = "windows-account-enabled"
  TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
  Conditions = [ "<EventID>4722</EventID>" ]
  Fields = [
	 """({event_name}A user account was enabled)""",
   """SystemTime=\'({time}\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d)""",
   """<Computer>({host}[^<]{1,2000})</Computer>""",
   """<EventID>({event_code}[^<]{1,2000})</EventID>""",
   """Subject:.+?Account Name:\s{0,100}({user}.+?)\s{0,100}Account Domain:\s{0,100}({domain}.+?)\s{0,100}Logon ID:\s{0,100}({logon_id}.+?)\s{0,100}Target Account:""",
   """Target Account:\s{0,100}Security ID:\s{0,100}({account_id}.+?)\s{0,100}Account Name:\s{0,100}({target_user}.+?)\s{0,100}Account Domain:\s{0,100}({target_domain}.+?)\s{0,100}<""",
   """<Data Name ='TargetUserName'>({target_user}.+?)\s{0,100}</Data>""",
   """<Data Name ='TargetDomainName'>({target_domain}.+?)\s{0,100}</Data>""",
   """<Data Name ='SubjectUserName'>({user}.+?)\s{0,100}</Data>""",
   """<Data Name ='SubjectDomainName'>({domain}.+?)\s{0,100}</Data>""",
   """<Data Name ='SubjectLogonId'>({logon_id}.+?)\s{0,100}</Data>""",
    
  ]


}