pC_l4725.md

Parser Content

{
Name = l-4725
  Vendor = Microsoft
  Product = Windows
  Lms = Direct
  DataType = "windows-account-disabled"
  TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
  Conditions = [ "<EventID>4725</EventID>", "A user account was disabled" ]
  Fields = [
    """({event_name}A user account was disabled)""",
    """SystemTime=\'({time}\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d)""",
    """<Computer>({host}[^<]{1,2000})</Computer>""",
    """<EventID>({event_code}[^<]{1,2000})</EventID>""",
    """Subject:.+?Security ID:\s{0,100}({user_sid}[^:]{1,2000}?)\s{0,100}Account Name:""",
    """Subject:.+?Account Name:\s{0,100}({user}[^:]{1,2000}?)\s{0,100}Account Domain:\s{0,100}(|({domain}[^:]{1,2000}?))\s{0,100}Logon ID""",
    """Logon ID:\s{0,100}({logon_id}[^:]{1,2000}?)\s{0,100}Target Account:""",
    """Target Account:\s{0,100}Security ID:\s{0,100}({target_user_sid}[^:]{1,2000}?)\s{0,100}Account Name:\s{0,100}(?=\w)({target_user}[^:]{1,2000}?)\s{0,100}Account Domain""",
    """Target Account.+?Account Domain:\s{0,100}(?=\w)({target_domain}[^:]{1,2000}?)\s{0,100}<"""
  ]
  DupFields = [ "host->dest_host" ]


}