pC_raw47685.md

Parser Content

{
Name = raw-4768-5
  Vendor = Microsoft
  Product = Windows
  Lms = Direct
  DataType = "windows-4768"
  TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
  Conditions = [ """Kerberos Authentication Service""", """Microsoft-Windows-Security-Auditing""","""ServiceName:""", """TicketOptions:""", """4768""", """TicketEncryptionType:"""]
  Fields = [
    """({time}\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d)\.\d{1,3}[+\-]{1,20}\d\d:\d\d""",
    """({host}[^\s]{1,2000})\s{1,100}Kerberos Authentication Service""",
    """({event_code}4768)""",
    """TargetUserName:(({user_email}[^@,]{1,2000}@[^,]{1,2000})|({user}[^,]{1,2000})),""",
    """TargetSid:({user_sid}[^,]{1,2000}),""",
    """ServiceName:({service_name}[^,]{1,2000})""",
    """TicketOptions:({ticket_options}[^,]{1,2000}),""",
    """TicketEncryptionType:({ticket_encryption_type}[^,]{1,2000}),""",
    """Status:({result_code}[^,]{1,2000}),""",
    """IpAddress:(::ffff:)?({dest_ip}[a-fA-F\d:.]{1,2000}),""",
    """({outcome}(Success|Failure) Audit)"""
  ]


}