pC_raw47693.md

Parser Content

{
Name = raw-4769-3
    Vendor = Microsoft
    Product = Windows
    Lms = Direct
    DataType = "windows-4769"
    TimeFormat = "yyyy-MM-dd HH:mm:ss"
    Conditions = ["A Kerberos service ticket was requested", "Account Name", "Computer"]
    Fields = [
      """({event_name}A Kerberos service ticket was requested)""",
      """({time}\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d)""",
      """({time}(?i)(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) \d{1,2} \d{1,2}:\d{1,2}:\d{1,2} 20\d{2})""",
      """<Computer>({host}[^<]{1,2000})</Computer>""",
      """Computer(\w+)?["\s]{0,2000}(:|=)\s{0,100}"?({host}.+?)("|\s|;)""",
      """({event_code}4769)""",
      """Account Name(:|=)\s{0,100}(\w+\/({src_host}[^@\s]{1,2000})(@({domain}[\w._\-]{1,2000}))?|({user}[^@:\s;]{1,2000})(@({=domain}[\w._\-]{1,2000}))?)[\s;]{0,2000}Account Domain(:|=)""",
      """Account Domain(:|=)\s{0,100}({domain}[^:=]{1,2000}?)[\s;]{0,2000}Logon GUID(:|=)""",
      """Service Name(:|=)\s{0,100}({dest_host}[^\s;]{1,2000}\$)[\s;]{0,2000}Service ID""",
      """Service Name(:|=)\s{0,100}({service_name}[^\s;]{1,2000})[\s;]{0,2000}Service ID""",
      """Client Address(:|=)\s{0,100}(::[\w]{1,2000}:)?({src_ip}[a-fA-F:\d.]{1,2000})""",
      """Failure Code(:|=)\s{0,100}({result_code}.+?)[\s;]{0,2000}Transited Services(:|=)""",
      """Ticket Options(:|=)\s{0,100}({ticket_options}.+?)[\s;]{0,2000}Ticket Encryption Type(:|=)"""
      """Ticket Encryption Type(:|=)\s{0,100}({ticket_encryption_type}.+?)[\s;]{0,2000}Failure Code(:|=)"""
    ]
  

}