pC_s4719.md

Parser Content

{
Name = s-4719
  Vendor = Microsoft
  Product = Windows
  Lms = Splunk
  DataType = "windows-audit"
  TimeFormat = "MM/dd/yyyy HH:mm:ss a"
  Conditions = [ """EventCode=4719""", """System audit policy was changed""" ]
  Fields = [
    """({event_name}System audit policy was changed)""",
    """ComputerName =({host}[\w.\-]{1,2000})""",
    """({time}\d\d/\d\d/\d\d\d\d \d{1,100}:\d{1,100}:\d{1,100} (am|AM|pm|PM))\s{1,100}""",
    """EventCode=({event_code}\d{1,100})""",
    """\s{1,100}Account Name:\s{0,100}({user}[^:]{1,2000}?)\s{1,100}Account Domain""",
    """\s{1,100}Account Domain:\s{0,100}({domain}[^\s]{1,2000})""",
    """\s{1,100}Logon ID:\s{0,100}({logon_id}[^\s]{1,2000})""",
    """\s{1,100}Category:\s{0,100}({audit_category}[^:]{1,2000}?)\s{1,100}Subcategory:""",
    """\s{1,100}Subcategory:\s{0,100}({subcategory}[^:]{1,2000}?)\s{1,100}Subcategory GUID:""",
    """\s{1,100}Changes:\s{0,100}({policy}[^:]{1,2000}?)(\s{1,100}\d{1,100}|\s{0,100}$|\s{0,100}")"""
  ]
  DupFields = [ "host->dest_host" ]


}