pC_s51411.md

Parser Content

{
Name = s-5141-1
  Vendor = Microsoft
  Product = Windows
  Lms = Splunk
  DataType = "windows-ds-access"
  TimeFormat = "yyyy-MM-dd HH:mm:ss"
  Conditions = [ """EventID=5141""", """A directory service object was deleted""" ]
  Fields = [
    """exabeam_time=({time}\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d)""",
    """({event_name}A directory service object was deleted)""",
    """DetectTime=({time_created}.+?)\s{1,100}\w+=""",
    """ComputerName =({host}[\w.\-]{1,2000})""",
    """EventID=({event_code}\w+)""",
    """Account Name =({user}.+?)\s{1,100}""",
    """Account Domain=({domain}.+?)\s""",
    """Logon ID=({logon_id}[^\s]{1,2000})\s""",
    """Object:Class=({object_class}.+?)\s""",
    """Object:DN=({object_dn}.+?)\s{0,100}Object:GUID=""",
    """Object:DN=.+?({object_ou}OU.+?)\s{0,100}Object:GUID"""
  ]
  DupFields = [ "host->dest_host" ]


}