pC_s612.md

Parser Content

{
Name = s-612
  Vendor = Microsoft
  Product = Windows
  Lms = Splunk
  DataType = "windows-audit"
  TimeFormat = "MMM dd HH:mm:ss yyyy"
  Conditions = [ "EventCode=612", "Audit Policy Change:" ]
  Fields = [
    """({event_name}Audit Policy Change)""",
    """exabeam_time=({time}\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d)""",
    """exabeam_host=({host}[^\s]{1,2000})""",
    """ComputerName =({host}[\w.\-]{1,2000})""",
    """({event_code}612)""",
    """Changed By:.*\s{1,100}User Name:\s{1,100}({user}[^\s]{1,2000})"""
    """\s{1,100}Domain Name:\s{1,100}({domain}[^\s]{1,2000})""",
    """\s{1,100}Logon ID:\s{1,100}\([^,]{1,2000

}