pC_s672.md

Parser Content

{
Name = s-672
  Vendor = Microsoft
  Product = Windows
  Lms = Splunk
  DataType = "windows-672"
  TimeFormat = "MM/dd/yyyy hh:mm:ss a"
  Conditions = [ "EventCode=672", "Service Name:", "krbtgt" ]
  Fields = [ """exabeam_raw=({time}\d{1,100}/\d{1,100}/\d{1,100} \d{1,100}:\d{1,100}:\d{1,100} (am|AM|pm|PM))""",
    """({event_name}Account Logon)""",
             """ComputerName =({host}[\w.\-]{1,2000})""",
             """EventCode=({event_code}\w+)""",
             """User Name:\s{1,100}({user}.+?)\s{1,100}Supplied Realm Name:\s{1,100}({domain}[^\s]{1,2000})""",
             """Client Address:\s{1,100}(::[\w]{1,2000}:)?({dest_ip}[a-fA-F:\d.]{1,2000})""",
             """Result Code:\s{1,100}({result_code}[\w\-]{1,2000})""",
             """Sid=({user_sid}[^\s]{1,2000})\s{1,100}SidType"""
  ]


}