pC_sxml4697.md

Parser Content

{
Name = s-xml-4697
  Vendor = Microsoft
  Product = Windows
  Lms = Splunk
  DataType = "windows-service-created"
  TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
  Conditions = [ """<EventID>4697</EventID>""", """'ServiceFileName'>"""]
  Fields = [ 
    """SystemTime(\\)?=\'({time}\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d)""",
    """<Computer>({host}[^<]{1,2000})</Computer>""",
    """<EventID>({event_code}[^<]{1,2000})</EventID>"""
    """<Data Name(\\)?='SubjectUserSid'>(?:NONE_MAPPED|({user_sid}[^<]{1,2000}))</Data>""",
    """<Data Name(\\)?='SubjectUserName'>(?=\w)({user}[^<]{1,2000})</Data>""",
    """<Data Name(\\)?='SubjectDomainName'>(?=\w)({domain}[^<]{1,2000})</Data>""",
    """<Data Name(\\)?='SubjectLogonId'>(?=\w)({logon_id}[^<]{1,2000})</Data>""",
    """<Data Name(\\)?='ServiceName'>(?=\w)(({service_name}[^_]{1,2000}?)(_[^\<]{1,2000})?)</Data>""",
    """<Data Name(\\)?='ServiceAccount'>(?=\w)(({account_domain}[^\\<]{0,2000})\\)?({account_name}[^<]{1,2000})</Data>""",
    """<Data Name(\\)?='ServiceFileName'>"?(?=\w)({process}({directory}(?:(\w+:)?[^:<"]{1,2000})?[\\])?({process_name}[^<"\s]{1,2000}))""",
    """<Data Name(\\)?='ServiceType'>(?=\w)({service_type}[^<]{1,2000})</Data>""",
    """<Message>({event_name}A service was installed in the system)"""
  ]
  DupFields = [ "host->dest_host", "directory->process_directory" ]


}