pC_xml51451.md

Parser Content

{
Name = xml-5145-1
  Vendor = Microsoft
  Product = Windows
  Lms = Direct
  DataType = "share-access"
  TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
  Conditions = [ """<EventID>5145<""" ]
  Fields = [
    """<TimeCreated SystemTime='({time}\d{1,100}-\d{1,100}-\d{1,100}T\d{1,100}:\d{1,100}:\d{1,100})""",
    """<Computer>({host}[\w\-.]{1,2000})""",
    """<Computer>(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}|({host}[\w\-.]{1,2000}))""",
    """({event_code}5145)""",
    """<EventRecordID>({record_id}[^<]{1,2000})""",
    """'SubjectUserSid'>({user_sid}[^"\s<]{1,2000})<""",
    """'SubjectUserName'>({user}[^"\s<]{1,2000})<""",
    """'SubjectDomainName'>({domain}[^"\s<]{1,2000})<""",
    """'SubjectLogonId'>({logon_id}[^"\s<]{1,2000})<""",
    """'ObjectType'>({file_type}[^<]{1,2000})<""",
    """'IpAddress'>({src_ip}[A-Fa-f:\d.]{1,2000})<""",
    """'IpPort'>({src_port}\d{1,100})""",
    """'ShareName'>(?:\\+\*\\+)?({share_name}.+?)<\/Data>""",
    """'ShareLocalPath'>(?:[\\\?]{1,2000})?(?:\s{0,100}|({share_path}({d_parent}[^<]{0,2000}?)({d_name}[^\\<]{1,2000}?)))<\/Data>""",
    """'RelativeTargetName'>((|({f_parent}[^<]{1,2000}?))({file_name}[^\\:<]{1,2000}?(\.({file_ext}[^\\.<]{1,2000}?))?))<\/Data>""",
    """'ObjectType'>({file_type}[^<]{1,2000})<"""
  ]


}