Hello ,
I am trying filter certain windows security events of interest and relabel some fields, see example below , but i don’t have any results yet , any help example would be appreciated
Thanks
2023-05-22 09:07:59.311 (no unique labels)
{
"source": "Microsoft-Windows-Security-Auditing",
"channel": "Security",
"computer": server.local",
"event_id": 4624,
"version": 2,
"task": 12544,
"levelText": "Information",
"taskText": "Logon",
"opCodeText": "Info",
"keywords": "Audit Success",
"timeCreated": "2023-05-22T06:07:58.178054200Z",
"eventRecordID": 3269032672,
"execution": {
"processId": 788,
"threadId": 7336,
"processName": "lsass.exe"
},
"event_data": "<Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>server$</Data><Data Name='SubjectDomainName'>domain</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='TargetUserSid'>S-1-5-21-2752612933-1646568981-4245257801-1430</Data><Data Name='TargetUserName'>ldap_search</Data><Data Name='TargetDomainName'>domain</Data><Data Name='TargetLogonId'>0xa3f101aeb</Data><Data Name='LogonType'>3</Data><Data Name='LogonProcessName'>Advapi </Data><Data Name='AuthenticationPackageName'>MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data><Data Name='WorkstationName'>server</Data><Data Name='LogonGuid'>{00000000-0000-0000-0000-000000000000}</Data><Data Name='TransmittedServices'>-</Data><Data Name='LmPackageName'>-</Data><Data Name='KeyLength'>0</Data><Data Name='ProcessId'>0x314</Data><Data Name='ProcessName'>C:\\Windows\\System32\\lsass.exe</Data><Data Name='IpAddress'>172.18.13.46</Data><Data Name='IpPort'>45050</Data><Data Name='ImpersonationLevel'>%%1833</Data><Data Name='RestrictedAdminMode'>-</Data><Data Name='TargetOutboundUserName'>-</Data><Data Name='TargetOutboundDomainName'>-</Data><Data Name='VirtualAccount'>%%1843</Data><Data Name='TargetLinkedLogonId'>0x0</Data><Data Name='ElevatedToken'>%%1842</Data>",
"message": "An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tDLT-BSH-AD01$\r\n\tAccount Domain:\t\tdomain\r\n\tLogon ID:\t\t0x3E7\r\n\r\nLogon Information:\r\n\tLogon Type:\t\t3\r\n\tRestricted Admin Mode:\t-\r\n\tVirtual Account:\t\tNo\r\n\tElevated Token:\t\tYes\r\n\r\nImpersonation Level:\t\tImpersonation\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-21-2752612933-1646568981-4245257801-1430\r\n\tAccount Name:\t\tldap_search\r\n\tAccount Domain:\t\tdomain\r\n\tLogon ID:\t\t0xA3F101AEB\r\n\tLinked Logon ID:\t\t0x0\r\n\tNetwork Account Name:\t-\r\n\tNetwork Account Domain:\t-\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x314\r\n\tProcess Name:\t\tC:\\Windows\\System32\\lsass.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\tserver\r\n\tSource Network Address:\t172.18.13.46\r\n\tSource Port:\t\t45050\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi \r\n\tAuthentication Package:\tMICROSOFT_AUTHENTICATION_PACKAGE_V1_0\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe impersonation level field indicates the extent to which a process in the logon session can impersonate.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested."
}
