Hi, am wonder how split the below such event into multi-events in order to extract fields easily, this event from Active directory via syslog
"Feb 21 09:24:17 192.168.1.11 Feb 21 09:15:55 JAMAICA_HQ_MMA microsoft-windows-security-auditing[failure] 4625 An account failed to log on.Subject:Security ID:S-1-0-0Account Name:-Account Domain:-Logon ID:0x0Logon Type:3Account For Which Logon Failed:Security ID:S-1-0-0Account Name:MICRO-HQ-15$Account Domain:MicroDataNetFailure Information:Failure Reason:%2313Status:0xc000006dSub Status:0xc000006aProcess Information:Caller Process ID:0x0Caller Process Name:-Network Information:Workstation Name:MICRO-HQ-15Source Network Address:172.18.10.56Source Port:56465Detailed Authentication Information:Logon Process:NtLmSsp Authentication Package:NTLMTransited Services:-Package Name (NTLM only):-Key Length:0This event is generated when a logon request fails. It isgenerated on the computer where access was attempted.The Subject fields indicate the account on the local systemwhich requested the logon. This is most commonly a servicesuch as the Server service, or a local process such asWinlogon.exe or Services.exe."
**to become something like**
Feb 21 09:24:17 192.168.1.11 Feb 21 09:15:55
JAMAICA_HQ_MMA microsoft-windows-security-auditing [failure]
4625 An account failed to log on.
Subject:Security ID:S-1-0-0
**Account Name:**-
Account Domain:-Logon ID:0x0
Logon Type:3 Account For Which Logon Failed: Security ID:S-1-0-0
Account Name:MICRO-HQ-15
Account Domain:MicroDataNet
**Failure Information**:
Failure Reason:%2313
Status:0xc000006d
Sub Status:0xc000006a
Process Information:Caller Process
ID:0x0
Caller Process Name:-
**Network Information:**
Workstation Name:MICRO-HQ-15 Source Network Address:172.18.10.56
Source Port:56465
**Detailed Authentication Information:**
Logon Process:NtLmSsp
Authentication Package:NTLM
**Transited Services:-**
Package Name (NTLM only):-
Key Length:0
This event is generated when a logon request fails.
It isgenerated on the computer where access was attempted.
The Subject fields indicate the account on the local systemwhich requested the logon.
This is most commonly a servicesuch as the Server service, or a local process such as Winlogon.exe or Services.exe.
↧