field_source,field,field_description
custom,_key,"The key field in the lookup which is lower(DomainDNSName).""#"".lower(objectGUID).  It is unique for every object, and critical for updates and syncing changes."
admon,accountExpires,"The date when the account expires. This value represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). A value of 0 or 0x7FFFFFFFFFFFFFFF (9223372036854775807) indicates that the account never expires."
admon,badPasswordTime,"The last time and date that an attempt to log on to this account was made with a password that is not valid. This value is stored as a large integer that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). A value of zero means that the last time a incorrect password was used is unknown."
admon,badPwdCount,The number of times the user tried to log on to the account using an incorrect password. A value of 0 indicates that the value is unknown.
admon,cn,Maps to 'Name' in the LDAP provider. Remember CN is a mandatory property. See also sAMAccountName.
admon,codePage,Specifies the code page for the user's language of choice.
admon,countryCode,Specifies the country/region code for the user's language of choice.
custom,deleted_flg,"This field contains either a True or False, where True shows the last admon event was for a deletion of the Computer Account."
admon,description,What you see in Active Directory Users and Computers. Not to be confused with displayName on the Users property sheet.
admon,displayName,"If you script this property, be sure you understand which field you are configuring. DisplayName can be confused with CN or description. (Ex. displayName = Guy Thomas.)"
admon,distinguishedName,A DN is a sequence of relative distinguished names (RDN) connected by commas.
admon,dn,A DN is a sequence of relative distinguished names (RDN) connected by commas.
admon,dNSHostName,Name of computer as registered in DNS.
custom,domain,"Using dn to create the fqdn, then populating this with the netbios name using Splunk collected ad data."
custom,DomainDNSName,"Using dn to create the fqdn, then populating this with the netbios name using Splunk collected ad data."
admon,dSCorePropagationData,The DS-Core-Propagation-Data attribute is for internal use only.
custom,evt_flg,This field contains the latest admonEventType value for the User Account admon event.
custom,host,Splunk forwarder host that is sending admon data.
admon,instanceType,A bitfield that dictates how the object is instantiated on a particular server. The value of this attribute can differ on different replicas even if the replicas are in sync.
admon,isCriticalSystemObject,"If TRUE, the object hosting this attribute must be replicated during installation of a new replica."
admon,isDeleted,"If TRUE, this object has been marked for deletion and cannot be instantiated. After the tombstone period has expired, it will be removed from the system."
admon,isRecycled,Is the object recycled. For use with AD Recycle Bin
admon,lastKnownParent,The Distinguished Name (DN) of the last known parent of an orphaned object.
admon,lastLogon,"The last time the user logged on. This value is stored as a large integer that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). A value of zero means that the last logon time is unknown."
admon,lastLogonTimestamp,"This is the time that the user last logged into the domain. This value is stored as a large integer that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). Whenever a user logs on, the value of this attribute is read from the DC. If the value is older [ current_time - msDS-LogonTimeSyncInterval ], the value is updated. The initial update after the raise of the domain functional level is calculated as 14 days minus random percentage of 5 days."
admon,localPolicyFlags,Flags that determine where a computer gets its policy. Local-Policy-Reference.
admon,logonCount,The number of times the account has successfully logged on. A value of 0 indicates that the value is unknown.
admon,memberOf,The memberOf field is no longer available since version 4.0.  Instead the member field in the AD_Obj_Group field is the central field that contains group membership information. Use | lookup AD_Obj_Group member AS dn OUTPUT dn AS memberOf in your search to get the User/Computer/Group membership information.
admon,msDFSR-ComputerReferenceBL,Contains the backward link for the ms-DFSR-ComputerReference attribute.
admon,msDS-SupportedEncryptionTypes,"The encryption algorithms supported by user, computer or trust accounts. (Note:The KDC uses this information while generating a service ticket for this account. Services and Computers can automatically update this attribute on their respective accounts in Active Directory, and therefore need write access to this attribute.)"
admon,name,Exactly the same as CN. (Ex. name = Guy Thomas)
custom,new_flg,"This field contains either a True or False, where True shows that this account was added since the initial admonEventType=Sync event."
admon,objectCategory,"Defines the Active Directory Schema category. For example, objectCategory = Person"
admon,objectClass,"Usually, User, or Computer"
admon,objectGUID,The unique identifier for an object.
admon,objectSid,A binary value that specifies the security identifier (SID) of the user. The SID is a unique value used to identify the user as a security principal.
admon,operatingSystem,"The Operating System name, for example, WindowsæVista Enterprise."
admon,operatingSystemServicePack,"The operating system service pack ID string (for example, SP3)."
admon,operatingSystemVersion,"The operating system version string, for example, 4.0."
admon,primaryGroupID,"Contains the relative identifier (RID) for the primary group of the user. By default, this is the RID for the Domain Users group."
admon,pwdLastSet,"The date and time that the password for this account was last changed. This value is stored as a large integer that represents the number of 100 nanosecond intervals since January 1, 1601 (UTC). If this value is set to 0 and the User-Account-Control attribute does not contain the UF_DONT_EXPIRE_PASSWD flag, then the user must set the password at the next logon."
admon,rIDSetReferences,List of references to RID-Set objects that manage Relative Identifier (RID) allocation.
admon,sAMAccountName,"This is a mandatory property, sAMAccountName = guyt.æ The old NT 4.0 logon name, must be unique in the domain.æ"
admon,sAMAccountType,The sAMAccountType attribute specifies an integer that represents the account type. This is set by the operating system when the object is created.
admon,serverReferenceBL,Found in the domain naming context. The distinguished name of a computer under the sites folder.
admon,servicePrincipalName,List of principal names used for mutual authentication with an instance of a service on this computer.
custom,src_nt_domain,"Using dn to create the fqdn, then populating this with the netbios name using Splunk collected ad data."
custom,uac_bin_map,This field contains the converted binary value for the userAccountControl value. It is used for determining the settings configured for the Computer Account.
custom,uac_details,"This field contains the text string values from the uac_binmap field, displaying the User Account Settings configured for the Computer Account."
admon,userAccountControl,"Used to disable an account.æ A value of 514 disables the account, while 512 makes the account ready for logon. (Ex. Enable (512) / disable account (514))"
admon,uSNChanged,"The update sequence number (USN) assigned by the local directory for the latest change, including creation. See also , USN-Created."
admon,uSNCreated,"The update sequence number (USN) assigned at object creation. See also, USN-Changed"
admon,whenChanged,The date when this object was last changed. This value is not replicated and exists in the global catalog.
admon,whenCreated,The date when this object was created. This value is replicated and is in the global catalog.