###### Add Host value for Standard Windows Performance Counter Information ###### [source::(Perfmon|WMI:Perfmon)...] FIELDALIAS-Host_for_windows_perfmon = host as Host [source::...Perfmon...] EVAL-componentId = "Perfmon-" . object . "-" . counter EVAL-componentInstance = instance EVAL-componentValue = Value LOOKUP-exc_host = hostInformation host OUTPUT ms_exchange_host [source::...(service|process)...] LOOKUP-exc_host = hostInformation host OUTPUT ms_exchange_host [WinHostMon] EVAL-componentId = "WinHostMon-" . Name EVAL-componentInstance = Path EVAL-componentValue = if((isnull(State) AND Type == "Process") OR (State == "Running" AND Type == "Service"), 1, 0) [MSExchange:2007:Topology] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false EXTRACT-mv=ProductVersion="(?\d+\.\d+) [MSExchange:2010:Topology] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false EXTRACT-mv=ProductVersion="(?\d+\.\d+) [MSExchange:2013:Topology] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false EXTRACT-mv=ProductVersion="(?\d+\.\d+) [MSExchange:2007:Mailbox-Usage] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false FIELDALIAS-Username = User as Username [MSExchange:2010:Mailbox-Usage] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false FIELDALIAS-Username = User as Username [MSExchange:2013:Mailbox-Usage] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false FIELDALIAS-Username = User as Username [MSExchange:2007:Database-Stats] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false [MSExchange:2010:Database-Stats] TIME_FORMAT=%Y-%m-%dT%H:%M:%S%:z TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD = 26 NO_BINARY_CHECK = true CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false [MSExchange:2013:Database-Stats] TIME_FORMAT=%Y-%m-%dT%H:%M:%S%:z TIME_PREFIX=^ MAX_TIMESTAMP_LOOKAHEAD = 26 NO_BINARY_CHECK = true CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false [MSExchange:Reputation] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false [source::XmlWinEventLog:Application] FIELDALIAS-Status_as_Error_Code = Status AS Error_Code EVAL-Error_Code = if(isnull(Error_Code), "-", Error_Code) # LOOKUP-action_for_windows_xmlsecurity = xmlsecurity_eventcode_action_lookup EventCode OUTPUTNEW action, action AS status # LOOKUP-action_for_windows_xmlsecurity_multi_input = xmlsecurity_eventcode_action_lookup_multiinput EventCode, Error_Code OUTPUTNEW action, action as status LOOKUP-action_for_windows_xmlsecurity_input = xmlsecurity_eventcode_errorcode_action_lookup EventCode, Error_Code OUTPUTNEW action, action as status FIELDALIAS-dest_for_xmlwineventlog_application = Computer AS dest ###### All Windows Event Log ###### ###### Windows Application Event Log ###### ## All Windows Application [source::WinEventLog:Application] EVAL-dest = coalesce('ComputerName','Computer') ## Below Extractions are for XmlWinEventLog:Application and have been kept for backward compatibility FIELDALIAS-Status_as_Error_Code = Status AS Error_Code EVAL-Error_Code = if(isnull(Error_Code), "-", Error_Code) # LOOKUP-action_for_windows_xmlsecurity = xmlsecurity_eventcode_action_lookup EventCode OUTPUTNEW action, action AS status # LOOKUP-action_for_windows_xmlsecurity_multi_input = xmlsecurity_eventcode_action_lookup_multiinput EventCode, Error_Code OUTPUTNEW action, action as status LOOKUP-action_for_windows_xmlsecurity_input = xmlsecurity_eventcode_errorcode_action_lookup EventCode, Error_Code OUTPUTNEW action, action as status ##Below fields extractions have been moved from [source::*:Security] and [source::(MonitorWare|NTSyslog|Snare|WinEventLog|WMI:WinEventLog)...] [WMI:WinEventLog:Application] LOOKUP-CategoryString_for_windows = windows_signature_lookup signature_id OUTPUTNEW CategoryString,action,result FIELDALIAS-category_for_windows = TaskCategory as category FIELDALIAS-dvc_for_windows = host AS dvc_nt_host, ComputerName as dvc FIELDALIAS-event_id_for_windows = RecordNumber AS event_id LOOKUP-0severity_for_windows = windows_severity_lookup EventCode OUTPUTNEW severity LOOKUP-1severity_for_windows = windows_severity_lookup Type OUTPUTNEW severity FIELDALIAS-severity_id_for_windows = EventType AS severity_id FIELDALIAS-id_for_windows = RecordNumber AS id REPORT-file_path-file_name_for_windows = file_path-file_name_for_windows ## Default lookup for EventCode->signature mapping ( i.e. EventCode=4625 + SubStaus=null() = "An account failed to log on" ) LOOKUP-signature_for_windows3 = windows_signature_lookup signature_id OUTPUTNEW signature,signature AS name, signature AS subject ## Since FIELDALIAS is destructive we need to preserve signature_id for certain SourceName values EVAL-signature_id = if(SourceName="Microsoft-Windows-WindowsUpdateClient",signature_id,EventCode) FIELDALIAS-user_group_id_for_windows = Primary_Group_ID AS user_group_id FIELDALIAS-dest_for_wmi = ComputerName AS dest FIELDALIAS-pid_for_wmi = IDProcess AS pid ###### Backward Compatibility ###### ## Perfmon Disk Space # "Perfmon:FreeDiskSpace" sourcetype is created from perfmon.conf. [MSExchange:2007:MessageTracking] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = msexchange2007msgtrack-fields,msgtrack-extract-psender,msgtrack-psender,msgtrack-sender,msgtrack-recipients,msgtrack-recipient TRANSFORMS-comments = ignore_comments FIELDALIAS-server_hostname_as_dest = server_hostname AS dest FIELDALIAS-host_as_dvc = host AS dvc EVAL-src = coalesce(original_client_ip,cs_ip) EVAL-product = "Exchange" EVAL-vendor = "Microsoft" LOOKUP-event_id_to_action = event_id_to_action_lookup event_id OUTPUT action FIELDALIAS-user = sender_username AS user FIELDALIAS-orig_dest = ss_ip AS orig_dest FIELDALIAS-dest_ip = ss_ip AS dest_ip FIELDALIAS-return_addr = return_path AS return_addr FIELDALIAS-size = message_size AS size FIELDALIAS-subject = message_subject AS subject EVAL-orig_src = coalesce(original_client_ip,cs_ip) EVAL-protocol = "SMTP" EVAL-vendor_product = "Microsoft Exchange" EVAL-sender = coalesce(PurportedSender,sender) EVAL-src_user = coalesce(PurportedSender,sender) EVAL-sender_username = coalesce(psender_username,sender_username) EVAL-sender_domain = coalesce(psender_domain,sender_domain) [MSExchange:2010:MessageTracking] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = msexchange2010msgtrack-fields,msgtrack-extract-psender,msgtrack-psender,msgtrack-sender,msgtrack-recipients,msgtrack-recipient TRANSFORMS-comments = ignore_comments FIELDALIAS-server_hostname_as_dest = server_hostname AS dest FIELDALIAS-host_as_dvc = host AS dvc EVAL-src = coalesce(original_client_ip,cs_ip) EVAL-product = "Exchange" EVAL-vendor = "Microsoft" LOOKUP-event_id_to_action = event_id_to_action_lookup event_id OUTPUT action FIELDALIAS-user = sender_username AS user FIELDALIAS-orig_dest = ss_ip AS orig_dest FIELDALIAS-dest_ip = ss_ip AS dest_ip FIELDALIAS-return_addr = return_path AS return_addr FIELDALIAS-size = message_size AS size FIELDALIAS-subject = message_subject AS subject EVAL-orig_src = coalesce(original_client_ip,cs_ip) EVAL-protocol = "SMTP" EVAL-vendor_product = "Microsoft Exchange" EVAL-sender = coalesce(PurportedSender,sender) EVAL-src_user = coalesce(PurportedSender,sender) EVAL-sender_username = coalesce(psender_username,sender_username) EVAL-sender_domain = coalesce(psender_domain,sender_domain) [MSExchange:2013:MessageTracking] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = msexchange2013msgtrack-fields,msgtrack-extract-psender,msgtrack-psender,msgtrack-sender,msgtrack-recipients,msgtrack-recipient TRANSFORMS-comments = ignore_comments FIELDALIAS-server_hostname_as_dest = server_hostname AS dest FIELDALIAS-host_as_dvc = host AS dvc EVAL-src = coalesce(original_client_ip,cs_ip) EVAL-product = "Exchange" EVAL-vendor = "Microsoft" LOOKUP-event_id_to_action = event_id_to_action_lookup event_id OUTPUT action FIELDALIAS-user = sender_username AS user FIELDALIAS-orig_dest = ss_ip AS orig_dest FIELDALIAS-dest_ip = ss_ip AS dest_ip FIELDALIAS-return_addr = return_path AS return_addr FIELDALIAS-size = message_size AS size FIELDALIAS-subject = message_subject AS subject EVAL-orig_src = coalesce(original_client_ip,cs_ip) EVAL-protocol = "SMTP" EVAL-vendor_product = "Microsoft Exchange" EVAL-sender = coalesce(PurportedSender,sender) EVAL-src_user = coalesce(PurportedSender,sender) EVAL-sender_username = coalesce(psender_username,sender_username) EVAL-sender_domain = coalesce(psender_domain,sender_domain) [MSWindows:2003:IIS] TZ = GMT REPORT-fields = mswin_2003_iis_fields, extract_webapp, extract_client TRANSFORMS-comments = ignore_comments FIELDALIAS-ipaddress = c_ip as IPAddress FIELDALIAS-cs_user_agent = cs_User_Agent as cs_user_agent [MSWindows:2008R2:IIS] TZ = GMT REPORT-fields = mswin_2008r2_iis_fields, extract_webapp, extract_client TRANSFORMS-comments = ignore_comments FIELDALIAS-ipaddress = c_ip as IPAddress FIELDALIAS-cs_user_agent = cs_User_Agent as cs_user_agent [MSWindows:2012:IIS] TZ = GMT REPORT-fields = mswin_2012_iis_fields, extract_webapp, extract_client TRANSFORMS-comments = ignore_comments FIELDALIAS-ipaddress = c_ip as IPAddress FIELDALIAS-cs_user_agent = cs_User_Agent as cs_user_agent FIELDALIAS-cs_referer = cs_Referer as cs_referer [MSWindows:2013EWS:IIS] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = mswindows2013ews_fields FIELDALIAS-csusername_usersubject = user_subject AS cs_username FIELDALIAS-rawclient_csuseragent = cs_user_agent AS raw_client EVAL-cs_uri_stem = "/EWS/" TRANSFORMS-comments = ignore_comments TRANSFORMS-header = ignore_header EVAL-RpcC = if(ServiceTaskMetadata_RpcCount>0,ServiceTaskMetadata_RpcCount,0) [MSWindows:2010EWS:IIS] SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = mswindows2010ews_fields FIELDALIAS-csusername_usersubject = user_subject AS cs_username FIELDALIAS-rawclient_csuseragent = cs_user_agent AS raw_client EVAL-cs_uri_stem = "/EWS/" TRANSFORMS-comments = ignore_comments TRANSFORMS-header = ignore_header EVAL-RpcC = if(ServiceTaskMetadata_RpcCount>0,ServiceTaskMetadata_RpcCount,0) [MSExchange:2010:DistributionLists] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false [MSExchange:2013:DistributionLists] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false [MSExchange:2010:AdminAudit] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = AdminAudit_ExtractParam,AdminAudit_ExtractError [MSExchange:2013:AdminAudit] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false REPORT-fields = AdminAudit_ExtractParam,AdminAudit_ExtractError [MSExchange:2013:MailboxAudit] CHARSET = UTF-8 SHOULD_LINEMERGE = false CHECK_FOR_HEADER = false [source::WinEventLog:Exchange Auditing] REPORT-fields = exch_audit_user_extraction FIELDALIAS-ipaddress = Address as IPAddress [source::WinEventLog:Security] EXTRACT-4625-fields = (?ms)EventCode=4625.*?Message=.*?\n.*?Subject\s*:.*?Account Name:\s*(?.*?)\n.*?Account Domain:\s*(?.*?)\n.*?Logon ID:\s*(?.*?)\n.*?\nLogon Type:.*?\n.*?Account For Which Logon Failed.*?\n.*?Security ID:(?.*?)\n.*?Account Name:(?.*?)\n.*?Account Domain:(?.*?)\n EXTRACT-4624-srcip = (?ms)EventCode=4624\n.*?Source Network Address:\s+?(?[^\n]+) EXTRACT-4624-user = (?ms)New Logon:\n*?.*?Security ID:\s*?(?[^\\]+)\\(?.*?)\n.*?Account Name:(?.*?)\s*\n.*?Account Domain:\s+(?[^\n]+).*?Logon ID:\s+(?[^\n]+) EXTRACT-group_changes = (?ms)EventCode=(4727|4730|4731|4734|4735|4737|4744|4745|4748|4749|4750|4753|4754|4755|4758|4759|4760|4763|4764).*Message=A (?.*)\-(?(enabled|disabled))\s(?.*)\sgroup\swas\s(?[^\.]+).*Subject:.*Security ID:\s*(?.*)\\(?.*)\s*\n.*Account Name:.*Group:.*Security ID:\s*(?.*)\s*\n.*Group Name:.*Group Domain:(?[^(\r|\n)]+).*Attributes: EXTRACT-group_change_4764 = (?ms)EventCode=(4764)(\n|\r).*Message\=A group’s type was (?[^\.]+) EXTRACT-groupmembership_changes = (?ms)EventCode=(4728|4729|4732|4733|4746|4747|4751|4752|4756|4757|4761|4762).*Message=A member was (?.*) (to|from) a (?.*)\-(?(enabled|disabled)) (?.*) group.*Subject:.*Security ID:\s*(?.*)\\(?.*)\n.*Account Name:.*Account Domain:.*Member:.*Security ID:\s*.*\\(?.*)\n.*Account Name:.*Group:.* EXTRACT-dest_nt_domain_for_4756 = (?msi)EventCode=4756.*(?:Account Domain.*Account Domain|Account Domain(?!(Account Domain)))\:\s+(?[a-zA-Z0-9._[\S\-\S]+)$ EXTRACT-group_changes_event_4756 = (?ms)EventCode\=4756\s*\n.*Member\:.*CN\=(?[^\,]+),CN.*Group\:.*Account\sName\:\s+(?[^(\n|\r|\s)]+).*Account\sDomain\:\s+(?[^(\n|\r|\s)]+).* EXTRACT-group_change_groupname = (?ms)EventCode=(4756)(\n|\r).*Group:(\n|\r).*Security ID:(?.*)\\(?[^(\n|\r)]+)(\r|\n).*Account Name: EXTRACT-4662-fields = (?ms)EventCode=4662\s*\n.*Message=.*?\n.*?Subject\s*:.*?Account Name:\s*(?.*?)\s*\n.*?Account Domain:\s*(?.*?)\s*\n.*?Logon ID:\s*(?.*?)\s*\n EXTRACT-ObjectNameGuid = (?ms)EventCode=4662\s*\n.*Message=.*?Object\s*:.*?Object\sName:\s*(CN=|%)*{*(?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12})}*.* LOOKUP-msadgroupclass = GroupType MSADGroupClassID OUTPUTNEW MSADGroupClass EXTRACT-gpo_changes = (?ms)Object Type\:\s+groupPolicyContainer(\n|\r).*Object\sName\:\s+CN(=|=\")(?\{.*\}) EXTRACT-msad_changes_oldevents = (?ms)EventCode=(624|628)(\n|\r).*Message\=(?[^\:]+) EXTRACT-msad_action_oldevents = (?ms)EventCode=(624|628|642)(\n|\r).*Message\=User\sAccount\s(?[^\:]+) EXTRACT-unlocked_accounts = (?msi)Message\=A\suser\saccount\swas\s(?[^\.]+)\.(\s+|\n+|\r+).*Subject\:(\s+|\n+|\r+).*Account\sName\:\s+(?[^(\s+|\n+|\r+)]+)(\s+|\n+|\r+).*Logon\sID\:\s+(?[^(\s+|\n+|\r+)]+)(\s+|\n+|\r+).*Target\sAccount\:(\s+|\n+|\r+).*?Account Name\:\s+(?[^(\s+|\n+|\r+)]+) EXTRACT-locked_accounts = (?msi)Message\=A\suser\saccount\swas\s(?[^(\.|\s)]+)(\.|\s+|\n+|\r+).*Subject\:(\s+|\n+|\r+).*Account\sName\:\s+(?[^(\s+|\n+|\r+)]+)(\s+|\n+|\r+).*Logon\sID\:\s+(?[^(\s+|\n+|\r+)]+)(\s+|\n+|\r+).*(Account\sThat\sWas\sLocked\sOut|Target\sAccount)\:(\s+|\n+|\r+).*?Account Name\:\s+(?[^(\s+|\n+|\r+)]+) EXTRACT-group_changes_srcuser = (?ms)Account Name\:\s+(?[^(\n|\r|\s)]+)(\r|\n|\s).*Account\sDomain\:\s+(?[^(\n|\r|\s)]+)(\r|\n|\s).*Logon\sID\:\s+(?[^(\n|\r|\s)]+)(\r|\n|\s).*Group\: EXTRACT-PSN=Process Name:.*Microsoft\.Exchange\.(?[^\.]+)\.exe [source::*:System] REPORT-bestmatch_for_windows_system = ComputerName_as_dest,ComputerName_as_src REPORT-package_for_windows_system_update = package_title_for_windows_system_update,package_for_windowsupdatelog LOOKUP-status_for_windows_system_update = windows_update_status_lookup EventCode OUTPUTNEW status REPORT-user_for_windows_system = user_for_windows_system_ias EVAL-vendor = "Microsoft" EVAL-product = "Windows" [WindowsUpdateLog] FIELDALIAS-dest_for_windowsupdatelog = host as dest REPORT-0package_message_for_windowsupdatelog = package_message_for_windowsupdatelog REPORT-1package_title_for_windowsupdatelog = package_title_for_windowsupdatelog,package_title_for_windowsupdatelog_restartrequired,package_title_for_windowsupdatelog_package_message REPORT-package_for_windowsupdatelog = package_for_windowsupdatelog REPORT-pid-tid-component_for_windowsupdatelog = pid-tid-component_for_windowsupdatelog LOOKUP-status_for_windowsupdatelog = windows_update_status_lookup vendor_status OUTPUTNEW status