Public feed
#891454
2008-02-04T17:21:36+0000 10.208.240.110 [syslog.info] MSWinEventLog 1 Security 10072140 Mon Feb 04 09:29:02 2008 673 Security SYSTEM User Success Audit CHI2K3DS01 Account Logon Service Ticket Request: User Name: THOMASA@CHI.WARRANTY.LOCAL User Domain: CHI.WARRANTY.LOCAL Service Name: USCHINTFS816$ Service ID: %{S-1-5-21-531451982-1846984212-2848423757-2531} Ticket Options: 0x40800000 Ticket Encryption Type: 0x17 Client Address: 10.208.244.56 Failure Code: - Logon GUID: {390999b3-2f06-c42c-16b1-53c6b4c7ac2c} Transited Services: - 10072139
HOST=Security
* Report on all hosts
* Search for this host
* Tag host
|
SOURCE=/var/log/buffers/windows
* Report on all sources
* Search for this source
|
SOURCETYPE=windows_snare_syslog
* Report on all sourcetypes
* Search for this sourcetype
* Edit sourcetype alias
02/04/08 17:21:36
* Search SplunkBase
* Show source
2008-02-04T17:21:36+0000 70.42.85.25 [syslog.info] MSWinEventLog 1 Security 564952 Mon Feb 04 11:21:25 2008 528 Security HerculesServer User Success Audit USCHISECRA03 Logon/Logoff Successful Logon: User Name: HerculesServer Domain: USCHISECRA03 Logon ID: (0x0,0xEEF70C6) Logon Type: 2 Logon Process: Advapi Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Workstation Name: USCHISECRA03 Logon GUID: - Caller User Name: USCHISECRA03$ Caller Domain: WORKGROUP Caller Logon ID: (0x0,0x3E7) Caller Process ID: 2756 Transited Services: - Source Network Address: - Source Port: - 564951