-
Notifications
You must be signed in to change notification settings - Fork 366
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[BUG] ESCU CS fields LogonType and TargetUserName #2869
Comments
After spending countless hours troubleshooting issues of this character i can conclude the following: My experience from every version of the Windows TA and ESCU that I have used is that only a handful of fields actually have aliases or evals that convert from the PascalCase names found in XmlWinEventlog to the classic WinEventLog Snake_Case correctly and that most if not all ESCU searches make use of the classic WinEventLog field names. To this you might respond "Why would you use Xml then?" The alternative in an international or mixed language environment is that you will have to manually translate most if not all field extractions and evals to support all the languages in your environment. I have encountered this same issue across multiple production environments so I am pretty sure this is not an isolated case, and googling similar issues return multiple splunk community discussions on this exact topic. My suggestion to fix these issue for good is for all fields names used in ESCU searches to be inventoried. Examples:
And so on |
I can not stress enough how right hampusstrom is in his assesment of this problem. This problem makes Enterprise Security more or less useless for our clients of many languages. |
Thank you so much for raising this up .. definitely a pain point we are now keenly aware of .. not sure what the exact plan for fix is yet but will make sure I come back to you once we have a fix. |
Describe the bug
There are some CS that are not using the correct field name using the last version of the "Splunk Add-on for Microsoft Windows".
Expected behavior
Some CS need to be change to the correct field names.
Field Original Name > New Name
LogonType > Logon_Type
TargetUserName > Target_User_Name > user
https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+LogonType&type=code
https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+TargetUserName&type=code
https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+Target_User_Name&type=code
App Version:
Splunk Version 9.0.4.1
ES Content Updates 4.12.0
Enterprise Security 7.1.1
The text was updated successfully, but these errors were encountered: