https://community.splunk.com/t5/Getting-Data-In/Splunk-TA-Windows-clash-with-ADFS-lookup/m-p/575070#M101644 <P>Hi,</P><P>MS ADFS will write inside WinEventLog:security and Splunk_TA_windows is watching that log and enriching with lookup.</P><P>Issue here is that AD FS have same ID's like some other.</P><P>Example: EventCode=516 should be "The following user account has been locked out due to too many bad password attempts. Additional Data Activity ID: %1 User: %2 Client IP: %3 nBad Password Count: %4 nLast Bad Password Attempt: %5" while Splunk_TA_windows will enrich it to: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits<BR /><BR />how can I override default Splunk_TA_windows lookup if <SPAN class="">Provider</SPAN> <SPAN class="">Name=</SPAN>'<SPAN class="">AD</SPAN> <SPAN class="">FS</SPAN> <SPAN class="">Auditing</SPAN>' is AD FS Auditing, so then I can enrich with ADFS table else use default lookup.</P> Tue, 16 Nov 2021 15:31:33 GMT jbanAtSplunk 2021-11-16T15:31:33Z https://community.splunk.com/t5/Getting-Data-In/Splunk-TA-Windows-clash-with-ADFS-lookup/m-p/575070#M101644 <P>Hi,</P><P>MS ADFS will write inside WinEventLog:security and Splunk_TA_windows is watching that log and enriching with lookup.</P><P>Issue here is that AD FS have same ID's like some other.</P><P>Example: EventCode=516 should be "The following user account has been locked out due to too many bad password attempts. Additional Data Activity ID: %1 User: %2 Client IP: %3 nBad Password Count: %4 nLast Bad Password Attempt: %5" while Splunk_TA_windows will enrich it to: Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits<BR /><BR />how can I override default Splunk_TA_windows lookup if <SPAN class="">Provider</SPAN> <SPAN class="">Name=</SPAN>'<SPAN class="">AD</SPAN> <SPAN class="">FS</SPAN> <SPAN class="">Auditing</SPAN>' is AD FS Auditing, so then I can enrich with ADFS table else use default lookup.</P> Tue, 16 Nov 2021 15:31:33 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-TA-Windows-clash-with-ADFS-lookup/m-p/575070#M101644 jbanAtSplunk 2021-11-16T15:31:33Z