topic Re: What is the workaround for the missing Subject_Account_Name field in WMI Windows security events? in Getting Data In

What is the workaround for the missing Subject_Account_Name field in WMI Windows security events?

tonopahtaos — Mon, 28 Sep 2020 12:16:28 GMT

Windows security event 4724 and 4738 set Subject_Account_Name if you get these events through Windows universal forwarder locally. But if you do it through WMI, the Subject_Account_Name is set to NULL. Instead, you can see the user name in Account_Name field for both Subject and Target as multiple values. In that case, you do not know which user name is for Subject and which user name is for Target user.

Is there any workaround on this?

Thanks in advance.

Re: What is the workaround for the missing Subject_Account_Name field in WMI Windows security events?

ziegfried — Thu, 16 Aug 2012 10:35:53 GMT

You can either use inline-extraction of that field using the rex command:

... | rex "(?ims)^subject:.+?account name:\s+(?<Subject_Account_Name>[^\v]+)"

Or you can add this regex to the sourcetype [WMI:WinEventLog:Security] in props.conf:

[WMI:WinEventLog:Security]
EXTRACT-subjectaccountname = (?ims)^subject:.+?account name:\s+(?<Subject_Account_Name>[^\v]+)

Re: What is the workaround for the missing Subject_Account_Name field in WMI Windows security events?

tonopahtaos — Thu, 16 Aug 2012 18:30:00 GMT

The second solution works perfectly for me. Thanks a lot.