XmlWinEventLog:Security events ::ffff: Remove SED props not working

vemurisurya — Wed, 30 Sep 2020 01:39:35 GMT

Hi
We are collecting the winevent logs in XML format since enabled ipv6 on the DC we are getting src_ip with included ipv6 and IP.
When I am trying to remove the ipv6 (::ffff:) from the src_ip and parse only IP address.

Neither of my props works.

[XmlWinEventLog]
SEDCMD-remove_ffff = s/(?ms)(.*IpAddress\'\>)(::ffff:)(.*)/\1\3/g

[XmlWinEventLog]
SEDCMD-ipaddresssed = s/(::ffff:)//g

My actual event.

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5434-4994-A5BA-3E3B0328C30D}'/><EventID>4769</EventID><Version>0</Version><Level>0</Level><Task>14337</Task><Opcode>0</Opcode><Keywords>0x80200000000000</Keywords><TimeCreated SystemTime='2019-08-07T20:59:39.371042600Z'/><EventRecordID>93547806</EventRecordID><Correlation/><Execution ProcessID='704' ThreadID='1468'/><Channel>Security</Channel><Computer>dcserver.prog.com</Computer><Security/></System><EventData><Data Name='TargetUserName'>dvtest@prog.COM</Data><Data Name='TargetDomainName'>prog.COM</Data><Data Name='ServiceName'>dctest$</Data><Data Name='ServiceSid'>progtest\devtest$</Data><Data Name='TicketOptions'>0x40810000</Data><Data Name='TicketEncryptionType'>0x12</Data><Data Name='IpAddress'>::ffff:10.0.192.53</Data><Data Name='IpPort'>58774</Data><Data Name='Status'>0x0</Data><Data Name='LogonGuid'>{CA2F0CA9-78F8-0F8F-EAA1-269FE090D582}</Data><Data Name='TransmittedServices'>- </Data></EventData></Event>

Re: XmlWinEventLog:Security events ::ffff: Remove SED props not working

vemurisurya — Thu, 08 Aug 2019 17:45:54 GMT

they did all Windows TA App source definitions filed changes on WinEventLog:Security source name , and finally they renamed the source as XmlWinEventLog:Security may be that's the reason my confs are not working.
now i had change my confs by removing the XML from the source OR sourcetype

> [source::WinEventLog:Security]
> SEDCMD-remove_ffff = s/(::ffff:)//g

topic Re: XmlWinEventLog:Security events ::ffff: Remove SED props not working in Getting Data In

XmlWinEventLog:Security events ::ffff: Remove SED props not working

Re: XmlWinEventLog:Security events ::ffff: Remove SED props not working