I have McAfee logs coming in to Splunk using Splunk DB Connect application. There are total 3 fields related to user name:
and the mcafee logs tagged to malware, attack, operations and the data is being accelerated by Malware datamodel. Malware data model looks for user and user field is available in McAfee logs, but the problem is I need to consider logonuser/sourcelogonuser not user field, I could simply rename sourcelogonuser/logonuser to user to work with CIM, again the problem with logonuser/sourcelogon_user has username like :
how to deal with the above scenarios, the reason why I would like to reformat the username field from above three scenarios to user, when we search something user=username , it will not return user=domain\username.
please help me out, if any spelunker already faced/solved this problem.