WinEvenLog for Security EventCode IN (4768) missing parts after Certificate Thumbprint

[jvmerilla]

The log we have for WinEvenLog for Security EventCode IN (4768) is missing the parts
"Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120. EditMore Resources"

This is after Certificate Thumbprint.

This only what we have in Splunk.

The SEDCMD in props.conf were already commented out but still we are not getting this part in Splunk.

[diogofgm]

Have you tried to index the xml version of those event?

[jvmerilla]

Hi @diogofgm ,

Thank you for the response!

We did try to index it as xml but we need to revert it back to the old format because, apparently, in xml format we are missing the "message" field.