All Apps and Add-ons

XMLWineventlog: How can we Map Security CategoryID and SubcategoryID?



Recently, we have changed the format of how our winventlog data is being fed to Splunk. From the classic format, we had it changed to XML. 

I found out that there is a difference in how data was also extracted when it was in classic versus when it is in XML. One would be for EventCode=4719, I noticed that before, in classic, we used to have Category and Subcategory fields but switching to XML, we are getting CategoryId and SubcategoryId. 

The challenge was, that we don't have any means to convert these IDs into their own meaning. I have been looking for any lookup that comes with the Splunk Add-on for Windows in order for me to map these ids but unfortunately can't find one. 

I tried to check Microsoft Windows documents but to no avail cannot find how to get the values for these ids.

Can anyone help how we can map the CategoryId and SubcategoryId?

Thanks in advance!

Labels (4)
0 Karma


Set up a field alias.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...