All Apps and Add-ons

XMLWineventlog: How can we Map Security CategoryID and SubcategoryID?



Recently, we have changed the format of how our winventlog data is being fed to Splunk. From the classic format, we had it changed to XML. 

I found out that there is a difference in how data was also extracted when it was in classic versus when it is in XML. One would be for EventCode=4719, I noticed that before, in classic, we used to have Category and Subcategory fields but switching to XML, we are getting CategoryId and SubcategoryId. 

The challenge was, that we don't have any means to convert these IDs into their own meaning. I have been looking for any lookup that comes with the Splunk Add-on for Windows in order for me to map these ids but unfortunately can't find one. 

I tried to check Microsoft Windows documents but to no avail cannot find how to get the values for these ids.

Can anyone help how we can map the CategoryId and SubcategoryId?

Thanks in advance!

Labels (4)
0 Karma


Set up a field alias.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...