Hello,
We have Splunk Add-on for Microsoft Windows (Splunk_TA_windows) deployed in our environment. There are 2 lookup tables which have information about the event codes in the add-on:
Name: xmlsecurity_eventcode_action_lookup
Supported Fields: EventCode,action,Category,Subcategory,message,os
Lookup File: xmlsecurity_eventcode_action.csv
App: Splunk_TA_windows
Status: Enabled
Name: xmlsecurity_eventcode_action_lookup_multiinput
Supported Fields: EventCode,action,Error_Code,Description
Lookup File:xmlsecurity_eventcode_action_multiinput.csv
App: Splunk_TA_windows
Status: Enabled
When I checked the input lookup tables xmlsecurity_eventcode_action.csv & xmlsecurity_eventcode_action_multiinput.csv the event codes 4725 and 4726 are present.
However I was not able to see the event code related logs.
Appreciate help.
Thanks,
Krish
