What is the workaround for the missing Subject_Account_Name field in WMI Windows security events?

[tonopahtaos]

Windows security event 4724 and 4738 set Subject_Account_Name if you get these events through Windows universal forwarder locally. But if you do it through WMI, the Subject_Account_Name is set to NULL. Instead, you can see the user name in Account_Name field for both Subject and Target as multiple values. In that case, you do not know which user name is for Subject and which user name is for Target user.

Is there any workaround on this?

Thanks in advance.

[ziegfried]

You can either use inline-extraction of that field using the rex command:

... | rex "(?ims)^subject:.+?account name:\s+(?<Subject_Account_Name>[^\v]+)"

Or you can add this regex to the sourcetype [WMI:WinEventLog:Security] in props.conf:

[WMI:WinEventLog:Security]
EXTRACT-subjectaccountname = (?ims)^subject:.+?account name:\s+(?<Subject_Account_Name>[^\v]+)

[tonopahtaos]

The second solution works perfectly for me. Thanks a lot.