Windows events and %%something entries

Getting Data In

Hi.

I'm using TA for Windows and everything is mostly working OK. But.

In some events I'm receiving values like

If I understand correctly, that's _not_ what evt_resolve_ad_obj option should affect, right? That option affects only resolving (or not) SID-s to usernames/groups and this is something completely different, right?

What is it then? And can I force my UF to forward the same contents that I see in Event Log Viewer?

In this case it's

Read Operation: Enumerate Credentials

I understand that it's something that event log viewer is rendering on its own, because in detail view of the event, it does indeed show %%8100 as ReadOperation so it's apparently the program's intepretation of this data that says "Enumerate Credentials".

So I suppose there'd have to be some lookups to "humanize" the events, right?

Get Updates on the Splunk Community!

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Enriching Signals with the OTel Lookup Processor

Introduction Raw telemetry is often incomplete. A log line might record an IP address, but what you really ...