Getting Data In

XmlWinEventLog:Security events ::ffff: Remove SED props not working

vemurisurya
Path Finder

Hi
We are collecting the winevent logs in XML format since enabled ipv6 on the DC we are getting src_ip with included ipv6 and IP.
When I am trying to remove the ipv6 (::ffff:) from the src_ip and parse only IP address.

Neither of my props works.

[XmlWinEventLog]
SEDCMD-remove_ffff = s/(?ms)(.*IpAddress\'\>)(::ffff:)(.*)/\1\3/g

[XmlWinEventLog]
SEDCMD-ipaddresssed = s/(::ffff:)//g

My actual event.

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5434-4994-A5BA-3E3B0328C30D}'/><EventID>4769</EventID><Version>0</Version><Level>0</Level><Task>14337</Task><Opcode>0</Opcode><Keywords>0x80200000000000</Keywords><TimeCreated SystemTime='2019-08-07T20:59:39.371042600Z'/><EventRecordID>93547806</EventRecordID><Correlation/><Execution ProcessID='704' ThreadID='1468'/><Channel>Security</Channel><Computer>dcserver.prog.com</Computer><Security/></System><EventData><Data Name='TargetUserName'>dvtest@prog.COM</Data><Data Name='TargetDomainName'>prog.COM</Data><Data Name='ServiceName'>dctest$</Data><Data Name='ServiceSid'>progtest\devtest$</Data><Data Name='TicketOptions'>0x40810000</Data><Data Name='TicketEncryptionType'>0x12</Data><Data Name='IpAddress'>::ffff:10.0.192.53</Data><Data Name='IpPort'>58774</Data><Data Name='Status'>0x0</Data><Data Name='LogonGuid'>{CA2F0CA9-78F8-0F8F-EAA1-269FE090D582}</Data><Data Name='TransmittedServices'>- </Data></EventData></Event> 
0 Karma

vemurisurya
Path Finder

they did all Windows TA App source definitions filed changes on WinEventLog:Security source name , and finally they renamed the source as XmlWinEventLog:Security may be that's the reason my confs are not working.
now i had change my confs by removing the XML from the source OR sourcetype

> [source::WinEventLog:Security]
> SEDCMD-remove_ffff = s/(::ffff:)//g
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...