How to create Splunk alert to detect unauthorized certificate usage?

[MagicVisitor]

Hi,

I am trying to extract a new field to spot unauthrorised certificate usage on a server.  Under event ID 4768, there is a "Certificate Information" heading followed by Certificate Issuer Name, Certificate Serial Number, and Certificate Thumbprint. Ideally, I want to extract the Certificate Thumbprint field so I can create an alert. But because the logs I have so far have empty Certificate Information fields, it's making it difficult to create an expression. Does anyone have ideas how to extract the Certificate Thumbprint field?

Regards,

Mark