How to translate SID to Username via the Lookup Table?

[Kendo213]

I have a lookup file which contains various fields, including the username and corresponding SID (pulled from AD).

I have a Windows event with data showing as User=NOT_TRANSLATED and Sid=(a value)

The CSV file contains a field named User and a field named Sid that matches.

I'm wanting to reference the lookup table to identify the username of the sid that is in the event data.

There is is where I am, and obviously it isn't working:

index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511  [| inputlookup ldap_identities.csv |  fields Sid,identity] | eval User=identity |  stats count by Sid,User

Any ideas?

[bgriffis]

How did you get the Sid/Username lookup?

[Kendo213 · Accepted solution]

I figured this out:

index=blah SourceName="Microsoft-Windows-User Profile Service" EventCode=1511 | lookup ldap_identities.csv Sid OUTPUT identity | rename identity as User | stats count by User,Sid,host