WINC Status and SubStatus

[dengelhardt]

Hi,

I have a Use Case looking at the Status and the SubStatus field in Windows Events (4625 and 4776). Now WINC does not have these codes mapped it seems. Actually the guide claims that SubStatus for 4625 is mapped to Device Custom String 1, but there I can e.g. see "User logon with misspelled or bad password" while the RAW EVENT says "SubStatus":"0xc000006a". So this might be a mapping somehow. But I njeed the code, no text.

Anyways, I tried to map Status and SubStatus using additional data mapping. However that does only work for Status, as SubStatus has not been seen.

Any idea how I can map the SubStatus? A parser overwrite would be another alternative but since MicroFocus decided to never hand out any original parsers, that feature has been made obsolete and useless.

[mr_ergene]

Hi @dengelhardt ,

In my test environment, the Substatus is deviceCustomString4. If you enabled the aggregation on the connector, check the fields and add deviceCustomString4 if it's not there. Or disable aggregation for a while to see if the field is populated.

[dengelhardt]

Hi,

sadly DC4 includes the STATUS code for 4776 only.

DC1 does have the SUBSTATUS but as TEXT for 4625.

[Richie D · Accepted solution]

As you have pointed out in your original post, you can map the field:

Create the mapping file:

<connectorroot>\current\user\agent\fcp\winc\security\microsoft_windows_security_auditing.sdkkeyvaluefilereader.properties 

and include the following text:

conditionalmap[0].mappings[12].event.deviceCustomString6=SubStatus
conditionalmap[0].mappings[12].event.deviceCustomString6Label=__stringConstant("Sub Status")

The above maps to deviceCustomString6

[dengelhardt]

Hi,

the parser overwrite is working. I am using this as overwrite now:

conditionalmap[0].mappings[12].event.flexString1=Status
conditionalmap[0].mappings[12].event.flexString1Label=__stringConstant("Status")

conditionalmap[0].mappings[12].event.flexString2=SubStatus
conditionalmap[0].mappings[12].event.flexString2Label=__stringConstant("Sub Status")

conditionalmap[0].mappings[12].event.flexNumber1=KeyLength
conditionalmap[0].mappings[12].event.flexNumber1Label=__stringConstant("Key Length")

 Let´s hope they do not change the parser so that I accidently overwrite something with that...

David

[dengelhardt]

Do you happen to know how I can do the same overwrite for 4776?

[muratekren]

0xc000006a is mapped to that text in the buildin parser.

if you need the code in your logs you can re-map that to that code , just put a map.0.properties or edit a current one in your connectors /current/user/agent/map folder with the entries below . 

event.externalId,event.deviceCustomString1,set.event.deviceCustomString1

4625,"User logon with misspelled or bad password",0xc000006

Or If you need that code to correlate with a field from another event,  just use a pre-persistence rule and set that event field to the original code ? 

[dengelhardt]

Hi,

nice idea, but some texts are duplicates for different codes! Which is why it is irreversible. I´d need the ORIGINAL code sadly.

Regards,

David