New Ranks & Badges For The Community!
Notice something different? The ranks and associated badges have gone "Star Fleet". See what they all mean HERE
Highlighted
Cadet 1st Class
Cadet 1st Class
905 views

Windows Event 4738 mapping

Hi,

I wanted to share my conditionalmap for Windows 2008 event id 4738. This will help in parsing the User Account Control information to something usable.

#Event id 4738

conditionalmap[0].mappings[84].event.deviceCustomString3=__ifThenElse(__regexToken(__replaceAll(__stringTrim(Changed Attributes:User Account Control),"\\s+","||"),(%%2060)),"%%2060","Smartcard Required Disabled","")

conditionalmap[0].mappings[84].event.deviceCustomString3Label=__stringConstant(User Account Control)


This takes the data in User Account Control and looks for the %%2060 information and writes back, in human words, the action that was taken on the user account. In this case it's Smartcard Disabled. You could change the %%2060 and add other User Account Control information.


You just have to add this in a file named security.sdkkeyvaluefilereader.properties after that put the file in fcp/windowsfg/windows_2008


You could do the same with windows 2012, here is the mapping number for the exact same event in windows 2012:

conditionalmap[0].mappings[90].values=4738


There you go... and have fun.


Labels (2)
0 Likes
1 Reply
Highlighted
Captain
Captain

Hi,

How did you find it out that mapping 84 is for event 4738?

Regards,

Ameer Mane

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.