name: Windows Event Log Security 4672
id: 43f189b6-369d-4a32-a34c-57e0d38d92f1
version: 1
date: '2024-07-18'
author: Patrick Bareiss, Splunk
description: Data source object for Windows Event Log Security 4672
source: XmlWinEventLog:Security
sourcetype: xmlwineventlog
separator: EventCode
supported_TA:
- name: Splunk Add-on for Microsoft Windows
  url: https://splunkbase.splunk.com/app/742
  version: 8.9.0
fields:
- _time
- ActivityID
- Caller_Domain
- Caller_User_Name
- Channel
- Computer
- Error_Code
- EventCode
- EventData_Xml
- EventID
- EventRecordID
- Guid
- Keywords
- Level
- Logon_ID
- Name
- Opcode
- PrivilegeList
- ProcessID
- RecordNumber
- SubjectDomainName
- SubjectLogonId
- SubjectUserName
- SubjectUserSid
- SystemTime
- System_Props_Xml
- Task
- ThreadID
- Version
- action
- app
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- dvc
- dvc_nt_host
- event_id
- eventtype
- host
- id
- index
- linecount
- name
- product
- punct
- session_id
- signature
- signature_id
- source
- sourcetype
- splunk_server
- src_nt_domain
- src_user
- status
- subject
- ta_windows_action
- tag
- tag::action
- tag::eventtype
- timeendpos
- timestartpos
- vendor
- vendor_product
example_log: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider
  Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4672</EventID><Version>0</Version><Level>0</Level><Task>12548</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated
  SystemTime='2023-03-27T18:35:15.439521100Z'/><EventRecordID>148946</EventRecordID><Correlation
  ActivityID='{a51712a7-60c1-0000-3513-17a5c160d901}'/><Execution ProcessID='624'
  ThreadID='728'/><Channel>Security</Channel><Computer>ar-win-6.attackrange.local</Computer><Security/></System><EventData><Data
  Name='SubjectUserSid'>ATTACKRANGE\REED_MORSE</Data><Data Name='SubjectUserName'>REED_MORSE</Data><Data
  Name='SubjectDomainName'>ATTACKRANGE</Data><Data Name='SubjectLogonId'>0x509b11</Data><Data
  Name='PrivilegeList'>SeSecurityPrivilege