security_content/data_sources/endpoint/Windows_Security_4798.yml at develop · Elmo-Riyani/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
name: Windows Security 4798
id: f342f8a6-889d-4a08-a0ca-3d29e05ad116
date: '2022-11-28'
author: Patrick Bareiss, Splunk
type: wineventlog_security
source: WinEventLog:Security
sourcetype: WinEventLog
service: security
product: windows
supported_TA:
- name: Splunk Add-on for Microsoft Windows
  version: 8.5.0
  url: https://splunkbase.splunk.com/app/742
references:
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4798
raw_fields:
- Account_Domain
- Account_Name
- ComputerName
- Logon_ID
- Process_ID
- Process_Name
- Security_ID