windows-auth
Log parser
- Version
- 0.3
Parse windows authentication failure events (id 4625)
Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/exchangeInstalls 10 parsers and 49 scenarios, via Windows - Generic Protection.
View Exchange - Bruteforce Protection →Installation
sudo cscli parsers install crowdsecurity/windows-authThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stage#debug: truefilter: "evt.Parsed.Channel == 'Security' && evt.Parsed.EventID == '4625'"name: crowdsecurity/windows-authdescription: "Parse windows authentication failure events (id 4625)"statics:- meta: source_ipexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='IpAddress']")- meta: usernameexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='TargetUserName']")- meta: statusexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='Status']")- meta: sub_statusexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='SubStatus']")- meta: logon_typeexpression: XMLGetNodeValue(evt.Line.Raw, "/Event/EventData[1]/Data[@Name='LogonType']")- meta: log_typevalue: windows_failed_auth
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
A parser for windows auth events read from the events log.
Only accepts events with from the Security channel with ID 4625.