Hi Guys
I need some help and I hope somebody can help me
I would like to capture specific windows security logs with syslog-ng.
Part of a windows event log for example:
Destination Port: 51365
Layer Run-Time ID: 44 (EventID 5156)
Dynamic columns:
.sdata.timequality.issynced=0 |
.sdata.timequality.tzknown=1 |
.sdata.meta.sequenceid=536797 |
.sdata.win@18372.4.event_category=Filtering Platform Connection |
.sdata.win@18372.4.event_facility=16 |
.sdata.win@18372.4.event_id=5156 |
.sdata.win@18372.4.event_level=0 |
.sdata.win@18372.4.event_name=Security |
.sdata.win@18372.4.event_rec_num=705976102 |
.sdata.win@18372.4.event_sid=N/A |
.sdata.win@18372.4.event_source=Microsoft Windows security auditing. |
.sdata.win@18372.4.event_task=Filtering Platform Connection |
.sdata.win@18372.4.event_type=Success Audit |
And here it is my filter from syslog-ng:
filter event_id_ad { match("(?:event_id=)(1102|4612|4624|4625|4656|4663|4672|4676|4704|4705|4719|4720|4722|4723|4724|4725 |4726|4728|4729|4731|4732|4733|4734|4737|4738|4739|4740|4754|4755|4756|4757|4758|4771|4776|4781|4911 |4913|5136|6279
)" value("MESSAGE")); };
I know it isn't so nice
but my biggest problem is I don't know how to concatenate "event_id=" and the exact event ids which are needed for me for example 4624. As you can see unfortunately it collects this message because it matches with
estination Port: 51365
Ty in advance
