Skip to content

Commit 811bdfc

Browse files
committed
The pcre for the second instances of Account Name and Account Domain
were grabbing too much. So modify them to only grab the username and domain name.
1 parent d49a9c1 commit 811bdfc

1 file changed

Lines changed: 2 additions & 3 deletions

File tree

etc/decoder.xml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2022,18 +2022,17 @@ Jan 8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
20222022
<decoder name="windows1">
20232023
<type>windows</type>
20242024
<parent>windows</parent>
2025-
<pcre2> Account Name:[ ]+?([A-Za-z0-9@_-]+?.+)[ ]+?Account</pcre2>
2025+
<pcre2> Account Name:[ ]+?([A-Za-z0-9@_-]+?)[ ]+?Account</pcre2>
20262026
<order>user</order>
20272027
</decoder>
20282028

20292029
<decoder name="windows1">
20302030
<type>windows</type>
20312031
<parent>windows</parent>
2032-
<pcre2>Account Domain:[ ][ ]+?([A-Za-z0-9@_-].+)[ ][ ]+?Logon ID:</pcre2>
2032+
<pcre2>Account Domain:[ ]+?([A-Za-z0-9@_-]+?)[ ]+?Logon ID:</pcre2>
20332033
<order>extra_data</order>
20342034
</decoder>
20352035

2036-
20372036
<!-- Windows decoder -NTsyslog format
20382037
- Will extract extra_data (as win source),action (as win category), id,
20392038
- username and computer name (as url).

0 commit comments

Comments
 (0)