Microsoft ADFS Collection Parsing Rule

Parsing Rule

Details

ID	`microsoft_adfs_collection_Parsing_Rule`
From Version	8.3.0
Tags	Microsoft Windows Active Directory Federation Services ADFS Event Colletion

Source

MicrosoftADFSParsingRules.xif MicrosoftADFSParsingRules.yml

Download History Raw

[INGEST:vendor="microsoft", product="windows", target_dataset="microsoft_adfs_raw", no_hit=drop]
filter to_string(time_created) ~= ".*\d{2}:\d{2}:\d{2}.*" AND _collector_type = "WEC" AND (provider_name = "AD FS Auditing" OR provider_name = "AD FS")
| alter _time = time_created;