SID To SAMAccountName Translation

Elastic Stack Beats
1

Hey there!

I've found that WinLogBeat is doing some translation of SID's. I'm hoping to leverage this translation for event logs that have multiple SID's. Ie. Event ID 4757 has an SID field for the member being added.

I'm looking to see if there is any way to leverage the SID lookup for this field as well.

Worst case, I can use logstash to trim down the Distinguished Name that is shipped by default with the event.

Thanks!

2

There's no way to configure Winlogbeat to translate other fields at this time. There is an open feature request that I would like to see implemented. You can follow it at https://github.com/elastic/beats/issues/7451.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.