Key Value pairs for Description field about kinesis-agent-windows HOT 3 OPEN

another option would be to add a keys to the EventData{} values.

from kinesis-agent-windows.

"EventData": [{ "BinaryLength": 12, "AccountDomainSid": null, "Value": "S-1-1-1-1" }, "Admin$", "somecompany", 999, 7272, "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "%%1936", 832, "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding", { "BinaryLength": 12, "AccountDomainSid": null, "Value": "S-1-1-1" }, "me$", "somecompany", 996, "C:\\Windows\\System32\\svchost.exe", { "BinaryLength": 12, "AccountDomainSid": null, "Value": "1-1-1-1-11" }],

currently event data looks like this and has Values but no keys to identify the data. Is there an easy way to attach the keys ?

from kinesis-agent-windows.

This seems to be the only way i can figure out how to extract the KV pairs from the data. There must be a better way.

`{
"Sources": [
{
"Id": "SecurityLog",
"SourceType": "WindowsEventLogSource",
"IncludeEventData": "true",
"LogName": "Security",
"CustomFilters": "ExcludeOwnSecurityEvents"
},
{
"Id": "SysmonSecurityLog",
"SourceType": "WindowsEventLogSource",
"IncludeEventData": "true",
"LogName": "Microsoft-Windows-Sysmon/Operational"
}
],
"Sinks": [
{
"Id": "KinesisStream",
"SinkType": "KinesisStream",
"StreamName": "prod-logs",
"Region": "us-west-2",
"ObjectDecorationEx": "Creator.Security ID={regexp_extract(_record, '\r\n\r\nCreator Subject:\r\n\tSecurity ID:\t\t(.+)\r',1)};Creator.Account Domain={regexp_extract(_record, '\r\n\r\nCreator Subject:\r\n\tSecurity ID:\t\t.+\r\n\tAccount Name:\t\t.+\r\n\tAccount Domain:\t\t(.+)\r',1)};Creator.Account Name={regexp_extract(_record, '\r\n\r\nCreator Subject:\r\n\tSecurity ID:\t\t.+\r\n\tAccount Name:\t\t(.+)\r',1)};Subject.Security ID={regexp_extract(_record, '\r\n\r\nSubject:\r\n\tSecurity ID:\t\t(.+)\r',1)};Subject.Security ID={regexp_extract(_record, '\r\n\r\nSubject :\r\n\tSecurity ID:\t\t(.+)\r',1)};Subject.Account Name={regexp_extract(_record, '\r\n\r\nSubject:\r\n\tSecurity ID:\t\t.+\r\n\tAccount Name:\t\t(.+)\r',1)};Subject.Account Name={regexp_extract(_record, '\r\n\r\nSubject :\r\n\tSecurity ID:\t\t.+\r\n\tAccount Name:\t\t(.+)\r',1)};Subject.Account Domain={regexp_extract(_record, '\r\n\r\nSubject:\r\n\tSecurity ID:\t\t.+\r\n\tAccount Name:\t\t.+\r\n\tAccount Domain:\t\t(.+)\r',1)};Subject.Account Domain={regexp_extract(_record, '\r\n\r\nSubject :\r\n\tSecurity ID:\t\t.+\r\n\tAccount Name:\t\t.+\r\n\tAccount Domain:\t\t(.+)\r',1)};Target.Security ID={regexp_extract(_record, '\r\n\r\nTarget Subject:\r\n\tSecurity ID:\t\t(.+)\r',1)};Target.Account Name={regexp_extract(_record, '\r\n\r\nTarget Subject:\r\n\tSecurity ID:\t\t.\r\n\tAccount Name:\t\t(.+)\r',1)};Target.Account Name={regexp_extract(_record, '\r\n\r\nAccount Whose Credentials Were Used:\r\n\tAccount Name:\t\t(.+)\r',1)};Target.Account Name={regexp_extract(_record, '\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\t.\r\n\tAccount Name:\t\t(.+)\r',1)};Target.Account Domain={regexp_extract(_record, '\r\n\r\nTarget Subject:\r\n\tSecurity ID:\t\t.+\r\n\tAccount Name:\t\t.+\r\n\tAccount Domain:\t\t(.+)\r',1)}",
"Format": "json",
}
],
"Pipes": [
{
"Id": "SecurityLogToKinesisStream",
"SourceRef": "SecurityLog",
"SinkRef": "KinesisStream"
},
{
"Id": "SysmonLogToKinesisStream",
"SourceRef": "SysmonSecurityLog",
"SinkRef": "KinesisStream"
}
],
"Telemetrics": {
"off": "true"
}
}

from kinesis-agent-windows.