


<Extension syslog>

	Module xm_syslog

</Extension>



<Input WindowsLog>
# Append this Input to the Path
define PATHGLOB %PATHGLOB%, \
 WindowsLog

	Module im_mseventlog
	Sources %SOURCES%


#	Here, we do the following:
#		Convert EventType to true SNARE-compatible wording;
#		Utilize a stats counter to attempt to simulate the message # count used by SNARE;
#		Capture the Domain & AccountName information, in case they are available;
#		Then, iteratively, look for one of two possible sources of other credential info,
#		 if the original values were null (and remember that those may have an embedded
#		 space);
#               Set an "N/A" result if no viable credentials are found;
#		Check for possible Account Name and Domain info, and construct a creds variable if found;
#		If the result from above is only the backslash, then the variables existed, but both were
#			null, so we set "N/A", but if "N/A" was still set, then we try for a set of
#			Login Account credentials, and set the creds variable to that value;
#		Lastly, we parse the raw_event, and plug in the Filename, counter, and creds, in the places
#			where nxlog does not set these things properly.
	Exec if ( $EventType == "AUDIT_SUCCESS" ) \
		$EventType = "Success Audit"; \
	else if ( $EventType == "AUDIT_FAILURE" ) \
		$EventType = "Failure Audit"; \
	else if ( $EventType == "INFO" ) \
		$EventType = "Information"; \
	else if ( $EventType == "CRITICAL" ) \
		$EventType = "Critical"; \
	else if ( $EventType == "ERROR" ) \
		$EventType = "Error"; \
	else if ( $EventType == "WARNING" ) \
		$EventType = "Warning"; \
	else if ( $EventType == "VERBOSE" ) \
		$EventType = "Verbose"; \
	to_syslog_snare(); \
	create_stat('counter', "COUNT",45); add_stat('counter', 1); $creds = $Domain + '\' + $AccountName; \
	if $creds == '\' \
		{if $raw_event =~ /User Name: +(\S+ *\S+)? +Domain: +(\S+ *\S+)? +Logon ID/ $creds = $2 + '\' + $1;} \
	if $creds == '\' {if $raw_event =~ /Logon Account: +(\S+ *\S+)? +Source Work/ $creds = $1;} \
	if $creds == '\' $creds = "N/A"; \
	if $raw_event =~ /^(.*?\t.*?\t).*?\t.*?\t(.*?\t.*?\t.*?\t).*?(\t.*)$/ \
		$raw_event = $1 + $FileName + "\t" + get_stat('counter') + "\t" + $2 + $creds + $3;


</Input>

