WEFTools

0.2.4

Configuration/Definitions/ADPasswordChange.json

{
    "SearchDefinition": {
        "ADPasswordChange": {
            "Events": {
                "Fields": {
                    "Computer": "Domain Controller",
                    "Action": "Action",
                    "Date": "Date",
                    "TargetUserName": "TargetUserName",
                    "TargetDomainName": "TargetDomainName",
                    "ObjectAffected": "ObjectAffected",
                    "ObjectAffectedSID": "TargetSid",
                    "Who": "Who",
                    "NoNameB4": "EventAction",
                    "ID": "Event ID",
                    "RecordID": "Record ID",
                    "GatheredFrom": "Gathered From",
                    "GatheredLogName": "Gathered LogName"
                },
                "Events": [
                    4723,
                    4724
                ],
                "IgnoreWords": {},
                "LogName": "Security",
                "SortBy": "When",
                "Enabled": true
            },
            "Enabled": true
        }
    },
    "LogName": "WEC3-Account-Management"
}