index=ad_authentiation EventCode=624 | rex field=_raw "User=(?<AD_Admin>.+)" | rex field=_raw "ComputerName=(?<AD_System>.+)"|rex field=_raw "New\sAccount\sName:\s(?<AD_NewUser>.+)" |rex field=_raw "New\sDomain:\s(?<AD_Domain>.+)" | rex field=_raw "Primary\sGroup\sID:\s(?<AD_GID>.+)" | rex field=_raw "Display\sName:\s(?<AD_DisplayName>.+)" |rex field=_raw "Account\sExpires:\s\<(?<AcctExpires>.+)\>" |rex field=_raw "'Password\sNot\sRequired\'\s\-(?<PasswdNOTRequired>.+)" |convert ctime(_time) as timestamp | table timestamp,AD_NewUser,AD_Domain,AD_GID,AD_DisplayName,AD_System,AD_Admin,AcctExpires,PasswdNOTRequired
... View more