Event Details
| Event Type | Audit Directory Service Replication, Audit Detailed Directory Service Replication, Audit Logon |
|---|
| Event Description | - 4675(S) : SIDs were filtered.
- 4928(S, F) : An Active Directory replica source naming context was established.
- 4931(S, F) : An Active Directory replica destination naming context was modified.
- 4932(S) : Synchronization of a replica of an Active Directory naming context has begun.
- 4933(S, F) : Synchronization of a replica of an Active Directory naming context has ended.
|
|---|
| Event IDs | 4675, 4928, 4931, 4932, 4933 |
|---|
Log Fields and Parsing
This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.
| Log Field | LogRhythm Default | LogRhythm Default v2.0 |
|---|
| Provider | <vendorinfo> | N/A |
| EventID | <vmid> | <vmid> |
| Version | <version> | N/A |
| Level | <severity> | <severity> |
| Task | <process> | <vendorinfo> |
| Opcode | N/A | N/A |
| Keywords | <result>, <tag1> | <result> |
| TimeCreated | N/A | N/A |
| EventRecordID | N/A | N/A |
| Correlation | N/A | N/A |
| Execution | N/A | N/A |
| Channel | N/A | N/A |
| Computer | <dname> | <dname> |
| DestinationDRA | N/A | N/A |
| SourceDRA | <sname> | N/A |
| NamingContext | N/A | N/A |
| Options | N/A | N/A |
| SessionID | <session> | <session> |
| StartUSN | N/A | N/A |
| StatusCode | <status> | <responsecode>, <tag1> |
| ProcessId | <processid> | N/A |
Log Processing Settings
This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.
LogRhythm Default
| Regex ID | Rule Name | Rule Type | Common Event | Classification |
|---|
| 1010539 | Microsoft Windows Security Auditing | Base Rule | Group Membership Information | Information |
| Security Audit : Success | Sub Rule | Windows Audit Success Event | Other Audit Success |
| Security Audit : Failure | Sub Rule | Windows Audit Failure Event | Other Audit Failure |
LogRhythm Default v2.0
| Regex ID | Rule Name | Rule Type | Common Event | Classification |
|---|
| 1011140 | V 2.0 : Active Directory Replica Context Events | Base Rule | General Replication Information | Information |
| V 2.0 : EVID 4928 : AD Replica Source Naming Conte | Sub Rule | Configuration Loaded : Directory Services | Configuration |
| V 2.0 : EVID 4928 : Failed AD Replica Context Cr | Sub Rule | Failed Configuration | Other Audit Failure |
| V 2.0 : EVID 4929 : AD Replica Source Naming CntRe | Sub Rule | Configuration Deleted : Directory Services | Configuration |
| V 2.0 : EVID 4929 : Failed AD Replica Context Dlt | Sub Rule | Failed Configuration | Other Audit Failure |
| V 2.0 : EVID 4930 : AD Replica Source Naming Conte | Sub Rule | Configuration Modified : Directory Services | Configuration |
| V 2.0 : EVID 4930 : Failed AD Replica Context Modi | Sub Rule | Failed Configuration | Other Audit Failure |
| V 2.0 : EVID 4931 : AD Replica Destination Naming | Sub Rule | Configuration Modified : Directory Services | Configuration |
| V 2.0 : EVID 4931 : Failed AD Replica Context Modi | Sub Rule | Failed Configuration | Other Audit Failure |
| V 2.0 : EVID 4932 : AD Naming Context SynchroBegun | Sub Rule | General Active Directory Replication | Information |
| V 2.0 : EVID 4933 : AD Naming Context Sync Complete | Sub Rule | Replication Successful | Information |
| V 2.0 : EVID 4933 : AD Naming Context Sync Failed | Sub Rule | Replication Failure | Error |
