EVID 5136-5139, 5141 : AD Object Access (XML - Security)

Event Details

Event Type	Audit Directory Service Changes
Event Description	5136(S) : A directory service object was modified. 5137(S) : A directory service object was created. 5138(S) : A directory service object was undeleted. 5139(S) : A directory service object was moved. 5141(S) : A directory service object was deleted.
Event IDs	5136, 5137, 5138, 5139, 5141

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log Field	LogRhythm Default	LogRhythm Default v2.0
Provider	N/A	N/A
EventID	<vmid>	<vmid>
Version	N/A	N/A
Level	<severity>	<severity>
Task	<vendorinfo>	<vendorinfo>
Opcode	N/A	N/A
Keywords	<command>	<result>
TimeCreated	N/A	N/A
EventRecordID	N/A	N/A
Correlation	N/A	N/A
Execution	N/A	N/A
Channel	N/A	N/A
Computer	<dname>	<dname>
OpCorrelationID	<process>	N/A
AppCorrelationID	N/A	N/A
SubjectUserSid	N/A	N/A
SubjectUserName	<login>	<login>
SubjectDomainName	<domain>	<domainorigin>
SubjectLogonID	<session>	<session>
DSName	N/A	<domainimpacted>
DSType	N/A	N/A
ObjectDN	<object>, <subject>	<objectname>
NewObjectDN	N/A	<objectname>
ObjectGUID	N/A	<object>
ObjectClass	<group>	<objecttype>
AttributeLDAPDisplayName	<objectname>	<account>
AttributeSyntaxOID	N/A	N/A
AttributeValue	<account>	<responsecode>
OperationType	N/A	<action>
ProcessId	<processid>	N/A
NewObjectDN	<result>	<objectname>
CN	N/A	<subject>

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex ID	Rule Name	Rule Type	Common Event	Classification
1007853	EVID 5136 - 5139 & 5141 : AD Object Access	Base Rule	Object Accessed	Access Success
	EVID 5141 : Directory Service Object Deleted	Sub Rule	Object Deleted/Removed	Access Success
	EVID 5139 : Directory Service Object Moved	Sub Rule	Object Moved	Access Success
	EVID 5138 : Directory Service Object Undeleted	Sub Rule	Object Modified	Access Success
	EVID 5137 : Directory Service Object Created	Sub Rule	Object Created	Access Success
	EVID 5136 : Directory Service Object Modified	Sub Rule	Object Modified	Access Success

LogRhythm Default v2.0

Regex ID	Rule Name	Rule Type	Common Event	Classification
1011142	V 2.0 : AD Object Events	Base Rule	Object Accessed	Access Success
	V 2.0 : EVID 5136 : AD Object Modified	Sub Rule	Object Modified	Access Success
	V 2.0 : EVID 5137 : AD Object Created	Sub Rule	Object Created	Access Success
	V 2.0 : EVID 5138 : AD Object Restored	Sub Rule	Directory Service Object Restored	Other Audit Success
	V 2.0 : EVID 5139 : AD Object Moved	Sub Rule	Object Moved	Access Success
	V 2.0 : EVID 5141 : AD Object Deleted	Sub Rule	Object Deleted/Removed	Access Success