The user or system account impacted by activity reported in the log.
Data Type
String
Aliases
|
Use |
Alias |
|---|---|
|
Client Console Full Name |
User (Impacted) |
|
Client Console Short Name |
Not applicable |
|
Web Console Tab/Name |
User (Impacted) |
|
OpenSearch Field Name |
account |
|
Rule Builder Column Name |
Account |
|
Regex Pattern |
<account> |
|
NetMon Name |
Not applicable |
Field Relationships
-
SIP
-
SIPv4
-
SIPv6
-
SIPv6E
-
Origin Hostname
-
Origin Hostname or IP
-
Origin NAT IP
-
DIP
-
DIPv4
-
DIPv6
-
DIPv6E
-
Impacted Hostname
-
Impacted Hostname or IP
-
Impacted NAT IP
-
Origin Port
-
Origin NAT Port
-
Impacted Port
-
Impacted NAT Port
-
Origin MAC Address
-
Impacted MAC Address
-
Origin Interface
-
Impacted Interface
-
Origin Domain
-
Impacted Domain
-
Origin Login
-
IANA Protocol Number
-
IANA Protocol Name
Common Applications
Any applications, systems or devices that utilize accounts.
Use Case
Correlating or monitoring user activity.
MPE/Data Masking Manipulations
Mapped to User Identity (Impacted)
Usage Standards
-
Use to indicate the user or account that is being altered or logged off a system by another user or system account.
-
Use for User Accounts and System Accounts.
Examples
-
Windows Event Log
<Event xmlns='http://Host2/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4738</EventID><Version>0</Version><Level>Information</Level><Task>User Account Management</Task><Opcode>Info</Opcode><Keywords>Audit Success</Keywords><TimeCreated SystemTime='2014-02-26T13:18:11.277015700Z'/><EventRecordID>1635656743</EventRecordID><Correlation/><Execution ProcessID='524' ThreadID='4900'/><Channel>Security</Channel><Computer> USABLDRRECFLOW01Computer><Security/></System><EventData>A user account was changed.
Subject:
Security ID: safaware\pete.store
Account Name: pete.store
Account Domain: safaware
Logon ID: 0x7b1adb067
Target Account:
Security ID: S-1-5-21-2222222-2222222222-2222222222-90119
Account Name: LHR-Reception
Account Domain: safaware
Changed Attributes:
SAM Account Name: -
Display Name: -
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: -
Account Expires: -
Primary Group ID: -
AllowedToDelegateTo: -
Old UAC Value: 0x15
New UAC Value: 0x211
User Account Control:
'Password Not Required' - Disabled
'Don't Expire Password' - Enabled
User Parameters: -
SID History: -
Logon Hours: -
Additional Information:
Privileges: -</EventData></Event>
Target in Windows indicates Impacted. In this log, the Target Account (Impacted) is being modified by Subject Account (Origin).