security_content/data_sources/ntlm_operational_8006.yml at 2b6d541b4c179dc3fc0dbabcb420fb98ba1d5f88 · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: NTLM Operational 8006
id: 9f50a672-6f7d-4621-a3bd-69468c6b7a7f
version: 2
creation_date: '2025-02-21'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
description: Data source object for NTLM Operational 8006
source: XmlWinEventLog:Microsoft-Windows-NTLM/Operational
sourcetype: XmlWinEventLog:Microsoft-Windows-NTLM/Operational
separator: EventCode
supported_TA:
    - name: Splunk Add-on for Microsoft Windows
      url: https://splunkbase.splunk.com/app/742
      version: 10.0.1
fields:
    - CategoryString
    - Channel
    - Computer
    - DomainName
    - EventCode
    - EventData_Xml
    - EventID
    - EventRecordID
    - Guid
    - Image_File_Name
    - Keywords
    - Level
    - Name
    - Opcode
    - ProcessID
    - RecordNumber
    - RenderingInfo_Xml
    - SChannelName
    - SChannelType
    - SourceName
    - SubStatus
    - SystemTime
    - System_Props_Xml
    - Task
    - TaskCategory
    - ThreadID
    - UserID
    - UserName
    - Version
    - WorkstationName
    - action
    - category
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - dvc
    - dvc_nt_host
    - event_id
    - eventtype
    - host
    - id
    - index
    - linecount
    - name
    - parent_process
    - process_name
    - punct
    - result
    - service
    - service_id
    - service_name
    - severity
    - severity_id
    - signature
    - signature_id
    - source
    - sourcetype
    - splunk_server
    - splunk_server_group
    - subject
    - tag
    - tag::action
    - tag::eventtype
    - timeendpos
    - timestartpos
    - user_group_id
    - user_id
    - vendor_product
    - _bkt
    - _cd
    - _eventtype_color
    - _indextime
    - _raw
    - _serial
    - _si
    - _sourcetype
    - _subsecond
    - _time
example_log: ''