Regex no Custom View

Question

question

jessenetojpti asked Mar 23, '22 piaudonn edited Mar 29, '22

Regex no Custom View

Olá, tenho o seguinte cenário.

Eu gostaria de identificar no filtro do customView do Windows se o campo ServiceName do XML foi preenchido.

Então, eu uso o "*$" como forma de filtro para que qualquer máquina/serviço seja apontado no campo ServiceName seja alarmado.

([EventData[Data[@Name='ServiceName']= '$']])

<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5) and (EventID=4769)]]
and
([EventData[Data[@Name='ServiceName']= '*$']])
</Select>
</Query>
</QueryList>

Enfim o uso do regex não funciona aqui. Alguém teria alguma solução para isso?

windows-active-directory windows-server-security

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-03-29T13:56:41.777Z

LimitlessTechnology-2700 answered Mar 29, '22

Hi @jessenetojpti

Here are a couple of links to potentially helpful articles regarding diagnosing this issue:

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/advanced-xml-filtering-in-the-windows-event-viewer/ba-p/399761

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.2

I do hope this answers your question.

Thanks.

--If the reply is helpful, please Upvote and Accept as answer--

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question