<span class="pill kill-chain">_time</span>
<span class="pill kill-chain">ActivityID</span>
<span class="pill kill-chain">Channel</span>
<span class="pill kill-chain">Computer</span>
<span class="pill kill-chain">EventCode</span>
<span class="pill kill-chain">EventID</span>
<span class="pill kill-chain">EventRecordID</span>
<span class="pill kill-chain">Guid</span>
<span class="pill kill-chain">Keywords</span>
<span class="pill kill-chain">Level</span>
<span class="pill kill-chain">Name</span>
<span class="pill kill-chain">Opcode</span>
<span class="pill kill-chain">ProcessID</span>
<span class="pill kill-chain">RecordNumber</span>
<span class="pill kill-chain">SystemTime</span>
<span class="pill kill-chain">System_Props_Xml</span>
<span class="pill kill-chain">Task</span>
<span class="pill kill-chain">ThreadID</span>
<span class="pill kill-chain">UserData_Xml</span>
<span class="pill kill-chain">UserID</span>
<span class="pill kill-chain">Version</span>
<span class="pill kill-chain">date_hour</span>
<span class="pill kill-chain">date_mday</span>
<span class="pill kill-chain">date_minute</span>
<span class="pill kill-chain">date_month</span>
<span class="pill kill-chain">date_second</span>
<span class="pill kill-chain">date_wday</span>
<span class="pill kill-chain">date_year</span>
<span class="pill kill-chain">date_zone</span>
<span class="pill kill-chain">dvc</span>
<span class="pill kill-chain">dvc_nt_host</span>
<span class="pill kill-chain">event_id</span>
<span class="pill kill-chain">eventtype</span>
<span class="pill kill-chain">host</span>
<span class="pill kill-chain">id</span>
<span class="pill kill-chain">index</span>
<span class="pill kill-chain">linecount</span>
<span class="pill kill-chain">punct</span>
<span class="pill kill-chain">signature_id</span>
<span class="pill kill-chain">source</span>
<span class="pill kill-chain">sourcetype</span>
<span class="pill kill-chain">splunk_server</span>
<span class="pill kill-chain">tag</span>
<span class="pill kill-chain">tag::eventtype</span>
<span class="pill kill-chain">timeendpos</span>
<span class="pill kill-chain">timestartpos</span>
<span class="pill kill-chain">user_id</span>
<span class="pill kill-chain">vendor_product</span>
</div>
Data Source: Windows Event Log CertificateServicesClient 1007
Description
Data source object for Windows Event Log CertificateServicesClient 1007
Details
| Property | Value |
|---|---|
| Source | XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational |
| Sourcetype | XmlWinEventLog |
| Separator | EventCode |
Supported Apps
- Splunk Add-on for Microsoft Windows (version 9.0.0)
Event Fields
Fields
Example Log
1<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-CertificateServicesClient-Lifecycle-System' Guid='{bc0669e1-a10d-4a78-834e-1ca3c806c93b}'/><EventID>1007</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-02-01T17:08:44.1466587Z'/><EventRecordID>2</EventRecordID><Correlation ActivityID='{3b615f97-365d-0000-130d-623b5d36d901}'/><Execution ProcessID='7716' ThreadID='8384'/><Channel>Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational</Channel><Computer>DESKTOP-92OQLA1</Computer><Security UserID='S-1-5-21-2334826781-4204571024-2242252149-1000'/></System><UserData><CertNotificationData ProcessName='powershell.exe' AccountName='DESKTOP-92OQLA1\Michael Haag' Context='Machine'><CertificateDetails Thumbprint='1ee3cb11c0937a0940d8633fbece475b76a04833'><SubjectNames><SubjectName>CN=test.atomic.com</SubjectName><SubjectName>test.atomic.com</SubjectName></SubjectNames><EKUs><EKU Name='Client Authentication' OID='1.3.6.1.5.5.7.3.2'/><EKU Name='Server Authentication' OID='1.3.6.1.5.5.7.3.1'/></EKUs><NotValidAfter>2024-02-01T17:18:09Z</NotValidAfter></CertificateDetails></CertNotificationData></UserData></Event>
Source: GitHub | Version: 1