События Windows
A Kerberos service ticket was requested
Запрошен билет службы Kerberos
Event ID 4769
Security
Audit Kerberos Service Ticket Operations
Основные поля
IP-адрес
IP
Windows
IP
ELK
-
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя компьютера
Computer
Windows
Computer
ELK
winlog.computer_name
Microsoft Sentinel
-
QRadar
-
Splunk
-
Имя пользователя
TargetUserName
Windows
Account Information: Account Name
ELK
winlog.event_data.TargetUserName
Microsoft Sentinel
-
QRadar
-
Splunk
-
Важное поле
IpAddress
Windows
Network Information: Client Address
ELK
winlog.event_data.IpAddress
Microsoft Sentinel
-
QRadar
-
Splunk
-
Поля
| Windows Raw | Windows | ELK | Microsoft Sentinel | QRadar | Splunk |
|---|---|---|---|---|---|
| TargetUserName | Account Information: Account Name | winlog.event_data.TargetUserName | - | - | - |
| TargetDomainName | Account Information: Account Domain | winlog.event_data.TargetDomainName | - | - | - |
| LogonGuid | Account Information: Logon GUID | winlog.event_data.LogonGuid | - | - | - |
| ServiceName | Service Information: Service Name | winlog.event_data.ServiceName | - | - | - |
| ServiceSid | Service Information: Service ID | winlog.event_data.ServiceSid | - | - | - |
| IpAddress | Network Information: Client Address | winlog.event_data.IpAddress | - | - | - |
| IpPort | Network Information: Source Port | winlog.event_data.IpPort | - | - | - |
| TicketOptions | Additional Information: Ticket Options | winlog.event_data.TicketOptions | - | - | - |
| TicketEncryptionType | Additional Information: Ticket Encryption Type | winlog.event_data.TicketEncryptionType | - | - | - |
| Status | Additional Information: Failure Code | winlog.event_data.Status | - | - | - |
| TransmittedServices | Additional Information: Transited Services | winlog.event_data.TransmittedServices | - | - | - |
| RequestTicketHash | Ticket information: Request ticket hash | winlog.event_data.RequestTicketHash | - | - | - |
| ResponseTicketHash | Ticket information: Response ticket hash | winlog.event_data.ResponseTicketHash | - | - | - |
| IP Системное поле | IP Системное поле | - | - | - | - |
| Computer Системное поле | Computer Системное поле | winlog.computer_name | - | - | - |
| ProcessID Системное поле | ProcessID Системное поле | winlog.process.pid | - | - | - |
| ThreadID Системное поле | ThreadID Системное поле | winlog.process.thread.id | - | - | - |
Пример события
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4769</EventID>
<Version>1</Version>
<Level>0</Level>
<Task>14337</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2026-08-02T14:45:57.0948590Z" />
<EventRecordID>156680</EventRecordID>
<Correlation />
<Execution ProcessID="848" ThreadID="3840" />
<Channel>Security</Channel>
<Computer>DC.socpedia.net</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetUserName">dc$@SOCPEDIA.NET</Data>
<Data Name="TargetDomainName">SOCPEDIA.NET</Data>
<Data Name="ServiceName">DC$</Data>
<Data Name="ServiceSid">S-1-5-21-1838030176-2987033226-1986555923-1000</Data>
<Data Name="TicketOptions">0x40810018</Data>
<Data Name="TicketEncryptionType">0x12</Data>
<Data Name="IpAddress">::ffff:192.168.0.237</Data>
<Data Name="IpPort">38776</Data>
<Data Name="Status">0x0</Data>
<Data Name="LogonGuid">{e1d45ca1-ed2f-84dd-6438-e4a0cc6bb92e}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="RequestTicketHash">7HBipXt3WPGjqkSRiGYRUNK8aWIiZ2KeP2t19Cu/j54=</Data>
<Data Name="ResponseTicketHash">sYW9cYl+HwkTYp1bGGKBczzdRwOVJqhLNJDMZljCnts=</Data>
</EventData>
</Event>