<html lang="en">
<body>
  
<p>
    <b>[OOTB] Microsoft Products via KES WIN NG for KUMA 3.2. Version 2</b><br>
	Сhange list:
	<ul>
		<li>Support of events from the Microsoft - Windows - TaskScheduler - Operational event journal was added.</li>
		<li>Extra normalizer "1" was changed. Target field of the first event enrichment with regexp was changed from the KUMA field OldfilePath to OldFileName.</li>
		<li>Extra normalizer Microsoft-Windows-GroupPolicy was changed. Event enrichment with constant "Windows" was added to the KUMA field DeviceProduct.</li>
		<li>Extra normalizer "4697" was changed. Event field "Event.EventData.Data.ServiceType" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.ServiceFileName" was mapped from the KUMA field DeviceCustomString2 to the KUMA field FileName. Event field "Event.EventData.Data.ServiceAccount" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.ServiceStartType" was mapped to the KUMA field DeviceCustomString2.</li>
		<li>New extra normalizers were added: "Microsoft-Windows-TaskScheduler", "TaskScheduler 100 101 102 103 106 110", "TaskScheduler 101 ResultCode mapping", "TaskScheduler 129", "TaskScheduler 101 ResultCode mapping", "TaskScheduler 129", "TaskScheduler 140 141 332", "TaskScheduler 201 202 203".</li>
		<li>Extra normalizer "1000 (Defender)" was updated. Event conversion was removed from the event field "Event.EventData.Data.Domain".</li>
		<li>Extra normalizer "1015 (Defender)" was updated. Event conversion was removed from the event field "Event.EventData.Data.Domain", "Event.EventData.Data.Domain", "Event.System.Security.User".</li>
		<li>New dictionary "[OOTB] Windows. Task Scheduler. EventIDs and Event Names" was added.</li>
		<li>Exta normalizers "4701", "TaskContentNew" were changed. Parameter "Keep extra fields" was disabled. Mapping of event field "Task.Actions.Exec.Command" was removed from the KUMA field DeviceAction.</li>
		<li>Exta normalizers "4698" was changed. Mapping of event field "Task.Actions.Exec.Command" was removed from the KUMA field DeviceAction.</li>
		<li>Extra normalizers "A scheduled tasks management" was removed.</li>
		<li>DeviceCustom* fields labels were updated.</li>
		<li>New extra normalizers "1040", "1013, 11725", "4698", "4698 TaskContent" were added.</li>
		<li>Extra normalizers "4768" and "4771" were changed. Event field "Event.EventData.Data.CertIssuerName" was mapped to the KUMA field S.CertIssuerName, Event field "Event.EventData.Data.CertSerialNumber" was mapped to the KUMA field S.CertSerialNumber, Event field "Event.EventData.Data.CertThumbprint" was mapped to the KUMA field S.CertThumbprint, Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field S.TicketOptions, Event field "Event.EventData.Data.TicketEncryptionType" was mapped to the KUMA field S.TicketEncryptionType, Event field "Event.EventData.Data.PreAuthType" was mapped to the KUMA field S.PreAuthType.</li>
		<li>Extra normalizer "4768" was changed. Event field "Event.EventData.Data.ServiceSid" was mapped to the KUMA field DestinationUserID.</li>
		<li>Extra normalizer "4738" was changed. Event field "Event.EventData.Data.SamAccountName" was mapped to the KUMA fields S.SamAccountName and DeviceCustomString1, Event field "Event.EventData.Data.UserPrincipalName" was mapped to the KUMA field S.UserPrincipalName, Event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA fields S.PasswordLastSet and DevicecustomDate1, Event field "Event.EventData.Data.AllowedToDelegateTo" was mapped to the KUMA fields S.AllowedToDelegateTo and FileType, Event field "Event.EventData.Data.DnsHostName" was mapped to the KUMA field S.DnsHostName, Event field "Event.EventData.Data.ServicePrincipalNames" was mapped to the KUMA field S.ServicePrincipalNames.</li>
		<li>Extra normalizer "A computer account management" was changed. Event field "Event.EventData.Data.SamAccountName" was mapped to the KUMA fields S.SamAccountName and DeviceCustomString1, Event field "Event.EventData.Data.UserPrincipalName" was mapped to the KUMA field S.UserPrincipalName, Event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA fields S.PasswordLastSet and DevicecustomDate1, Event field "Event.EventData.Data.AllowedToDelegateTo" was mapped to the KUMA fields S.AllowedToDelegateTo and FileType, Event field "Event.EventData.Data.DnsHostName" was mapped to the KUMA field S.DnsHostName, Event field "Event.EventData.Data.ServicePrincipalNames" was mapped to the KUMA field S.ServicePrincipalNames.</li>
		<li>Extra normalizer "User Account Management" was changed. Event field "Event.EventData.Data.SamAccountName" was mapped to the KUMA field DeviceCustomString1, event field "Event.EventData.Data.UserPrincipalName" was mapped to the KUMA field S.UserPrincipalName, Mapping of the event field "Event.EventData.Data.PasswordLastSet" was changed from the KUMA field "FlexString2" to "DeviceCustomDate1", event field "Event.EventData.Data.PasswordLastSet" was mapped to the KUMA field S.PasswordLastSet, event field "Event.EventData.Data.AllowedToDelegateTo" was mapped to the KUMA field FileType, event field "Event.EventData.Data.DnsHostName" was mapped to the KUMA field S.DnsHostName, Event field "Event.EventData.Data.ServicePrincipalNames" was mapped to the KUMA field S.ServicePrincipalNames.</li>
		<li>Extra normalizer "4769" was changed. Mapping of the event field "Event.EventData.Data.TicketEncryptionType" was changed from the KUMA field "DeviceCustomString5" to "DeviceCustomString3". Event field "Event.EventData.Data.CertIssuerName" was mapped to the KUMA field S.CertIssuerName, Event field "Event.EventData.Data.CertSerialNumber" was mapped to the KUMA field S.CertSerialNumber.</li>
		<li>Extra normalizer "1042" was changed. Mapping of the event field "Event.EventData.Data.0" was changed from the KUMA field "FilePath" to "OldFilePermission". Event enrichment "ReplaceWithRegexp" was added to the field "Event.EventData.Data.0". Event field "Event.System.Security.UserID" was mapped to the KUMA field DestinationUserID.</li>
		<li>Extra normalizer "1034" was changed. Event enrichment "Replace" was added to the field DeviceCustomString6 and DeviceCustomString3.</li>
		<li>Extra normalizer "4104" was changed. Mapping of the event filed "Event.EventData.Data.ScriptBlockId" was removed from the KUMA field DeviceCustomStrin1.</li>
		<li>Extra normalizer "1317" was changed. Mapping of the event filed "Event.System.Security.UserID" was changed from the KUMA field SourceUserName to the KUMA fied SourceUserID.</li>
		<li>Extra normalizers "7000, 7023, 7024", "7031", "7011", "7001", "7043", "7038", "7002", "7003 7037", "7005", "7006", "7009", "7016, 7017, 7018, 7019, 7020, 7021, 7022", "7026", "7028", "7030", "7032", "7033", "7034", "7035", "7036", "7039", "7040", "7041", "7042", "107", "1074", "109", "42", "12", "13 system" were changed. Parameter "Use raw event" was enabled. Parameter "XML attributes" was changed to "Event.EventData.Data.Name".</li>
		<li>Extra normalizer "1074" was changed. Mapping of the event filed "Event.EventData.Data.param2" was changed from the KUMA field SourceDnsDomain to the KUMA fied DestinationHostName. Event converion was removed from the event field "Event.EventData.Data.param2". Mapping of the event field "Event.EventData.Data.param7" was changed from the SourceUserName to the DestinationUserName.</li>
		<li>Extra normalizer "13 system" was changed. Event conversions were added to the event field "Event.EventData.Data.StopTime" (regexp and append functions).</li>
		<li>Extra normalizers "Windows PowerShell 400 403 regexp", "Windows PowerShell 800 regexp", "Windows PowerShell 600 regexp", "SMBServer 3000 RenderingInfo.Message parsing" were changed. New regular expression was added.</li>
		<li>Extra normalizer "2080 Event.RenderingInfo.Message regex part" was changed. Capture group "all" was mapped to the KUMA field DeviceCustomString6.</li>
		<li>Extra normalizer "1001" was changed. Additional regular expression was added. Capture group "all" was mapped to the KUMA field DeviceCustomString6.</li>
		<li>Extra normalizer "4625" was edited. Mapping of the event field "Event.EventData.Data.FailureReason" was removed from the KUMA field DeviceCustomString4. Mapping of the event field "Event.EventData.Data.Status" was changed fro the KUMA field DeviceCustomString6 to the KUMA field DeviceCustomString4. Event enrichment with replace function was removed from the KUMA field DeviceCustomString4. Event enrichment with replace function was added to the field S.DecodedReason. Event enrichment with dictionary "[OOTB] Windows. Failure codes" was removed from the KUMA field DeviceCustomString6. Event enrichment with dictionary "[OOTB] Windows. Failure codes" was added to the field S.DecodedStatus.</li>
		<li>Extra normalizer "4768" was edited. Option "Keep extra fields" was disabled. Event enrichement with dictionary "[OOTB] Windows. KRB ResultCodes" was removed from the KUMA field DeviceCustomString4. Event enrichement with dictionary "[OOTB] Windows. KRB ResultCodes" was added to the field S.DecodedStatus.</li>
		<li>Extra normalizer "4771" was edited. Mapping of the event field "Event.EventData.Data.Status" was removed from the KUMA field Reason. Event enrichement with dictionary "[OOTB] Windows. KRB ResultCodes" was removed from the KUMA field DeviceCustomString4. Event enrichment with dictionary "[OOTB] Windows. KRB ResultCodes" was added to the field S.DecodedStatus.</li>
		<li>Extra normalizer "4776" was edited. Mapping of the event field "Event.EventData.Data.Status" was removed from the KUMA field Reason. Event enrichement with dictionary "[OOTB] Windows. Validate Cred. Error Codes" was removed from the KUMA field DeviceCustomString4. Event enrichment with dictionary "[OOTB] Windows. Validate Cred. Error Codes" was added to the field S.DecodedStatus.</li>
		<li>Table "[OOTB] Windows. GroupPolicy EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. GroupPolicy. EventIDs and Event Names".</li>
		<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. EventIDs and Event Names".</li>
		<li>Dictionary "[OOTB] Microsoft DNS Server. EventIDs and Event Names" was renamed to "[OOTB] Microsoft. DNS Server. EventIDs and Event Names".</li>
		<li>Dictionary "[OOTB] Windows_Terminal Server. EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. Terminal Server. EventIDs and Event Names".</li>
		<li>Dictionary "[OOTB] Windows Hyper-V EventID-Name" was renamed to "[OOTB] Windows. Hyper-V. EventIDs and Event Names".</li>
		<li>Dictionary "[OOTB] Windows. Service Control Manager EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. Service Control Manager. EventIDs and Event Names".</li>
		<li>Dictionary "[OOTB] Windows. LogonTypes (Windows all events)" was renamed to "[OOTB] Windows. Logon Types".</li>
		<li>Dictionary "[OOTB] Windows_Sysmon. EventIDs and Event Names mapping" was renamed to "[OOTB] Windows. Sysmon. EventIDs and Event Names".</li>
		<li>Dictionary "[OOTB] Windows. FailureCodes (4625)" was changed. Dictionary was renamed from "[OOTB] Windows. FailureCodes (4625)" to "[OOTB] Windows. Failure Codes". Dicionary description was updated.</li>
		<li>Other minor improvements: labels in the extra normalizers were updated.</li>
		<li>Extra normalizer "4625" was changed. Event enrichment with dictionary "[OOTB] Windows. LogonTypes (Windows all events)" was added to the extra normalizer "4625" on "FlexString2" KUMA field. Event enrichment with dictionary "[OOTB] Windows. FailureCodes (4625)" was added to the extra normalizer "4625" to the "DeviceCustomString6" KUMA field. Event enrichment with "replace" function was added to the extra normalizer "4625" to the "DeviceCustomString4" KUMA field. Mapping of the event field "Event.EventData.Data.WorkstationName" was changed from the KUMA field "SourceHostName" to "DeviceCustomString2".</li>
		<li>Extra normalizer "4907" was changed. Event field "Event.EventData.Data.OldSd" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.NewSd" was mapped to the KUMA field DeviceCustomString6.</li>
        <li>Extra normalizer "Kerberos or DRA group for EFS or The audit policy (SACL) on an object policy was changed." was changed. Event field "Event.EventData.Data.OldSd" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.NewSd" was mapped to the KUMA field DeviceCustomString6.</li>
        <li>Extra normalizer "4770" was changed. Event field "Event.EventData.Data.TicketEncryptionType" was mapped to the KUMA field DeviceCustomString3. Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.ServiceSid" was mapped to the KUMA field DestinationUserID.</li>
        <li>Extra normalizer "4768" was changed. Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field DeviceCustomString1. Event field "Event.EventData.Data.TicketEncryptionType" was mapped to the KUMA field DeviceCustomString3.</li>
        <li>Extra normalizer "4771" was changed. Event field "Event.EventData.Data.PreAuthType" was mapped to the KUMA field DeviceCustomString5. Event field "Event.EventData.Data.TicketOptions" was mapped to the KUMA field DeviceCustomString1.</li>
        <li>Extra normalizer "4662" was changed. Event field "Event.EventData.Data.AdditionalInfo" was mapped to the KUMA field DeviceCustomString3. Event field "Event.EventData.Data.AdditionalInfo2" was mapped to the KUMA field DeviceCustomString4.</li>
        <li>Extra normalizer "5140" was changed. Event field "Event.EventData.Data.ShareLocalPath" was mapped to the KUMA field FilePath.</li>
		<li>New extra normalizer "TaskContentNew" was added.</li>
		<li>Support of some events generated by MsiInstaller and MSExchange was added.</li>
		<li>Event enrichment was added to the extra "normalizer 33205 data KV part" to the field "Event.EventData.Data".</li>
		<li>Extra normalizer 4624 was changed. Label of the field FlexString1 was changed from "Subject logon ID" to "Target logon ID".</li>
		<li>Extra normalizer 4769 was changed. Event field Event.EventData.Data.TransmittedServices was mapped to the KUMA field DeviceCustomString2.</li>
		<li>Extra normalizer 4768 was changed. Event field Event.EventData.Data.TransmittedServices was mapped to the KUMA field DeviceCustomString2.</li>
		<li>Extra normalizers 4898, 4887 were changed. Event.System.Correlation.ActivityID was mapped to the KUMA field DeviceCustomString5.</li>
		<li>Extra normalizer 4738 was changed. Event field Event.EventData.Data.UserPrincipalName was mapped to the KUMA field DeviceCustomString3.</li>
		<li>New extra normalizers were added: 7038, 7002, "7003 7037", 7005, 7006, 7009, "7016, 7017, 7018, 7019, 7020, 7021, 7022", 7026, 7028, 7030, 7032, 7033, 7034, 7035, 7036, 7039, 7040, 7041, 7042, 7043, "Other system events", "MsiInstaller", "1034 1033 1035", 1038, 1029, 1042, 1013, "11707 11728 11724", 1022, 1025, 1026, 1027, 1005, 1014, 1028, "MSExchange", "9000", "9017", "9018", "2004 MSExchange OAuth", "2080", "2080 Event.RenderingInfo.Message regex part", "12018", "IISInfoCtrs", "1001", "Microsoft-Windows-RestartManager", "10000", "Microsoft-Windows-Security-SPP", "16384".</li>
		<li>Dictionary "[OOTB] Windows. EventIDs and Event Names mapping" was changed. Event names were removed for event IDs 7000, 7001, 7009, 7011, 7023, 7031, 7034, 7043, 7045 from the dictionary.</li>
		<li>Extra normalizer "7000 7009 7023 7034" was renamed to "7000, 7023, 7024".</li>
		<li>Extra normalizer condition was updated. Event enrichments were added.</li>
		<li>Extra normalizer "7001" was changed. Event enrichments were added.</li>
		<li>Extra normalizer "7011" was changed. Event enrichment was added.</li>
		<li>Extra normalizer "7031" was changed. Event enrichments were added. Mapping of event field Event.EventData.Data.param3, Event.EventData.Data.param4 were removed. Mapping of the event field Event.EventData.Data.param5 was changed from KUMA field DeviceCustomString5 to DeviceCustomString3.</li>
		<li>Extra normalizer "7038" was changed. Event enrichments were added.</li>
		<li>Extra normalizer "7043" was changed. Event enrichment was added.</li>
		<li>Extra normalizer 7045 was changed. Extra normalizer "7045" was moved from the "System" parent extra extra normalizer to "Service Control Manager" parent extra normalizer. Mapping was changed. Field Event.EventData.Data.ImagePath was mapped from the KUMA field FileName to the KUMA field FilePath.</li>
		<li>Event enrichment with dictionary "[OOTB] Windows. Service Control Manager EventIDs and Event Names mapping" was added in the extra normalizer "Service Control Manager".</li>
		<li>Extra normalizers 107, 1074, 109, 42, "12 system", "13 system", 104, "5827 5829 5830", "5828 5831" were moved from the "System" parent extra extra normalizer to "Other system events" parent extra normalizer.</li>
		<li>Event enrichment with dictionary was removed from the "System" extra normalizer.</li>
	</ul>
	<br>
	Same changes has been made in the normalizer "[OOTB] Microsoft Products for KUMA 3" in the versions 15, 16, 17, 18.
</p>
  
<p>
    <b>[OOTB] Microsoft Products via KES WIN NG for KUMA 3.2. Version 1</b><br>
	This is the first version of the package.
</p>

</body>
</html>