ntsyslog = {

  # The name of the log format
  log.format.format_label = "NTsyslog Log Format"
  log.miscellaneous.log_data_type = "syslog_required"  
  log.miscellaneous.log_format_type = "syslog_server"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "[a-z]+\\[(warning|error|failure)\\] [0-9]+  "

  # Log fields
  log.fields = {

    type = ""
    event_code = ""
    message = ""
    event_type = ""
    process = ""
    source = ""
    severity = ""
    reason = ""
    username = ""
    domain = ""
    logon_type = ""
    logon_process = ""
    logon_account = ""
    logon_id = ""
    authentication_package = ""
    workstation_name = ""
    source_workstation = ""
    error_code = ""
    status_code = ""
    substatus_code = ""

  } # log.fields


  #          
  # Log Parsing Filters
  log.parsing_filters = {

    parse = "
if (matches_regular_expression(v.syslog_message, '^([a-z ]+)\\\\[([^]]+)\\\\] ([0-9]+)  (.*)$')) then (
  set_collected_field('', 'source', $1);
  set_collected_field('', 'severity', $2);
  set_collected_field('', 'event_code', $3);
  set_collected_field('', 'message', $4);
);
if (matches_regular_expression(v.syslog_message, ' ([0-9]+) ([A-Z ]+\\\\\\\\[A-Z]+)  ([^:]+):')) then (
  set_collected_field('', 'event_code', $1);
  set_collected_field('', 'process', $2);
  set_collected_field('', 'event_type', $3);
);

if (matches_regular_expression(v.syslog_message, '(529) .* (Logon Failure):  Reason:(.*)  User Name:(.*)  Domain:(.*)  Logon Type:(.*)  Logon Process:(.*)  Authentication Package:(.*)  Workstation Name:(.*)')) then (
  set_collected_field('', 'event_code', $1);
  set_collected_field('', 'event_type', $2);
  set_collected_field('', 'reason', $3);
  set_collected_field('', 'username', $4);
  set_collected_field('', 'domain', $5);
  set_collected_field('', 'logon_type', $6);
  set_collected_field('', 'logon_process', $7);
  set_collected_field('', 'authentication_package', $8);
  set_collected_field('', 'workstation_name', $9);
)

else if (matches_regular_expression(v.syslog_message, '(680) .* Logon attempt by: ([A-Z0-9_]+)  Logon account:  (.*)  Source Workstation: (.*)  Error Code: (.*)$')) then (
  set_collected_field('', 'event_code', $1);
  set_collected_field('', 'event_type', $2);
  set_collected_field('', 'username', $3);
  set_collected_field('', 'logon_account', $4);
  set_collected_field('', 'source_workstation', $5);
  set_collected_field('', 'error_code', $6);
)

else if (matches_regular_expression(v.syslog_message, '(680) .*  (Account Used for Logon) by: ([A-Z0-9_]+)  Account Name:  (.*)  Workstation:  (.*)$')) then (
  set_collected_field('', 'event_code', $1);
  set_collected_field('', 'event_type', $2);
  set_collected_field('', 'logon_account', $3);
  set_collected_field('', 'source_workstation', $4);
  set_collected_field('', 'error_code', $5);
)

else if (matches_regular_expression(v.syslog_message, '(537) .* (Logon Failure):  Reason:(.*)  User Name:(.*)  Domain:(.*)  Logon Type:([0-9]+)  Logon Process:(.*)  Authentication Package:(.*)  Workstation Name:(.*)  Status code:(0x[0-9A-F]+)  Substatus code:(0x[0-9A-F]+)')) then (
  set_collected_field('', 'event_code', $1);
  set_collected_field('', 'event_type', $2);
  set_collected_field('', 'reason', $3);
  set_collected_field('', 'username', $4);
  set_collected_field('', 'domain', $5);
  set_collected_field('', 'logon_type', $6);
  set_collected_field('', 'logon_account', $7);
  set_collected_field('', 'authentication_package', $8);
  set_collected_field('', 'workstation_name', $9);
  set_collected_field('', 'status_code', $10);
  set_collected_field('', 'substatus_code', $11);
)

else if (matches_regular_expression(v.syslog_message, '(538) .*  (User Logoff):  User Name:(.*)  Domain:(.*)  Logon ID:\\\\(([^)]+)\\\\)  Logon Type:(.*)$')) then (
  set_collected_field('', 'event_code', $1);
  set_collected_field('', 'event_type', $2);
  set_collected_field('', 'username', $3);
  set_collected_field('', 'domain', $4);
  set_collected_field('', 'logon_type', $5);
  set_collected_field('', 'logon_id', $6);
)

else if (matches_regular_expression(v.syslog_message, '(540) .*  (Successful Network Logon):  User Name:(.*)  Domain:(.*)  Logon ID:\\\\(([^)]+)\\\\)  Logon Type:(.*)  Logon Process:(.*)  Authentication Package:(.*)  Workstation Name:(.*)$')) then (
  set_collected_field('', 'event_code', $1);
  set_collected_field('', 'event_type', $2);
  set_collected_field('', 'username', $3);
  set_collected_field('', 'domain', $4);
  set_collected_field('', 'logon_id', $5);
  set_collected_field('', 'logon_type', $6);
  set_collected_field('', 'logon_process', $7);
  set_collected_field('', 'authentication_package', $8);
  set_collected_field('', 'authentication_package', $9);

);

accept_collected_entry('', false);
"

  } # log.parsing_filters


  # Database fields
  database.fields = {

    source = ""
    severity = ""
    event_code = ""
    message = ""
    event_type = ""
    process = ""
    reason = ""
    username = ""
    domain = ""
    logon_type = ""
    logon_process = ""
    logon_account = ""
    logon_id = ""
    authentication_package = ""
    workstation_name = ""
    source_workstation = ""
    error_code = ""
    status_code = ""
    substatus_code = ""

  } # database.fields

  database.numerical_fields = {

    events = {
      label = "$lang_stats.field_labels.events"
      default = true
      requires_log_field = false
      type = "int"
      display_format_type = "integer"
      entries_field = true
    } # events

  } # database.numerical_fields


  log.filters = {

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'events = 1;'
    } # mark_entry

  } # log.filters

  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      source = true
      severity = true
      type = true
      event_code = true
      message = true
      event_type = true
      process = true
      reason = true
      username = true
      domain = true
      logon_type = true
      logon_process = true
      logon_account = true
      logon_id = true
      authentication_package = true
      workstation_name = true
      source_workstation = true
      error_code = true
      status_code = true
      substatus_code = true
    } # report_groups

  } # create_profile_wizard_options

} # ntsyslog