SF.net SVN: logwatch:[265] trunk/scripts/services/evtsecurity

Revision: 265
          http://sourceforge.net/p/logwatch/code/265
Author:   opoplawski
Date:     2014-10-29 21:35:16 +0000 (Wed, 29 Oct 2014)
Log Message:
-----------
[evtsecurity] Add url for more info on security events

Modified Paths:
--------------
    trunk/scripts/services/evtsecurity

Modified: trunk/scripts/services/evtsecurity
===================================================================
--- trunk/scripts/services/evtsecurity	2014-10-29 21:04:08 UTC (rev 264)
+++ trunk/scripts/services/evtsecurity	2014-10-29 21:35:16 UTC (rev 265)
@@ -18,6 +18,8 @@
 #########################################################
 
 use strict;
+use URI::URL;
+
 my $Detail = $ENV{'LOGWATCH_DETAIL_LEVEL'} || 0;
 
 my $SuccessAudits = 0;
@@ -47,6 +49,7 @@
       print STDERR "Cannot parse $ThisLine";
       next;
    }
+   my $url = URI::URL->new("https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=$EventID");
    if ($EventLogType eq "Success Audit") {
       $SuccessAudits++;
       $SuccessAuditUsers{$UserName}++;
@@ -63,7 +66,7 @@
             # Client not found in Kerberos database
             $UnknownClient{"$Account\\$Realm $Client"}++;
          } else {
-            $FailureAudits{"$Hostname $ExpandedString"}++;
+            $FailureAudits{"$Hostname $ExpandedString\n$url"}++;
          }
       } elsif ($EventID == 4769) {
          # A Kerberos service ticket was requested
@@ -76,7 +79,7 @@
             # Clock skew too great
             $ClockSkew{$Client}++;
          } else {
-            $FailureAudits{"$Hostname $ExpandedString"}++;
+            $FailureAudits{"$Hostname $ExpandedString\n$url"}++;
          }
       } elsif ($EventID == 4771) {
          # Kerberos pre-authentication failed
@@ -88,7 +91,7 @@
             # Clock skew too great
             $ClockSkew{$Client}++;
          } else {
-            $FailureAudits{"$Hostname $ExpandedString"}++;
+            $FailureAudits{"$Hostname $ExpandedString\n$url"}++;
          }
       } elsif ($EventID == 4776) {
          # The domain controller attempted to validate the credentials for an account
@@ -103,10 +106,10 @@
             # expired password
             $ExpiredPassword{"$Account $Client"}++;
          } else {
-            $FailureAudits{"$Hostname $ExpandedString"}++;
+            $FailureAudits{"$Hostname $ExpandedString\n$url"}++;
          }
       } else {
-         $FailureAudits{"$Hostname $ExpandedString"}++;
+         $FailureAudits{"$Hostname $ExpandedString\n$url"}++;
       }
    }
    else {

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------