# Streams / Events templates or examples

**URL:** <https://community.graylog.org/t/streams-events-templates-or-examples/23110>\
**Category:** Graylog Central (peer support)\
**Tags:** sidecar, nxlog, basic-configuration, alert\
**Created:** [March 21, 2022, 9:54pm UTC](https://community.graylog.org/t/streams-events-templates-or-examples/23110 "2022-03-21T21:54:58Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [March 23, 2022, 4:33pm UTC](https://community.graylog.org/t/streams-events-templates-or-examples/23110/5 "2022-03-23T16:33:17Z")

</div>

I don’t think you need the "Unknown username or bad password part, [event 4625 is exactly that](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4625), no more, no less.

Rather than catching that in an Extractor, if you put it through pipeline rules. you can augment the information in the message. For instance, the link I gave above has a translation tables for the status/substatus code of the bad login… which you can place in a table to look up when the event happens and tell more about the bad login. There is another table for logon “type” if you are interested, that link has a “cheat sheet” you can download that has key windows security events (short list) to work with.

So with a pipeline and a rule like the one below nad it’s table lookups, you can get more detail and more presentable on your alert.

```auto
rule "bad_password_rule"
when
    // Bad Password
    to_string($message.winlog_event_id) == "4625"             
then

    let subject_0 = concat("PW-BAD: ", to_string($message.winlog_event_data_TargetUserName));
    let subject_1 = concat(subject_0, " connecting to ");
    let subject_fin = concat(subject_1, to_string($message.winlog_host_name));
    set_field("short_detail", subject_fin);
    //
    // create detail of alert
    let LogonTypeNumber = to_string($message.winlog_event_data_LogonType); //logon type... interactive, batch, etc...
    let LogonTypeResult = lookup_value("winLogonType",LogonTypeNumber, 0); //Lookup logon type against bre-built table
    let LogonTypeErr = lookup_value("WinLogonErr" ,to_string($message.winlog_event_data_SubStatus), 0); //lookup error reason in pre-built table.
    let build_mess_0 = concat("Failed Password Attempt - ", to_string($message.winlog_event_data_TargetUserName)); //build out explanation for Error message
    let build_mess_1 = concat(build_mess_0, " attempting to log in to ");
    let build_mess_2 = concat(build_mess_1, to_string($message.winlog_event_SubjectDomainName));
    let build_mess_3 = concat(build_mess_2, "-");
    let build_mess_4 = concat(build_mess_3, to_string($message.winlog_host_name));
    let build_mess_5 = concat(build_mess_4, ". Logon Type: ");
    let build_mess_6 = concat(build_mess_5, to_string(LogonTypeResult));
    let build_mess_7 = concat(build_mess_6, ". Attempt came from: ");
    let build_mess_8 = concat(build_mess_7, to_string($message.winlog_event_data_WorkstationName));
    let build_mess_9 = concat(build_mess_8, ". ERROR: ");
    let build_mess_fin = concat(build_mess_9, to_string(LogonTypeErr));
    set_field("the_explanation", build_mess_fin);
    route_to_stream("security_reports");
end

```

and you can get a line out it similar to this:

`Failed Password Attempt - greg.smith@kubernetes.com attempting to log in to DockerApp. Logon Type: NetworkClearText. Attempt came from: DockerOne. ERROR: User name is correct but the password is wrong - NTLM`

---

_[View the full topic](https://community.graylog.org/t/streams-events-templates-or-examples/23110)._