如何使用KQL解析Windows事件日志并将各字段拆分为单独列？

针对你提供的这类Windows对象权限变更日志（对应事件ID 4670），可以通过KQL的parse运算符或extract函数，把日志描述里的各个字段提取为单独列。以下是具体实现：

方案一：使用parse运算符（适合格式规整的日志） #

假设日志存储在SecurityEvent表中（自定义日志表可替换对应名称），查询语句如下：

SecurityEvent
| where EventID == 4670  // 筛选对象权限变更事件
| parse EventDescription with * 
    "Subject: " * 
    "  Security ID: " Subject_SecurityID "\n"
    "  Account Name: " Subject_AccountName "\n"
    "  Account Domain: " Subject_AccountDomain "\n"
    "  Logon ID: " Subject_LogonID "\n" *
    "Object: " *
    "  Object Server: " Object_Server "\n"
    "  Object Type: " Object_Type "\n"
    "  Object Name: " Object_Name "\n"
    "  Handle ID: " Object_HandleID "\n" *
    "Process: " *
    "  Process ID: " Process_ID "\n"
    "  Process Name: " Process_Name "\n" *
    "Permissions Change: " *
    "  Original Security Descriptor: " Permissions_OriginalSD "\n"
    "  New Security Descriptor: " Permissions_NewSD *
| project 
    TimeGenerated,
    Subject_SecurityID,
    Subject_AccountName,
    Subject_AccountDomain,
    Subject_LogonID,
    Object_Server,
    Object_Type,
    Object_Name,
    Object_HandleID,
    Process_ID,
    Process_Name,
    Permissions_OriginalSD,
    Permissions_NewSD

说明 #

• parse运算符通过匹配日志文本中的固定格式前缀，将对应内容提取到自定义列中，逻辑直观，适合结构稳定的日志。
• project子句用于筛选最终展示的列，保留提取后的字段和时间元数据。

方案二：使用extract函数（适配格式有细微变动的日志） #

如果日志存在少量换行、空格差异，用正则表达式精准提取更灵活：

SecurityEvent
| where EventID == 4670
| extend 
    Subject_SecurityID = extract(@"Security ID: (\S+)", 1, EventDescription),
    Subject_AccountName = extract(@"Account Name: (\S+)", 1, EventDescription),
    Subject_AccountDomain = extract(@"Account Domain: (\S+)", 1, EventDescription),
    Subject_LogonID = extract(@"Logon ID: (\S+)", 1, EventDescription),
    Object_Server = extract(@"Object Server: (\S+)", 1, EventDescription),
    Object_Type = extract(@"Object Type: (\S+)", 1, EventDescription),
    Object_Name = extract(@"Object Name: (.+?)\n", 1, EventDescription),
    Object_HandleID = extract(@"Handle ID: (\S+)", 1, EventDescription),
    Process_ID = extract(@"Process ID: (\S+)", 1, EventDescription),
    Process_Name = extract(@"Process Name: (.+?)\n", 1, EventDescription),
    Permissions_OriginalSD = extract(@"Original Security Descriptor: (.+?)\n", 1, EventDescription),
    Permissions_NewSD = extract(@"New Security Descriptor: (.+?)\]", 1, EventDescription)
| project 
    TimeGenerated,
    Subject_SecurityID,
    Subject_AccountName,
    Subject_AccountDomain,
    Subject_LogonID,
    Object_Server,
    Object_Type,
    Object_Name,
    Object_HandleID,
    Process_ID,
    Process_Name,
    Permissions_OriginalSD,
    Permissions_NewSD

说明 #

• extract函数通过正则表达式匹配字段内容，能兼容日志中少量格式变动，比如空格、换行的细微差异。
• 正则中的(\S+)匹配非空白字符，(.+?)\n匹配到换行前的任意内容，适配字段值含空格的场景。

内容的提问来源于stack exchange，提问作者Edw