Windows Events 4625 is missing Disposition meta key
3 years ago
Originally Published: 2017-06-02
Article Number
000049966
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: SA Core Appliance
RSA Version/Condition: 10.6.2.0
 
Issue
If you are using Windows Events 4625 and have not updated your Windows parsers you may not see some subcodes parsed properly.
Cause
The meta keys used for Windows Events 4625 were changed to offer a more descriptive name.
Resolution
For more information on the Windows 4625 events please refer to the following RSA community blog:

Analyst's Reference: Windows 4625