Open andrewkroh opened 5 months ago
Is that Iff
an If-and-only-if
or just a mistype? From context, it looks like if-and-only-if
. I love seeing the maths in here!
That's the problem with iff outside of math/logic contexts, you never know if it is intentional or a typo 😆 . I did lazily mean if and only if. I probably should have written "if JoinInfo contains exactly one subkey then read the UserEmail value from that subkey...".
Add a
Domain
Field to thetypes.Host
struct. For Windows this should be populated with the host's Active Directory (AD) or Entra ID domain name. This value should satisfy the definition of thehost.domain
field in ECS.Windows registry data sources
HKLM:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\Machine
and readDistinguished-Name
CN=ComputerName,OU=Computers,DC=domain,DC=com
. I think we would join together theDC
components to form the domain name.HKLM:SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin\\JoinInfo\\
JoinInfo
contains one entry then get theUserEmail
value from within that entry and then parse the domain from the email address. If JoinInfo contains more than one entry then the computer is joined to more than one domain so do nothing.References