<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4673</EventID><Version>0</Version><Level>0</Level><Task>13056</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-07-27T05:25:02.933560800Z'/><EventRecordID>48497301</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='4596'/><Channel>Security</Channel><Computer>IP-C61301BB.prdnca.umbrellaint.com</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>IP-C61301BB$</Data><Data Name='SubjectDomainName'>prdnca</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='ObjectServer'>NT Local Security Authority / Authentication Service</Data><Data Name='Service'>LsaRegisterLogonProcess()</Data><Data Name='PrivilegeList'>SeTcbPrivilege</Data><Data Name='ProcessId'>0x290</Data><Data Name='ProcessName'>C:\Windows\System32\lsass.exe</Data></EventData><RenderingInfo Culture='en-US'><Message>A privileged service was called.

Subject:
	Security ID:		S-1-5-18
	Account Name:		IP-C61301BB$
	Account Domain:		prdnca
	Logon ID:		0x3E7

Service:
	Server:	NT Local Security Authority / Authentication Service
	Service Name:	LsaRegisterLogonProcess()

Process:
	Process ID:	0x290
	Process Name:	C:\Windows\System32\lsass.exe

Service Request Information:
	Privileges:		SeTcbPrivilege</Message><Level>Information</Level><Task>Sensitive Privilege Use</Task><Opcode>Info</Opcode><Channel>Security</Channel><Provider>Microsoft Windows security auditing.</Provider><Keywords><Keyword>Audit Success</Keyword></Keywords></RenderingInfo></Event>
This is a syslog message from a product called Windows Logs by Microsoft. The following fields were extracted from the message:
fieldExtractorName: windows_security_audit_xml
messageType: security_audit_event
senderHost: 10.168.2.6-SecurityEvents
sensitivity: normal
serverHostname: IP-C61301BB.prdnca.paygoint.com
sourceInfo: unknown
streamName: windows_security_audit
tags: ['eventId:4673', 'windows_security_audit', 'security_audit_event']