#event_simpleName=UserLogon UserSid=S-1-5-21-*
| in(LogonType, values=["2","10"])
| ipLocation(aip)
| $falcon/helper:enrich(field=UserIsAdmin)
| $falcon/helper:enrich(field=LogonType)
| PasswordLastSet := PasswordLastSet*1000
| ContextTimeStamp := ContextTimeStamp*1000
| PasswordLastSet := formatTime("%Y-%m-%d %H:%M:%S", field=PasswordLastSet, locale=en_US, timezone=Z)
| ContextTimeStamp := formatTime("%Y-%m-%d %H:%M:%S", field=ContextTimeStamp, locale=en_US, timezone=Z)
| table(["ContextTimeStamp", "aid", "UserName", "UserSid", "LogonType", "UserIsAdmin", "PasswordLastSet", "aip.city", "aip.state", "aip.country"])