[BUG] ESCU CS fields LogonType and TargetUserName

Open

#2,869 opened on Oct 2, 2023 3 comments 0 reactions 1 assignee View on GitHub

@josehelps is already working on this.

Since Jan 23, 2024.

Assessment

This issue has not been assessed yet.

Description

bug

Describe the bug

There are some CS that are not using the correct field name using the last version of the "Splunk Add-on for Microsoft Windows".

Expected behavior

Some CS need to be change to the correct field names.
Field Original Name > New Name
LogonType > Logon_Type
TargetUserName > Target_User_Name > user

https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+LogonType&type=code
https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+TargetUserName&type=code
https://github.com/search?q=repo%3Asplunk%2Fsecurity_content+Target_User_Name&type=code

App Version:

Splunk Version 9.0.4.1
ES Content Updates 4.12.0
Enterprise Security 7.1.1

Dominant language: Python
Stars: 1.7k
Forks: 494
Avg merge: 2d 7h
Merged PRs (30d): 35

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

More from splunk/security_content

Duplicate *http* Pattern in Windows Ngrok Reverse Proxy Usage Detection Open

Difficulty 1/5 Under an hour Newbie friendliness 72/100

splunk/security_content#4275 · 1 comment · Opened Sep 19, 2026
Lookup replication issue with DA-ESS-ContentUpdate on distributed search Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

splunk/security_content#4229 · 1 comment · Opened Aug 22, 2026
Suggested Enhancement for Detection: Windows AD Short Lived Domain Account ServicePrincipalName Open

enhancement

splunk/security_content#3941 · 1 assignee · Opened Mar 6, 2026
Suggested Enhancement for ESCU Detection: Internal Horizontal Port Scan NMAP Top 20 Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 58/100

splunk/security_content#3604 · 3 comments · Opened Jul 12, 2025

All issues in splunk/security_content

Similar issues

[BUG] GkeTpuCluster queries metadata.google.internal for MEGASCALE_SLICE_ID even when TPU_SKIP_MDS_QUERY is set Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

jax-ml/jax#40854 · Opened Sep 22, 2026
[pcied] Honour PCIE_DETACH_INFO on platforms that are not smartswitches Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

sonic-net/sonic-platform-daemons#900 · Opened Sep 21, 2026
MCP client has no httpx timeout, so the event stream fails after 5 seconds Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

Azure/azure-functions-agents-runtime#228 · Opened Sep 21, 2026
feat(mcp): friendlier error when `run_cloud_sync` is called on a disabled connection Open

enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

airbytehq/PyAirbyte#1205 · Opened Sep 21, 2026
pn7160: reader goes permanently deaf — post-read IRQ-low check fails reads that succeeded Open

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

esphome/esphome#19452 · Opened Sep 21, 2026

More Python issues

A short digest of beginner-friendly GitHub issues.