view release on metacpan or  search on metacpan

lib/Algorithm/ToNumberMunger.pm  view on Meta::CPAN

    { munger => 'windows_logon_status_enum', default => -1 }

Named-map enum (lookup rules as L</dns_rcode_enum>) for the NTSTATUS
sub-status on a failed Windows logon (events 4625/4776), collapsed to a
compact B<reason category> rather than the raw 32-bit code: C<0xC0000064>
(no such user) 0, C<0xC000006A> (bad password) 1, C<0xC000006D> (generic bad
user/pass) 2, C<0xC000006F> (outside hours) 3, C<0xC0000070> (workstation
restriction) 4, C<0xC0000071> (password expired) 5, C<0xC0000072> (disabled)
6, C<0xC0000193> (account expired) 7, C<0xC0000133> (clock skew) 8,
C<0xC0000224> (must change password) 9, C<0xC0000234> (locked out) 10,
C<0xC000015B> (logon type not granted) 11. Keys are the hex codes exactly as
logged (matched case-insensitively); only the common logon subset is baked in,
so an unlisted code croaks unless a numeric C<default> is given. Numeric
inputs are not passed through.

=head2 windows_impersonation_level_enum

    { munger => 'windows_impersonation_level_enum', default => -1 }

Named-map enum (lookup rules as L</dns_rcode_enum>) for the event 4624

lib/Algorithm/ToNumberMunger.pm  view on Meta::CPAN

			# not itself a useful feature. Keys are the hex codes as logged.
			'0xc0000064' => 0,     # user name does not exist
			'0xc000006a' => 1,     # bad password
			'0xc000006d' => 2,     # bad user name or password (generic)
			'0xc000006f' => 3,     # outside authorized hours
			'0xc0000070' => 4,     # workstation restriction
			'0xc0000071' => 5,     # password expired
			'0xc0000072' => 6,     # account disabled
			'0xc0000193' => 7,     # account expired
			'0xc0000133' => 8,     # clock skew between client and server
			'0xc0000224' => 9,     # must change password at next logon
			'0xc0000234' => 10,    # account locked out
			'0xc000015b' => 11,    # logon type not granted
		},
	},
	windows_impersonation_level => {
		numeric => 0,
		map     => {
			# 4624 ImpersonationLevel; ordinal by reach. Text labels plus the
			# two "%%18xx" message tokens Windows most often emits in place.
			anonymous      => 0,

lib/Algorithm/ToNumberMunger.pm  view on Meta::CPAN

high-cardinality noise, but "an internal host suddenly talking multicast" is
a class-level signal. Classes and their emitted numbers:

    0  global       anything not covered below
    1  private      10/8, 172.16/12, 192.168/16, 100.64/10 (CGNAT), fc00::/7 (ULA)
    2  loopback     127/8, ::1
    3  link_local   169.254/16, fe80::/10
    4  multicast    224/4, ff00::/8
    5  broadcast    255.255.255.255
    6  unspecified  0.0.0.0, ::
    7  reserved     0/8, 192.0.0/24, the documentation nets (192.0.2/24,
                    198.51.100/24, 203.0.113/24, 2001:db8::/32), benchmarking
                    (198.18/15), 240/4, and the 100::/64 discard prefix

An IPv4-mapped IPv6 address (C<::ffff:a.b.c.d>) is classified as its embedded
IPv4 address. An unparseable input croaks, or yields the numeric C<default>
when one is given. IPv6 parsing uses L<Socket>'s C<inet_pton>, loaded lazily
the way L</datetime> loads Time::Piece. For B<site-specific> zones (DMZ,
server VLAN, guest Wi-Fi) use L</cidr>, which knows your networks instead of
the RFCs'.

=head2 cidr