What is a one sentence summary of your feature request?
o Add a consistent, explicit SIEM variable for the originating domain controller or agent across Active Directory threat alerts, including Golden Ticket.
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
o %ORIGINATING_SERVER% doesn’t consistently capture the DC hostname for several AD threat types. We first noticed this with Golden Ticket, but the same gap shows other replication-based threats. All of these share the same underlying problem: there isn’t a reliable native variable that tells us which DC or agent detected or was targeted by the threat.
o We’d like an explicit SIEM variable that reliably provides the originating DC or agent across this whole set of AD threat types, not just Golden Ticket. Having this would help us identify which environment or server detected or was targeted by a threat, map lateral movement across DCs, scope and contain incidents to the right DC faster, and correlate related alerts (like a DCSync followed by a Golden Ticket) to the correct infrastructure without having to dig through the UI every time, or even our own logs to help correlate the activity.
How do you currently solve the challenges you have by not having this feature?
o Right now, there isn’t a reliable automated way to do this. Since %ORIGINATING_SERVER% doesn’t consistently populate with the DC hostname for these threat types, an analyst has to manually log into the Netwrix web UI and check the “Originating Server Name” or “Originating Agent” field on each individual threat to figure out which DC was involved, if one is even listed. Otherwise, we have to dig through our WEF logs to understand the threat more thoroughly. That’s a manual lookup every single time, and it slows triage across all of these alert types, not just one. It also makes it harder to quickly map lateral movement or correlate related alerts when speed really matters.