windows_event_disallowed_credentials

SCHEMA

cred_type	string	Types of credentials which were presented for delegation
description	string	Plugin description text
eventid	int	The Windows event ID
package	string	The name of Security Package which was used. Always CREDSSP for this event.
provider_name	string	The Windows event provider
source	string	The Windows event source
subject_domain	string	The domain or computer name for the account that reported the logon
subject_username	string	The account that reported the logon
target_server	string	SPN of the target service for which delegation was requested.
user_upn	string	UPN of the account for which delegation was requested.

-- windows_event_disallowed_credentials INFO
SELECT 
   -- Device ID DETAILS
   meta_hostname, meta_ip_address, 

   -- Query Details
   query_name, cred_type, description, eventid, package, provider_name,
   source, subject_domain, subject_username, target_server, user_upn,

   -- Decoration 
   meta_boot_time, meta_eid, meta_endpoint_type, 
   meta_ip_mask, meta_mac_address, meta_os_name, meta_os_platform, meta_os_type,
   meta_os_version, meta_public_ip, meta_query_pack_version, meta_username,

   --- Generic
   calendar_time, counter, epoch, host_identifier, numerics
   osquery_action, unix_time,

   -- Data Lake
   customer_id, endpoint_id, upload_size

FROM xdr_data
WHERE query_name = 'windows_event_disallowed_credentials'

So someone needs to test this, any takers want to and send me feedback?

Karl_Ackerman