SID Decode

Parse Security

Synopsis

Extracts and decodes Windows Security Identifier (SID) information.

Schema

- sid_decode:
    field: <ident>
    target_field: <string>
    format: <string>
    resolve_well_known: <boolean>
    add_components: <boolean>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    tag: <string>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Source field containing SID to decode (string, byte array, or array of strings)
target_field	N	{field}_decoded	Target field to store decoded SID information
format	N	Auto-detect	Input format: string, hex, base64 (auto-detects if not specified)
resolve_well_known	N	false	Resolve well-known SIDs to account names
add_components	N	false	Add parsed SID components (revision, authority, sub-authorities, domain info)
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	Continue processing if decoding fails
ignore_missing	N	false	Skip processing if referenced field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
tag	N	-	Identifier
disabled	N	false	When true, the processor is skipped and the event continues to the next one. Lets you take a processor out of the path without removing its configuration

Details

Decodes Windows Security Identifiers (SIDs) from multiple input formats (string, hex, base64, byte arrays) into standardized SID strings with optional component parsing and well-known SID resolution.

The processor supports three input formats with automatic detection: standard SID strings (S-1-5-21-...), hexadecimal binary SIDs, and base64-encoded binary SIDs. Byte arrays are processed directly as binary SID data.

Default behavior returns the SID string only. Use add_components to extract revision, authority, authority name, sub-authorities, domain identification, and RID information. Use resolve_well_known to map SIDs to account names like "Local System", "Administrators", "Domain Admins".

When add_components is enabled for domain SIDs (S-1-5-21-...), the processor identifies domain context, extracts domain_id, RID, and RID type (well-known, user, group/computer). Well-known RIDs (500=Administrator, 512=Domain Admins, etc.) are automatically resolved.

The processor handles arrays of SIDs, processing each element independently with consistent error handling via ignore_failure.

Examples

Basic String SID

Decoding SID string...	{ "user_sid": "S-1-5-21-1234567890-1234567890-1234567890-1001" } - sid_decode: field: user_sid
returns SID string by default:	{ "user_sid": "S-1-5-21-1234567890-1234567890-1234567890-1001", "user_sid_decoded": "S-1-5-21-1234567890-1234567890-1234567890-1001" }

Well-Known SID Resolution

Resolving well-known SID to account name...	{ "sid": "S-1-5-18" } - sid_decode: field: sid resolve_well_known: true
adds name and well-known flag:	{ "sid": "S-1-5-18", "sid_decoded": { "sid": "S-1-5-18", "name": "Local System", "is_well_known": true } }

Component Parsing

Extracting SID component details...	{ "sid": "S-1-5-21-1234567890-1234567890-1234567890-1001" } - sid_decode: field: sid add_components: true
parses all SID components:	{ "sid": "S-1-5-21-1234567890-1234567890-1234567890-1001", "sid_decoded": { "sid": "S-1-5-21-1234567890-1234567890-1234567890-1001", "revision": 1, "authority": 5, "authority_name": "NT Authority", "sub_authorities": [21, 1234567890, 1234567890, 1234567890, 1001], "sub_authority_count": 5, "is_domain_sid": true, "domain_id": "1234567890-1234567890-1234567890", "rid": 1001, "rid_type": "user" } }

Hex Binary SID

Decoding binary SID from hex...	{ "hex_sid": "010100000000000512000000" } - sid_decode: field: hex_sid format: hex resolve_well_known: true
converts to SID string with name:	{ "hex_sid": "010100000000000512000000", "hex_sid_decoded": { "sid": "S-1-5-18", "name": "Local System", "is_well_known": true } }

Array of SIDs

Processing multiple SIDs...	{ "sids": [ "S-1-5-18", "S-1-5-32-544", "S-1-1-0" ] } - sid_decode: field: sids resolve_well_known: true
resolves each SID:	{ "sids": [...], "sids_decoded": [ { "sid": "S-1-5-18", "name": "Local System", "is_well_known": true }, { "sid": "S-1-5-32-544", "name": "Administrators", "is_well_known": true }, { "sid": "S-1-1-0", "name": "Everyone", "is_well_known": true } ] }