in_winevtlog: Add a describing link for capability SIDs

Signed-off-by: Hiroshi Hatake <hiroshi@chronosphere.io>
fluent · Aug 22, 2024 · 839c963 · 839c963
1 parent 05a7e3a
commit 839c963
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/plugins/in_winevtlog/pack.c b/plugins/in_winevtlog/pack.c
@@ -278,7 +278,8 @@ static int pack_sid(struct winevtlog_config *ctx, PSID sid, int extract_sid)
     if (ConvertSidToStringSidW(sid, &wide_sid)) {
         if (extract_sid == FLB_TRUE) {
             /* Skip to translate SID for capability SIDs.
-             * see also: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
+             * ref: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
+             * See also: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/sids-not-resolve-into-friendly-names
              */
             if (wcsnicmp(wide_sid, L"S-1-15-3-", 9) == 0) {
                 flb_plg_debug(ctx->ins, "This SID is one of the capability SIDs. Skip.");