...
EventCode 2889, exposing Binding Type
index="winevent_dc_index" source="wineventlog:directory service" EventCode="2889" | rex field=_raw "(?ms)Binding\s+Type:\s+(?<typeBind>\d)"| table _time, host, EventCode, ClientIdentity, ClientIPAddress, typeBind