Content Comparison

...

index="winevent_dc_index" source="wineventlog:directory service" EventCode="2889"
| rex field=_raw "(?ms)Binding\s+Type:\s+(?<typeBind>\d)"
| table _time, host, EventCode, ClientIdentity, ClientIPAddress, typeBind

Truth Tables

Wireshark - SASL bind behavior

In observing the behavior of macOS connections, a SASL bind sequence is observed. This sequence is seen when macOS sits at the login screen, or when dscl runs queries. This sequence triggers a 2889 event code.

Client: LDAP search for base properties of the directory.	Image Added
Server: Result indicating that it support SASL GSSAPI bind.	Image Added
Client: SASL bindRequest of type GSSAPI, on port 389.	Image Added
Server: saslBindInProgress using GSS-API and specifying encryption type.	Image Added
Client: SASL bindRequest of type GSSAPI, sending from port 88 (Kerberos).	Image Added
Server: saslBindInProgress using GSS-API and hashes.	Image Added
Client: SASL bindRequest of type GSSAPI, declaring credential hash.	Image Added
Server: Bind success.	Image Added

Appendix: Raw text from testing notes

...