https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294444#M690 <P>Thank you!</P> Mon, 13 Feb 2017 15:08:32 GMT dhrechkosy 2017-02-13T15:08:32Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294439#M685 <P>Trying to figure out how to search for all logon/logoff attempts by any users in the "Domain Admins" group in active directory. I am currently using Splunk Light 6.5.2 and forwarding the security log events from one single domain controller to Splunk.</P> <P>What would be a proper search string to use to find account logon/logoff activity for domain admins? Will I need to do a general search for all logon and logoff activity and then filter it to the specific users I'm looking for?</P> <P>There are 3 staff in the domain admins group as well as the built in domain-administrator account. Management wants me to find a way to track logs for every logon/logoff for these four accounts.</P> <P>Any suggestions will be helpful as I'm still quite new to this software.</P> Fri, 10 Feb 2017 16:26:31 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294439#M685 dhrechkosy 2017-02-10T16:26:31Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294440#M686 <P>You could add your domain admins to a lookup file/table.<BR /> Using a sub search you could read your list of users using inputlookup and then in the main search look for login events.</P> <PRE><CODE>tag=authentication tag=login [search inputlookup admin_users.csv] </CODE></PRE> <P>(I'm not near a system with windows logs to test/get you proper syntax but hopefully that gives you enough)</P> Sat, 11 Feb 2017 09:41:07 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294440#M686 nickhills 2017-02-11T09:41:07Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294441#M687 <P>This is the easiest being new. Longer term you could make a lookup table inspired by the Enterprise Security app format for identities.<BR /> <A href="http://docs.splunk.com/Documentation/ES/4.6.0/User/AssetandIdentityLookupReference">http://docs.splunk.com/Documentation/ES/4.6.0/User/AssetandIdentityLookupReference</A></P> <P>Then apply it as an auto lookup on the sourcetype of those logs. <BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Knowledge/Makeyourlookupautomatic">http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Knowledge/Makeyourlookupautomatic</A></P> Sat, 11 Feb 2017 12:24:20 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294441#M687 starcher 2017-02-11T12:24:20Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294442#M688 <P>Perfect I will try this suggestion. Do you know where the admin_users.csv file will need to be placed in order for splunk to recognize it when I run this sub search?</P> Mon, 13 Feb 2017 14:55:12 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294442#M688 dhrechkosy 2017-02-13T14:55:12Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294443#M689 <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/PivotTutorial/AddlookupfilestoSplunk">https://docs.splunk.com/Documentation/Splunk/latest/PivotTutorial/AddlookupfilestoSplunk</A></P> Mon, 13 Feb 2017 14:57:19 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294443#M689 starcher 2017-02-13T14:57:19Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294444#M690 <P>Thank you!</P> Mon, 13 Feb 2017 15:08:32 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294444#M690 dhrechkosy 2017-02-13T15:08:32Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294445#M691 <P>Just a few more questions/clarifications needed:</P> <P>For the two tags you mentioned "authentication" and "login" what field should those correspond to?</P> <P>I set authentication to EventCode=4634 and EventCode=4672, not sure if thats right and not certain what login should be set as.</P> <P>For the admin_users.csv file what is the format it should be in? Currently I just had an empty csv file with:</P> <P>Username<BR /> Username<BR /> Username</P> <P>Should there be any special formatting inside the .csv file to list the domain admin names properly?</P> Mon, 13 Feb 2017 15:38:05 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294445#M691 dhrechkosy 2017-02-13T15:38:05Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294446#M692 <P>your CSV will need to contain a header row, and you may find it useful to drop some friendly names in too.</P> <PRE><CODE>username, firstname, surname bob.jones, bob, jones user662237, mike, smith </CODE></PRE> <P>etc.</P> Mon, 13 Feb 2017 16:45:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294446#M692 nickhills 2017-02-13T16:45:56Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294447#M693 <P>Hi Nick,</P> <P>Thanks looks like I have that all figured out now. As for the tags what field value pairs do you recommend?</P> <P>authentication: </P> <P>login: </P> Mon, 13 Feb 2017 16:52:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/294447#M693 dhrechkosy 2017-02-13T16:52:22Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/707213#M21159 <P>&nbsp;</P><P>Hi do you mind sharing the search string/spl you used to the the AD login information?</P><P>Thank you!</P> Wed, 18 Dec 2024 19:48:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-for-logon-logoff-activity-of-domain-admins/m-p/707213#M21159 viscarra 2024-12-18T19:48:15Z