topic WinEventLog:Security EventCode 4732 Name instead of SID in Splunk- How can I view the account or username? in Getting Data In

WinEventLog:Security EventCode 4732 Name instead of SID in Splunk- How can I view the account or username?

garrywilmeth — Fri, 24 Jun 2022 15:54:46 GMT

Hello,

I have all auditing enabled via GPO and I am getting WinEventLog:Security logs in Splunk. I am attempting to generate an alert when a user or group is added to local admin on a host. I see the SID that gets added in the Win event log on the host showing as the group or account name, but I see the corresponding event in Splunk showing the same entry as the alpha/numeric SID. How can I view the account or username in Splunk for these events?

Thanks,

Garry

Re: WinEventLog:Security EventCode 4732 Name instead of SID in Splunk- How can I view the account or username?

chrisRed — Thu, 16 Mar 2023 18:16:28 GMT

This appears to be an old post, but for the sake of others looking for solutions, the win event id does return account name fields. Sometimes, if your running in smart mode, you may not see all fields, so I recommend using verbose mode, then extract the fields you need. I noticed the Account_Name field has more than one entry, so it helps to add a | eval user = mvindex(Account_Name, 0) to filter out unwanted info.