topic Re: Identifying non-reporting hosts via correlation with DNS. in Getting Data In

Identifying non-reporting hosts via correlation with DNS.

rmckerchar — Mon, 28 Sep 2020 12:41:56 GMT

Hi guys,

I'm trying to define a search to spot Active Directory domain controllers which have not (and possibly never have) sent theie security logs into Splunk.

I can easily get a list of domain controllers from DNS (_ldap._tcp.dc._msdcs. SRV records). First stage I'd simply like to paste this list into a search and then do a set operation to subtract hosts which we've received data from. Later I guess I could get splunk to do the DNS query too.

Something like, to mix splunk & SQL syntax:

["list of DCs here" as host] host NOT IN [search sourcetype="wineventlog:security" | dedup host | fields host]

To show me everything in the first list which doesn't match a host in the second.

regards,

-ross

Re: Identifying non-reporting hosts via correlation with DNS.

bmacias84 — Fri, 26 Oct 2012 15:56:14 GMT

You could store your DC list in a csv and use lookup, just index a list of DCs, or WMI query AD peroidicly.. Once your have your complete search just use the diff command. You probably have to play around a bit with the your results.



... | diff pos1=1 pos2=3 attribute=domain_contorller

Hope this helps you. Cheers.

Please don't forget to click accept and up this post, if it helps you.

Additional reading:

Diff

enriching-data-with-lookups-part-1

enriching-data-with-db-lookups-part-2

CreateAndConfigureFieldLookups

Re: Identifying non-reporting hosts via correlation with DNS.

rmckerchar — Sat, 27 Oct 2012 15:25:34 GMT

Ta very much. I started this but then just switch to deploy Splunk for Active Directory app instead!

Re: Identifying non-reporting hosts via correlation with DNS.

rmckerchar — Thu, 08 Nov 2012 15:22:33 GMT

Here's how I ended up solving this:

So,

Do some LDAP searches to get DCs for a couple of our domains (had to do a union here as I domain=A OR domain=B didn't seem to work in conjuction with the ldapsearch app)
Rename the cn field as host.
Diff against a search which returns all DCs only (in our case this was a specific index used by DC security logs). Upper the host field to get around case differences.

Interestingly, the "fields somefield - _*" syntax didn't work as a filter here, hence multiple use of "fields". One to select fields, one to filter out the ones I didn't want.

-ross