https://community.splunk.com/t5/Getting-Data-In/Translate-GUID-in-Windows-Event-Log-during-Searchtime/m-p/104215#M21939 <P>I would assume you could do it with a lookup (scripted or CSV) that does an LDAP search against your AD tree. From what I'm seeing here, objectGUID is an operational attribute of each object.</P> <P><A href="http://msdn.microsoft.com/en-us/library/cc221017%28v=PROT.10%29.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/cc221017%28v=PROT.10%29.aspx</A></P> <P>It's not perfect yet, but I got close using just ldapsearch, as follows:</P> <P>ldapsearch -h my.ad.server -x -D "CN=bindaccount,CN=Users,DC=my,DC=com" -W -b DC=my,DC=com "(objectGuid=*)" distinguishedName objectGuid</P> <P>This dumps (in ldif format) every object that has a GUID, showing its GUID and its DN. There's some non-entirely-trivial reformatting to turn this into a CSV for lookup purposes. The same thing might be more easily done with the Python LDAP modules:</P> <P><A href="http://www.packtpub.com/article/installing-and-configuring-the-python-ldap-library-and-binding-to-an-ldap-directory" rel="nofollow">http://www.packtpub.com/article/installing-and-configuring-the-python-ldap-library-and-binding-to-an-ldap-directory</A></P> <P><A href="http://www.packtpub.com/article/python-ldap-applications-ldap-opearations" rel="nofollow">http://www.packtpub.com/article/python-ldap-applications-ldap-opearations</A></P> <P><A href="http://www.packtpub.com/article/python-ldap-applications-more-ldap-operations-and-the-ldap-url-library" rel="nofollow">http://www.packtpub.com/article/python-ldap-applications-more-ldap-operations-and-the-ldap-url-library</A></P> Tue, 14 Dec 2010 23:30:34 GMT dwaddle 2010-12-14T23:30:34Z https://community.splunk.com/t5/Getting-Data-In/Translate-GUID-in-Windows-Event-Log-during-Searchtime/m-p/104214#M21938 <P>Is there a way to translate any GUID's to their corresponding AD objects as with "evt_resolve_ad_obj," but during Searchtime?</P> Tue, 14 Dec 2010 03:56:42 GMT https://community.splunk.com/t5/Getting-Data-In/Translate-GUID-in-Windows-Event-Log-during-Searchtime/m-p/104214#M21938 muebel 2010-12-14T03:56:42Z https://community.splunk.com/t5/Getting-Data-In/Translate-GUID-in-Windows-Event-Log-during-Searchtime/m-p/104215#M21939 <P>I would assume you could do it with a lookup (scripted or CSV) that does an LDAP search against your AD tree. From what I'm seeing here, objectGUID is an operational attribute of each object.</P> <P><A href="http://msdn.microsoft.com/en-us/library/cc221017%28v=PROT.10%29.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/cc221017%28v=PROT.10%29.aspx</A></P> <P>It's not perfect yet, but I got close using just ldapsearch, as follows:</P> <P>ldapsearch -h my.ad.server -x -D "CN=bindaccount,CN=Users,DC=my,DC=com" -W -b DC=my,DC=com "(objectGuid=*)" distinguishedName objectGuid</P> <P>This dumps (in ldif format) every object that has a GUID, showing its GUID and its DN. There's some non-entirely-trivial reformatting to turn this into a CSV for lookup purposes. The same thing might be more easily done with the Python LDAP modules:</P> <P><A href="http://www.packtpub.com/article/installing-and-configuring-the-python-ldap-library-and-binding-to-an-ldap-directory" rel="nofollow">http://www.packtpub.com/article/installing-and-configuring-the-python-ldap-library-and-binding-to-an-ldap-directory</A></P> <P><A href="http://www.packtpub.com/article/python-ldap-applications-ldap-opearations" rel="nofollow">http://www.packtpub.com/article/python-ldap-applications-ldap-opearations</A></P> <P><A href="http://www.packtpub.com/article/python-ldap-applications-more-ldap-operations-and-the-ldap-url-library" rel="nofollow">http://www.packtpub.com/article/python-ldap-applications-more-ldap-operations-and-the-ldap-url-library</A></P> Tue, 14 Dec 2010 23:30:34 GMT https://community.splunk.com/t5/Getting-Data-In/Translate-GUID-in-Windows-Event-Log-during-Searchtime/m-p/104215#M21939 dwaddle 2010-12-14T23:30:34Z