topic Re: AD FS - event ID 1102 in Getting Data In

AD FS - event ID 1102

astatrial — Tue, 29 Sep 2020 23:57:03 GMT

Hello,
I have encountered a problem with AD FS events that has the ID 1102.
They are getting the action "cleared", and being classified as audit clearing events.
This happens because there is another WinEventLog with the same ID, which is about audit clearing - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=1102

The meaning of this event ID, referring to AD FS, is different, and it causing me a lot of false postive alerts about audit clearing (!!)

Do any of you know how to fix it ?

I am able to separate them from the event type "windows_audit_log_cleared", but it doesn't really useful as the correlation searches are using the "action" field to identify log clearing.

Thanks in advance.

Re: AD FS - event ID 1102

lakshman239 — Thu, 04 Apr 2019 12:35:47 GMT

Windows EventCode=1102 from domain controllers and windows servers/endpoints indicates 'log clear' and could indicate a malicious activity OR the logs are being cleared as part of upgrade/rebuilt etc..

If you are getting 1102 from ADFS servers, which you want to exclude, could you use the host name to exclude ADFS servers in the correlation search?

Re: AD FS - event ID 1102

astatrial — Thu, 04 Apr 2019 12:41:14 GMT

I can exclude those events by the SourceName at the moment. But i wondered how can i remove the action "cleared" from those events.

Re: AD FS - event ID 1102

lakshman239 — Wed, 30 Sep 2020 00:01:58 GMT

The action=cleared comes from the lookup table windows_audit_changes.csv within the Splunk_TA_windows