topic Re: How to tranlate SID from Windows event in Getting Data In

How to tranlate SID from Windows event

evelenke — Tue, 07 May 2019 13:57:44 GMT

Hi Splunkers,

we need to analyze events with code 4662 that contains accessed AD objects, unfortunately object values are presented as IDs (example - %{bf967a86-0de6-11d0-a285-00aa003049e2}, like it is presented in EventViewer).

Will an attribute evt_resolve_ad_obj = 1 translate IDs (Object Name, Object Type) into names? OR it converts only Security ID?
Is there any suggestion how to translate those IDs to be presented as readable names in EventViewer directly?

Re: How to tranlate SID from Windows event

woodcock — Tue, 07 May 2019 15:55:24 GMT

You are correct, you need the evt_resolve_ad_obj = 1 setting and it will resolve EVERYTHING.

Re: How to tranlate SID from Windows event

evelenke — Tue, 07 May 2019 23:59:35 GMT

Thanks,and I've found a new detail in documentation, I'm afraid with our GUIDs will not work, but have to try:

" Splunk software cannot translate SIDs that are not in the format S-1-N-NN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNN"

Re: How to tranlate SID from Windows event

woodcock — Wed, 08 May 2019 01:43:23 GMT

I have never seen SIDs that did not get resolved.

Re: How to tranlate SID from Windows event

evelenke — Tue, 14 May 2019 09:51:47 GMT

DIdn't get to prove, because we've decided to grab sids and guids via ldapsearch and format lookup.
But thanks, accepting!

Re: How to tranlate SID from Windows event

woodcock — Tue, 14 May 2019 14:53:54 GMT

WAIT! Don't click accept on this answer! We would all like to hear about your clever workaround. That sill surely help somebody else (maybe me) in the future!