topic Re: In Windows Security logs while using transaction why am I unable to get proper results? in Knowledge Management

In Windows Security logs while using transaction why am I unable to get proper results?

zaynaly — Mon, 24 Sep 2018 12:42:14 GMT

 sourcetype="WinEventLog:Security" host=PC* (EventCode=5059 OR EventCode=4648) |  transaction maxspan=5s startswith=eval(EventCode=5059) endswith=eval(EventCode=4648) keeporphans=false | table _time,host,EventCode,Account_Name

I'm trying to query for all computers and find the event code 5059 followed with an event 4648 within 5 seconds from the same computer. However, the search results return events from 2 different computers and matches them to the same transaction. How can I improve this search query?

Re: In Windows Security logs while using transaction why am I unable to get proper results?

Richfez — Mon, 24 Sep 2018 13:08:13 GMT

It may be the only thing you are actually missing is the field list to match on.

sourcetype="WinEventLog:Security" host=PC* (EventCode=5059 OR EventCode=4648) 
| transaction maxspan=5s startswith=eval(EventCode=5059) endswith=eval(EventCode=4648) keeporphans=false host
| table _time,host,EventCode,Account_Name

Add that host to the end of the transaction says to only connect them on where host is the same.

Happy Splunking!
-Rich

Re: In Windows Security logs while using transaction why am I unable to get proper results?

zaynaly — Tue, 25 Sep 2018 14:07:21 GMT

Is there any way to add 3 or more consecutive events to the transacation? I see only start and end, meaning only 2 events?

Re: In Windows Security logs while using transaction why am I unable to get proper results?

Richfez — Tue, 25 Sep 2018 14:19:52 GMT

If there were three or more consecutive events, they would all be added in. You can possibly see this already if you check the field "eventcount".

OH! I see why. Sorry, I wasn't paying close enough attention.

In the initial search, you search ONLY for (EventCode=5059 OR EventCode=4648). So that's all you get. And if you then build a transaction starting with 5059 and ending with 4648...

Try removing that bit.

 sourcetype="WinEventLog:Security" host=PC*  
 | transaction maxspan=5s startswith=eval(EventCode=5059) endswith=eval(EventCode=4648) keeporphans=false host
 | table _time,host,EventCode,Account_Name

Let me know if that's better. 🙂

-Rich