topic Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security? in Splunk Enterprise Security

How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Tylerdygert — Mon, 05 Nov 2018 15:59:53 GMT

Hello,

Our correlation search for "account deleted" in Splunk is firing for any type of machine deletion detected on our domain controllers.

Here is our correlation search:

| from datamodel:"Change_Analysis"."Account_Management" | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This rule fires for machine deletions such as when our system engineers remove machines after testing. We don't want to see this activity in incident review. We only want to know when someone has removed a user account.

Doing some digging, I can see that there are specific event codes for different types of deletions in wineventlog. For a user account deletion, the eventcode is 4726, but when a machine account is deleted, the eventcode is 4743. So, I made a copy of our correlation rule and added the 4726 event code into the rule like so:

| from datamodel:"Change_Analysis"."Account_Management" | where EventCode=4726 | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This is not working. I tested this search this morning after seeing a user account getting removed. And when I run this version of the search, I get no results.

Am I putting the 'where EventCode=4726' portion in the wrong part of the search string? Will this not work within a data model search?

Thank You,

Tyler Dygert

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

miwade — Mon, 05 Nov 2018 20:16:05 GMT

| from datamodel:"Change_Analysis"."Account_Management" | search EventCode=4726 tag=delete

This should take care of it.

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Tylerdygert — Mon, 05 Nov 2018 21:34:28 GMT

This does not work. When I run this for a time frame when we had one of these events we get no results

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

dherrald_splunk — Mon, 05 Nov 2018 22:39:54 GMT

Depending on the versions of the CIM and Windows TA, this base search might work for you:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Tylerdygert — Tue, 29 Sep 2020 21:55:29 GMT

This worked, thank you. Our final search looks like this now:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"| stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0