topic How do you use the rex command to filter Windows security events? in Splunk Search

How do you use the rex command to filter Windows security events?

swimena — Fri, 15 Feb 2019 11:52:00 GMT

Hi there,

I'm trying to extract some data from Windows security logs and filter the counted results.

This search doesn't work though — any help?

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?i)Subject:W\r\n\tSecurity ID:\t\t(?P<Subject>.+)"  
| rex "(?i)Member:\W\r\n\tSecurity  ID:\t\t(?P<Member>.+)" 
| rex "(?i)Group:\W\r\n\tSecurity ID:\t\t(?P<Group>.+)"
| search group_obj_id="*admin*" OR group_obj_id="*adm*" OR group_obj_id="*admn*"
| convert ctime(_time) AS time
| eval Group_and_time=Group+"--"+time
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member
| where group_count>1
| rename group_count as "Group Count"

Re: How do you use the rex command to filter Windows security events?

DMohn — Fri, 15 Feb 2019 12:47:08 GMT

First of all, your RegEx does not seem to work ... you have to make it multiline-matching, the case-instensitivity is not necessary. It can be eased down a bit as well. Next, line #5 is sort of redundant, as group_obj_id="*adm*" covers the other two selections as well. The rest seems to work fine - at leat in my test environment.

This does it for me:

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?im)Subject:[^:]+:\t*(?P<Subject>.+)\n" 
| rex "(?im)Member:[^:]+:\t*(?P<Member>.+)\n" 
| rex "(?im)Group:[^:]+:\t*(?P<Group>.+)\n" 
| search group_obj_id="*adm*"
| convert ctime(_time) AS time 
| eval Group_and_time=Group+"--"+time 
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member 
| where group_count>1 
| rename group_count as "Group Count"

Re: How do you use the rex command to filter Windows security events?

swimena — Fri, 15 Feb 2019 13:17:25 GMT

Thanks again @DMohn 🙂

I'm getting results in the Events tab, however, I can't display any statistics out of it.
I'll try to cut some of the code and see whether anything changes...