topic Re: Windows Events - Why does SRC_IP for an Active Directory Server appears different in different events? in Splunk Search

Windows Events - Why does SRC_IP for an Active Directory Server appears different in different events?

neerajs_81 — Fri, 29 Oct 2021 08:27:10 GMT

Folks, Need some assistance to understand why Splunk is reporting different IP's for the same hostname ( Active Dir Server) even though the AD server has only one static IP ip assigned to it.
For example: Lets assume my AD server is : AD01.domain.com with IP 1.2.3.4

Now if i run the search to group events where the src host is AD01,

index=ad |stats list(action) by src, src_ip| where src="AD01.domain.com"

it shows following results ...where there is different src-IP for every event for the same Host AD01

src	src_ip	list(action)
AD01.domain.com	2.3.4.5	success
AD01.domain.com	10.76.12.102	success
AD01.domain.com	10.x.12.101	success
AD01.domaincom	x.x.x.x	failure

Why so ?

Re: Windows Events - Why does SRC_IP for an Active Directory Server appears different in different events?

PickleRick — Fri, 29 Oct 2021 14:41:04 GMT

Why would it be the same IP always? It's the source IP of an object referenced in an event. So if the event is, for example 4624, you'll have the IP of the user's workstation.

Re: Windows Events - Why does SRC_IP for an Active Directory Server appears different in different events?

neerajs_81 — Fri, 29 Oct 2021 15:22:47 GMT

Thank you for clarifying that. What field can we then use for grouping events ( based on Event ID 4624 or 4625) going to AD server from same source machine ? If i run the below search, the Workstation_name field shows the client's laptop name (which is what we want) in some events, but in some, it shows the Hostname of the AD server itself and finally in some events it is <empty>.

index=ad source="WinEventLog:Security" EventCode IN(4625)

Re: Windows Events - Why does SRC_IP for an Active Directory Server appears different in different events?

PickleRick — Fri, 29 Oct 2021 16:04:07 GMT

It's more of a windows question, not a splunk one 😉

I'm not a big windows guru but I suppose each event's fields depend on context. Some logon request could come from the servers themselves probably (if generated by services running on those servers).