topic How to achieve field extraction to list domain admins from AD logs? in Splunk Search

How to achieve field extraction to list domain admins from AD logs?

ggilmore1 — Thu, 14 Jul 2022 20:13:09 GMT

I have been trying to extract a field to list domain admins from AD logs. The logs have all the admins starting with a CN= as shown in the expression. Despite working on regex101, the expression won't extract on Splunk. I've tried making little modifications but to no avail. Please help.

Expression:

source="ActiveDirectory" AND "CN=Domain Admins" AND member=*

| rex field=_raw"(?<=CN=)[\w .]*(?=,)(?<admin>)/g"

The logs look similar to this:

CN=Admin Account,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain

Re: How to achieve field extraction to list domain admins from AD logs?

PickleRick — Thu, 14 Jul 2022 20:35:09 GMT

Cut the "/g" part from your regex unless your event contains such substring. I suppose it doesn't. That's one thing.

Another is that you have a capture group named "admin" but nothing to match in this group.

What do you want to match? Matching such strings can be tricky especially if you want to account for all the border cases.

Re: How to achieve field extraction to list domain admins from AD logs?

ggilmore1 — Thu, 14 Jul 2022 20:38:22 GMT

Ideally, I would like to match all CN=Admin Account. My goal is to make a table with the admin accounts

Re: How to achieve field extraction to list domain admins from AD logs?

PickleRick — Thu, 14 Jul 2022 21:26:58 GMT

Easiest approach to this would be something like

CN=(?<cn>[^,]+),

This way you're capturing everything between 'CN=' and a comma.

One caveat - if your CN contains literal comma (and I don't know if your logs should have it escaped in any way or not), only the part up to and not including the comma would be captured.

Assuming that there has to be another component of the DN, you can try to use this information like this:

CN=(?<cn>.*?),\w+=

In this case however you'd have problem if your CN included a ",SOMETHING=" string but it's sooooooo unlikely

Re: How to achieve field extraction to list domain admins from AD logs?

ggilmore1 — Thu, 14 Jul 2022 21:41:46 GMT

I tried the first one and it works well. The problem is it seems to stop after the first one and I can't get it to repeat. Unfortunately I am pretty new to the world of regex

Re: How to achieve field extraction to list domain admins from AD logs?

PickleRick — Thu, 14 Jul 2022 22:02:21 GMT

What do you mean by "stops after the first one"? Do your events contain multiple DNs per event? If so, add max_match=0 option to your rex command.

Re: How to achieve field extraction to list domain admins from AD logs?

ggilmore1 — Thu, 14 Jul 2022 22:12:39 GMT

What I mean is the logs are like this:

CN=Admin Account,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain|CN=Admin Account2,OU=Vendor Accounts,OU=IT,DC=domain,DC=domain

And the command stops after the first one.

Re: How to achieve field extraction to list domain admins from AD logs?

PickleRick — Thu, 14 Jul 2022 22:16:00 GMT

With max_match=0 you should get the field extracted as multivalued field.

<your search>
| rex max_match=0 "CN=(?<cn>.*?),\w+="

With this regex or with the other one.

Re: How to achieve field extraction to list domain admins from AD logs?

ggilmore1 — Thu, 14 Jul 2022 22:16:52 GMT

That's the one. Thank you sir for bearing with me