topic Re: Splunk wineventlog in Splunk Search

Why are there Splunk wineventlog?

BryanLim — Mon, 31 Jul 2023 20:59:27 GMT

Hi All, urgent help here. I check whether is any activity done by a user on a client machine, so i use this query in splunk search - [host="domain controller's server name" "user's account name"]. From the result, I see that there is multiple login/logout session within seconds and multiple Kerberos. I can confim that there is no physical user that is using the client machine. So can i ask why there is still wineventlogs (login/logout)?

Re: Splunk wineventlog

PickleRick — Mon, 31 Jul 2023 19:26:00 GMT

It's not really a Splunk related question. It's more like a material for a discussion with your windows admins.

For starters you can look into https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events

Re: Why are there Splunk wineventlog?

caiosalonso — Mon, 31 Jul 2023 21:59:45 GMT

Hi @BryanLim ,

I Agree with @PickleRick, this does't seem to be related to Splunk. Actually, I guess there are lots of reasons that could make this occur in a Windws host, such as the user perviously authenticated and the session was not ended, services running authenticated on that machine and so on.