topic Re: Use Case for Privileged Users, SPL Question in Splunk Search

Use Case for Privileged Users, SPL Question

avoelk — Wed, 08 Jan 2025 17:25:41 GMT

I'm trying to create a search in which the following should be done:

- look for a user creation process (ID 4720)

- and then look (for the same user) if there is a follow up group adding event (4728) for privileged groups like (512,516 etc.)

my SPL was so far like that:

index=lalala source=lalala EventID=4720 OR 4728 PrimaryGroupId IN (512,516,517,518,519)

BUT that way I only look for either a user creation OR a user being added as a privileged user. but I want to like both. I understand that I need to somehow connect those two searches but I don't know how exactly.

Re: Use Case for Privileged Users, SPL Question

emlin_charly — Wed, 08 Jan 2025 21:11:56 GMT

Hello hello!

I think what you are looking for here is the `transaction` command, but it can have some extra over-head. I'll leave some examples here to see if they work for you. Since your requirement is simple, I suggest using the `stats` command instead of `transaction`. If you wanted to look at a specific EventID first and then another specific EventID after, `transaction` might be easier to implement.

Version using `transaction`:

index=lalala source=lalala (EventID=4720 OR (EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519))) | transaction UserName maxspan=5m | search EventID=4720 AND EventID=4728

Version using `stats`:

index=lalala source=lalala (EventID=4720 OR (EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519))) | stats values(EventID) AS EventIDs by UserName | search EventIDs=4720 EventIDs=4728

Edit: Fixing the code blocks.

Re: Use Case for Privileged Users, SPL Question

isoutamo — Wed, 08 Jan 2025 20:34:54 GMT

I think that this is place for sub query like

index=lalala source=lalala EventID=4728 AND PrimaryGroupId IN (512,516,517,518,519) AND [ search index=lalala source=lalala EventID=4720 | fields UserName | dedup UserName | format ]

In this way it first look those UserNames which has created and then that "outer" base search this those (UserName = "xxx" OR UserName = "yy"....)

If you are looking for long period then maybe there is better options too.

r. Ismo

Re: Use Case for Privileged Users, SPL Question

avoelk — Thu, 16 Jan 2025 18:24:09 GMT

thanks a lot, that was the solution !