All Apps and Add-ons

ta_windows_action

teak421
Path Finder

Hi. I'm getting the Windows Infrastructure App up and running and in one of the events, I am getting a failure on ta_windows_action. The event was a process creation that showed success. Is there some sort of documentation (searched here and on Google) that explains what that field is (or others...basically a reference.) Thanks!

0 Karma
1 Solution

arcsight_guru
Engager

I have noticed the same thing, but in the Splunk_TA_windows app. I guess the same logic applies to the Infra as well. There is an EVAL in props.conf that sets the field ta_windows_action based on the value of Status. And if there is no match a default value of "failure" is set. So the meaning of "failure" is basically "failure to set a proper value in this field ". Which, in my opinion, is confusing. It should say "unknown" or just leave it blank. Also the coverage of this field in the logs seems very low so a lot of the events has this field set to failure.

This is the EVAL statement in the Windows-app:

props.conf

EVAL-ta_windows_action = case(upper(Status) == "0XC000006F", "denied", upper(Status) == "0XC0000070", "denied", upper(Status) == "0XC000015B", "denied", upper(Status) == "0XC0000234", "denied", upper(Status) == "0XC0000064", "unknown", upper(Status) == "0XC0000133", "error", upper(Status) == "0XC0000225", "error", 1=1 , "failure")

My way forward is to create an override of this and changing the text "failure" to "unknown" instead.

View solution in original post

arcsight_guru
Engager

I have noticed the same thing, but in the Splunk_TA_windows app. I guess the same logic applies to the Infra as well. There is an EVAL in props.conf that sets the field ta_windows_action based on the value of Status. And if there is no match a default value of "failure" is set. So the meaning of "failure" is basically "failure to set a proper value in this field ". Which, in my opinion, is confusing. It should say "unknown" or just leave it blank. Also the coverage of this field in the logs seems very low so a lot of the events has this field set to failure.

This is the EVAL statement in the Windows-app:

props.conf

EVAL-ta_windows_action = case(upper(Status) == "0XC000006F", "denied", upper(Status) == "0XC0000070", "denied", upper(Status) == "0XC000015B", "denied", upper(Status) == "0XC0000234", "denied", upper(Status) == "0XC0000064", "unknown", upper(Status) == "0XC0000133", "error", upper(Status) == "0XC0000225", "error", 1=1 , "failure")

My way forward is to create an override of this and changing the text "failure" to "unknown" instead.

View solution in original post

teak421
Path Finder

Thanks a ton for your response..!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!