Security

How to link SID to Security ID

BlackZao
Explorer

Hello all,

I'm looking for a way to link a SID string, which looks like this:

S-1-5-21-3623811015-3361044348-30300820-1013

...to a Security ID, which looks like this:

 Security ID:       DOMAIN\useraccount

Which shows up in the event logs. What I am trying to do is tie account creation to the specific SIDs that they create for the purposes of auditing and logging of accounts. Thanks for your help!

Tags (2)
0 Karma
1 Solution

JSapienza
Contributor

I would Start by dumping the SID and users account name to a file with something like this:
Creating a SID Mapping File with Windows PowerShell

Next, I would take this data and create a lookup :
Fields lookup based on a static table

See if this gets you on the right track.

View solution in original post

JSapienza
Contributor

I would Start by dumping the SID and users account name to a file with something like this:
Creating a SID Mapping File with Windows PowerShell

Next, I would take this data and create a lookup :
Fields lookup based on a static table

See if this gets you on the right track.

youngsuh
Contributor

could you do this via scripted input?  or is the permission needed beyond system to run the powershell script?

Tags (1)
0 Karma

BlackZao
Explorer

This certainly looks like it will work. Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...