Splunk Search

I need some searching help for windows event logs. Can anyone tell me the specific search commands?

dyllonj
Engager

Hey I'm new to splunk and I'm having problems finding specific events for a local server, I need help to search for the following:
i. Successful and unsuccessful access to log files
ii. Successful and unsuccessful authentication events
iii. Successful and unsuccessful authorization events
iv. Successful and unsuccessful resource access events
v. Successful and unsuccessful privilege operation
vi. Creation modification and deletion of user accounts, group accounts and objects including files, directories and user accounts.
vii. Creation, modification and deletion of command line changes, batch file changes and queries made to databases.
viii. Creation, modification and deletion of security policy.
ix. Changes to logical access control authority (i.e. rights permission).
x. System and/or application shutdowns, reboots/restarts, errors.
xi. All system changes with the potential to compromise the integrity of the audit policy configurations and audit record generation services.

Tags (1)
0 Karma

jdonn_splunk
Splunk Employee
Splunk Employee

The Splunk App for Windows Infrastructure has most if not all of this covered - https://splunkbase.splunk.com/app/1680/

0 Karma

dyllonj
Engager

thanx this helps alot

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...