what are status and sub status in Splunk PCi?

[90509]

could anyone suggest me how can I take this problem? Actually, I have been working on PCI in Splunk tool.

Status: 0xC00006D......etc
Substatus:0xC00006A....etc

The users got failed to login into servers(eg: LOUAPPWPS1111.....etc), the contributing events showing status and sub-status along with logon type-1,2,3,4,5....etc

so how could I take this failed attempts, what is the main reason for this type of attempts?
could anyone please help me out.

[DavidHourani]

hi @90509,

You really want to be classifying and defining your status and sub-status by using lookups :
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Lookup

Lookups are really powerful and allow you to simplify the way you look at things. They will allow you to define what your status code 0xC00006D means and what the substatus 0xC00006A means. That way you won't have to worry about the code anymore 🙂

If you don't want to build the lookups yourself you can leverage some of the TAs available on splunkbase which in a lot of cases contain predefined lookups with definitions of event codes.

Cheers,
David

[koshyk]

My guess is Status/SubStatus you are referring is Error Codes from Windows EventLog

Please refer the link https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4776 for the table
For instance,

000006A user name is correct but the password is wrong

The best way to understand how things work is to install Splunk_TA_Windows in your Search Head and CIM addon. This will greatly enrich your data and puts tag for each of these. For example, the above status/sub-status will be enriched to have tags of "authentication, failure, error, windows" etc. This way your data becomes device agnostic