AD FS - event ID 1102

[astatrial]

Hello,
I have encountered a problem with AD FS events that has the ID 1102.
They are getting the action "cleared", and being classified as audit clearing events.
This happens because there is another WinEventLog with the same ID, which is about audit clearing - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=1102

The meaning of this event ID, referring to AD FS, is different, and it causing me a lot of false postive alerts about audit clearing (!!)

Do any of you know how to fix it ?

I am able to separate them from the event type "windows_audit_log_cleared", but it doesn't really useful as the correlation searches are using the "action" field to identify log clearing.

Thanks in advance.

[lakshman239]

Windows EventCode=1102 from domain controllers and windows servers/endpoints indicates 'log clear' and could indicate a malicious activity OR the logs are being cleared as part of upgrade/rebuilt etc..

If you are getting 1102 from ADFS servers, which you want to exclude, could you use the host name to exclude ADFS servers in the correlation search?

[astatrial]

I can exclude those events by the SourceName at the moment. But i wondered how can i remove the action "cleared" from those events.

[lakshman239]

The action=cleared comes from the lookup table windows_audit_changes.csv within the Splunk_TA_windows