Getting Data In

AD FS - event ID 1102

Communicator

Hello,
I have encountered a problem with AD FS events that has the ID 1102.
They are getting the action "cleared", and being classified as audit clearing events.
This happens because there is another WinEventLog with the same ID, which is about audit clearing - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=1102

The meaning of this event ID, referring to AD FS, is different, and it causing me a lot of false postive alerts about audit clearing (!!)

Do any of you know how to fix it ?

I am able to separate them from the event type "windows_audit_log_cleared", but it doesn't really useful as the correlation searches are using the "action" field to identify log clearing.

Thanks in advance.

0 Karma

SplunkTrust
SplunkTrust

Windows EventCode=1102 from domain controllers and windows servers/endpoints indicates 'log clear' and could indicate a malicious activity OR the logs are being cleared as part of upgrade/rebuilt etc..

If you are getting 1102 from ADFS servers, which you want to exclude, could you use the host name to exclude ADFS servers in the correlation search?

0 Karma

Communicator

I can exclude those events by the SourceName at the moment. But i wondered how can i remove the action "cleared" from those events.

0 Karma

SplunkTrust
SplunkTrust

The action=cleared comes from the lookup table windows_audit_changes.csv within the Splunk_TA_windows

0 Karma