Getting Data In

How do you separate computer login attempts from real user login attempts?

mpasha
Path Finder

Good day,

I am trying to monitor our User Account logon activity through Splunk. As you might know, Active directory creates a huge amount of account logon events when a computer tries to access the network and does account activities as well. The only difference is that the Computer accounts have a "$" at the end of their names. this behavior will cause a lot of confusion for the teams when they are monitoring the environments for "Real" user activities.

I was thinking to create a field at indexing time "using an index time transform" to tag accounts with a $ in their names.
Here is the relevant part of the config in transforms.conf, props.conf and Fields.conf
Transforms.conf:

[AD_Computer]
REGEX = (?ms)\s+((Logon Account|Account Name):\s+\w+(\$)) \\this Regex will search for $ in the Account Name or Logon Account 
FORMAT = AD_Server::1
WRITE_META = True

Props.conf:

TRANSFORMS-ISComputer= AD_Computer

and the Fields.conf

[AD_Server]
INDEXED = true

here are the problems now:
1- The new tag "AD_Server"can not be found in the list of fields, but if I type "AD_Server=1" in the search bar, then i see some results.
2- the main purpose of this new field/tag was to be able to exclude the computer accounts from the search. However, when i add:
"AD_Server!=1" no results are returned!!

is there a way to say, if the Regex does not match a $, then the value for AD_Server is zero?

I was wondering if you have a better method to filter out these computer accounts or make the method i explained work properly.

Thanks for your help.

0 Karma
1 Solution

acharlieh
Influencer

@richgalloway's very valid point aside... You should know that there are two ways of searching for a field not equal to a particular value in Splunk, and their semantics are slightly different:

AD_Server!=1 -> Means find all events that have a field named AD_Server with a value that is not equal to 1

whereas

NOT AD_Server=1 -> Means find all events that do not have a field named AD_Server with value equal to 1

It's very slight, but only the second form will find those events where the field AD_Server is not defined... the first form it will only return events that have a field named AD_Server. (which since you're only creating the field when you're assigning 1 to it, you want the second form)

You could indeed setup a second transform that would match only if the username does not contain a $... which likely would be a rather expensive regex, possibly involving backreferences... and you would have to run both the AD_Computer and the NOT AD_Computer regexes... Or you would just need to change your filter a bit, which might be the easier option.

View solution in original post

acharlieh
Influencer

@richgalloway's very valid point aside... You should know that there are two ways of searching for a field not equal to a particular value in Splunk, and their semantics are slightly different:

AD_Server!=1 -> Means find all events that have a field named AD_Server with a value that is not equal to 1

whereas

NOT AD_Server=1 -> Means find all events that do not have a field named AD_Server with value equal to 1

It's very slight, but only the second form will find those events where the field AD_Server is not defined... the first form it will only return events that have a field named AD_Server. (which since you're only creating the field when you're assigning 1 to it, you want the second form)

You could indeed setup a second transform that would match only if the username does not contain a $... which likely would be a rather expensive regex, possibly involving backreferences... and you would have to run both the AD_Computer and the NOT AD_Computer regexes... Or you would just need to change your filter a bit, which might be the easier option.

mpasha
Path Finder

Thanks!! that works perfectly!!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What's wrong with filtering names at search time? index=wineventlog sourcetype=WinEventLog:Security NOT Account_Name="*$" | ...

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...