Getting Data In

How to capture user field with the windows event code 1100

swamysanjanaput
Explorer

We have a use case query : Detect when auditing service on any critical system was disabled, stopped or restarted more than once in the past 7 days.

search query: earliest=-7d@d index=X OR index=Y sourcetype=abc EventCode=1100 | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode | ctime(firstTime) | ctime(lastTime) | where count > 1

I am not able to get the user field because in windows event viewer there is no user info logged with 1100 event code(PFB link for more information)
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100.[link text]1

I had thought of using ComputerName as common field in the search query to fetch user details since multiple users will be logged in to the same host this approach is not feasible. So could anyone shed some light on how to get user field for this use case?

0 Karma

woodcock
Esteemed Legend

You are assuming that a user initiated the shutdown which is as unlikely as so. This is really more of a Windows problem than a Splunk one. I would hit the Windows forums.

0 Karma

lakshman239
Influencer

As you have noticed, the event 1100 will not have user name as this gets logged when someone/process stops the eventlogging service. What you could do to track back the user, is to look for log-off events (4634) around the time of 1100 and get the 'Logon ID' and correlate that with the respective Login event - 4624 to know the the user/process.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...