Getting Data In

How to get the correct gid/uid on windows fschange events

Communicator

All of my events show up with gid=-1,uid=-1. Is this a bug or am I doing something wrong?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

View solution in original post

Splunk Employee
Splunk Employee

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

View solution in original post

Splunk Employee
Splunk Employee

If our marketing collateral is out of step with the hard requirements of compliance specifications, that definitely deserves to be addressed. Get the ball rolling with a support ticket. Eventually it becomes an internal discussion to get things sorted, I think, but you'd be doing us a favor to apply the lever.

0 Karma

Communicator

I agree!!! Or at least put asterisks on your compliance advertisements!

0 Karma