Getting Data In

How to get the correct gid/uid on windows fschange events

oreoshake
Communicator

All of my events show up with gid=-1,uid=-1. Is this a bug or am I doing something wrong?

Tags (2)
1 Solution

jrodman
Splunk Employee
Splunk Employee

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

jrodman
Splunk Employee
Splunk Employee

If our marketing collateral is out of step with the hard requirements of compliance specifications, that definitely deserves to be addressed. Get the ball rolling with a support ticket. Eventually it becomes an internal discussion to get things sorted, I think, but you'd be doing us a favor to apply the lever.

0 Karma

oreoshake
Communicator

I agree!!! Or at least put asterisks on your compliance advertisements!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...