Getting Data In

How to track domain logons from DC security logs?

johann2017
Explorer

I want to be able to track domain logons from our DC security logs. I am monitoring Event 4624, but the DC security logs only seem to provide domain member authentication for Type 3 logons. What are others using for this?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Depends on how homogeneous your network and your user base are. Check for these and see what you find.

(EventID=528 OR EventID=540 OR EventID=552 OR EventID=4624 OR EventID=4648)  

Whether the individual workstations are going to forward their logs of type 7 events, whether you have technical users that will be using runas and generating type 9s, logging on through VPN and generating type 10s, not to mention whether there is any KVM/IP going on and generating pseudo-Type 2s, and so on, is highly organization-specific.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Depends on how homogeneous your network and your user base are. Check for these and see what you find.

(EventID=528 OR EventID=540 OR EventID=552 OR EventID=4624 OR EventID=4648)  

Whether the individual workstations are going to forward their logs of type 7 events, whether you have technical users that will be using runas and generating type 9s, logging on through VPN and generating type 10s, not to mention whether there is any KVM/IP going on and generating pseudo-Type 2s, and so on, is highly organization-specific.

0 Karma

johann2017
Explorer

Thanks I will experiment with your suggestion!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Oh, and that's for windows; unix logons have a whole different set of criteria. As a place to start, look for stuff like this -

((pam_vas:* AND "<succeeded") OR "Accepted" OR "Auth_methods_completed") 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...