Getting Data In

How to track domain logons from DC security logs?

Explorer

I want to be able to track domain logons from our DC security logs. I am monitoring Event 4624, but the DC security logs only seem to provide domain member authentication for Type 3 logons. What are others using for this?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Depends on how homogeneous your network and your user base are. Check for these and see what you find.

(EventID=528 OR EventID=540 OR EventID=552 OR EventID=4624 OR EventID=4648)  

Whether the individual workstations are going to forward their logs of type 7 events, whether you have technical users that will be using runas and generating type 9s, logging on through VPN and generating type 10s, not to mention whether there is any KVM/IP going on and generating pseudo-Type 2s, and so on, is highly organization-specific.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Depends on how homogeneous your network and your user base are. Check for these and see what you find.

(EventID=528 OR EventID=540 OR EventID=552 OR EventID=4624 OR EventID=4648)  

Whether the individual workstations are going to forward their logs of type 7 events, whether you have technical users that will be using runas and generating type 9s, logging on through VPN and generating type 10s, not to mention whether there is any KVM/IP going on and generating pseudo-Type 2s, and so on, is highly organization-specific.

View solution in original post

0 Karma

Explorer

Thanks I will experiment with your suggestion!

0 Karma

SplunkTrust
SplunkTrust

Oh, and that's for windows; unix logons have a whole different set of criteria. As a place to start, look for stuff like this -

((pam_vas:* AND "<succeeded") OR "Accepted" OR "Auth_methods_completed") 
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!