Getting Data In

In Windows Security logs Splunk is no longer resolving account names and instead showing SIDs

JWBailey
Communicator

Good morning,

I noticed recently that some of my events in splunk are no longer displaying account names and group names from active directory correctly. Instead it is showing the SID of the object. We are running Splunk 6.3.3.

When I look at the source log in the event viewer on the host, it is properly displaying the account information. I have verified that evt_resolve_ad_obj = 1 for the Windows Security input and is not being overwritten with a different value.

I am not sure what else would be causing this.

Thanks,

0 Karma
1 Solution

JWBailey
Communicator

Apparently this was changed in the 6.2 product release. I found this in the notes when researching the upgrade to 6.5.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/Aboutupgradingto6.5READTHISFIRST (second to last note)

According to splunk docs:

The default behavior for translating security identifiers (SID) and globally unique identifiers (GUIDs) when monitoring Windows Event Log data has changed
The etc_resolve_ad_obj attribute, which controls whether or not Splunk Enterprise attempts to resolve SIDs and GUIDs when it monitors event log channels, is now disabled by default for all channels. When you upgrade, any inputs.conf monitor stanzas that do not explicitly define this attribute will no longer perform this translation.

I followed the instructions and added the setting directly to inputs.conf. This fixed the problem.

View solution in original post

0 Karma

JWBailey
Communicator

Apparently this was changed in the 6.2 product release. I found this in the notes when researching the upgrade to 6.5.
http://docs.splunk.com/Documentation/Splunk/6.5.0/Installation/Aboutupgradingto6.5READTHISFIRST (second to last note)

According to splunk docs:

The default behavior for translating security identifiers (SID) and globally unique identifiers (GUIDs) when monitoring Windows Event Log data has changed
The etc_resolve_ad_obj attribute, which controls whether or not Splunk Enterprise attempts to resolve SIDs and GUIDs when it monitors event log channels, is now disabled by default for all channels. When you upgrade, any inputs.conf monitor stanzas that do not explicitly define this attribute will no longer perform this translation.

I followed the instructions and added the setting directly to inputs.conf. This fixed the problem.

0 Karma

rashid47010
Communicator

can you please share the input.conf parameter along with their values

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...