Getting Data In

Windows File System Auditing

jdoles
Engager

I'm attempting to reports & alert on file changes/deletes using Windows Object Access/File System auditing. I see the events coming through Splunk, but I'm struggling to get the events from Windows 2003 & Windows 2008 to show up in one saved search since the EventCode is different. I just need to show events from user accounts that are not service/SYSTEM.

I saw where I may be able to use transactions, so I built the query below.

index="testindex" sourcetype="WinEventLog:Security" | transaction EventCode maxspan=1m maxpause=30 | where (CategoryString="Object Access" OR TaskCategory="File System") AND LIKE (Message, "%WriteData%") AND NOT LIKE (User, "SYSTEM") AND NOT LIKE (Message, "%Account Name:%SYSTEM%")

It seems to work somewhat. Admittedly I don't fully understand transactions. Any help is appreciated. Splunk 4.1.6 on Windows Server 2008.

1 Solution

southeringtonp
Motivator

In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.

Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.

Something like:

index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode

View solution in original post

southeringtonp
Motivator

In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.

Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.

Something like:

index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode

jdoles
Engager

Excellent! I never made the connection regarding the offset. The search string was a huge help.
Thanks again for the help.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...