Getting Data In

Windows File System Auditing

jdoles
Engager

I'm attempting to reports & alert on file changes/deletes using Windows Object Access/File System auditing. I see the events coming through Splunk, but I'm struggling to get the events from Windows 2003 & Windows 2008 to show up in one saved search since the EventCode is different. I just need to show events from user accounts that are not service/SYSTEM.

I saw where I may be able to use transactions, so I built the query below.

index="testindex" sourcetype="WinEventLog:Security" | transaction EventCode maxspan=1m maxpause=30 | where (CategoryString="Object Access" OR TaskCategory="File System") AND LIKE (Message, "%WriteData%") AND NOT LIKE (User, "SYSTEM") AND NOT LIKE (Message, "%Account Name:%SYSTEM%")

It seems to work somewhat. Admittedly I don't fully understand transactions. Any help is appreciated. Splunk 4.1.6 on Windows Server 2008.

1 Solution

southeringtonp
Motivator

In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.

Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.

Something like:

index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode

View solution in original post

southeringtonp
Motivator

In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.

Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.

Something like:

index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode

jdoles
Engager

Excellent! I never made the connection regarding the offset. The search string was a huge help.
Thanks again for the help.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...