Windows File System Auditing

[jdoles]

I'm attempting to reports & alert on file changes/deletes using Windows Object Access/File System auditing. I see the events coming through Splunk, but I'm struggling to get the events from Windows 2003 & Windows 2008 to show up in one saved search since the EventCode is different. I just need to show events from user accounts that are not service/SYSTEM.

I saw where I may be able to use transactions, so I built the query below.

index="testindex" sourcetype="WinEventLog:Security" | transaction EventCode maxspan=1m maxpause=30 | where (CategoryString="Object Access" OR TaskCategory="File System") AND LIKE (Message, "%WriteData%") AND NOT LIKE (User, "SYSTEM") AND NOT LIKE (Message, "%Account Name:%SYSTEM%")

It seems to work somewhat. Admittedly I don't fully understand transactions. Any help is appreciated. Splunk 4.1.6 on Windows Server 2008.

[mcronkrite]

On newer systems EventCode 560 is the key.
Check out these links:
http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/

http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/

http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=560

http://social.technet.microsoft.com/forums/windowsserver/en-US/ed94f9ca-586a-44a2-a6fc-03a97a8ae8ab/...

[southeringtonp · Accepted solution]

In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.

Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.

Something like:

index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode

[jdoles]

Excellent! I never made the connection regarding the offset. The search string was a huge help.
Thanks again for the help.