- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Windows File System Auditing
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm attempting to reports & alert on file changes/deletes using Windows Object Access/File System auditing. I see the events coming through Splunk, but I'm struggling to get the events from Windows 2003 & Windows 2008 to show up in one saved search since the EventCode is different. I just need to show events from user accounts that are not service/SYSTEM.
I saw where I may be able to use transactions, so I built the query below.
index="testindex" sourcetype="WinEventLog:Security" | transaction EventCode maxspan=1m maxpause=30 | where (CategoryString="Object Access" OR TaskCategory="File System") AND LIKE (Message, "%WriteData%") AND NOT LIKE (User, "SYSTEM") AND NOT LIKE (Message, "%Account Name:%SYSTEM%")
It seems to work somewhat. Admittedly I don't fully understand transactions. Any help is appreciated. Splunk 4.1.6 on Windows Server 2008.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.
Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.
Something like:
index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On newer systems EventCode 560 is the key.
Check out these links:
http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows/
http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=560
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In places where Win2008 event codes are different from Win2003, it's usually just by an offset of 4096. You just need to create a new field that has the equivalent codes for comparison.
Also, try to filter out as much as possible in your initial search string instead of using where. Doing so is almost always a good idea, but can make a particularly big difference when using transaction.
Something like:
index="testindex" sourcetype"WinEventLog:Security"
CategoryString="Object Access" OR TaskCategory="File System"
"*WriteData*" NOT User="System" NOT "Account Name: SYSTEM"
| eval ComparisonCode=if(EventCode<4096, EventCode+4096, EventCode)
| transaction maxspan=1m maxpause=30 ComparisonCode
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Excellent! I never made the connection regarding the offset. The search string was a huge help.
Thanks again for the help.
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
