Reporting

How to create a report that shows Active Directory activity carried out?

DanAlexander
Communicator

Hi all,

I need some assistance please,

I am trying to create a report which shows all Active Directory activities carried out. Should contain columns as follows: Login, Account, Domain, Group, iHost and Date. The Group column shows the name of the Add group which has been added or removed and the Host is the Domain Controler. The Account column is the asset number of the machine.

 

Thanks in advance!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

View solution in original post

DanAlexander
Communicator

Sorry, never used it before... 🙂 will know from now on. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

some little question to better understand your needs?

  • did you already ingested logs from your Domain Controllers?
  • do you know that in Windows each login activity generates more than 10 login events?
  • you want to register each login event log or only the real accesses?

the first question is the most important, if you didn't  do it, see at:

https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/HowtogetWindowsdataintoSplunk

https://www.splunk.com/en_us/resources/videos/getting-data-in-to-splunk-enterprise-windows.html

If you already have them in you Splunk pass to the other question.

The second question is related to the target of your question: do need to gegister each login event for compliance scopes or you want the real accesses to you systems?

If you need to register all events, it's easy, you have to run a simple search like the following:

index=wineventlog EventCode=4624
| table _time Account_name Domain_name Computername

check if the field names are correct on your windows.

If instead you want the real accesses to your systems, you have to filter your results excluding many events:

  • Account_name="*$"
  • Account_name="SYSTEM"
  • Account_name="-"

than you have top dedup your events using something like this:

index=wineventlog EventCode=4624 (Logon_Type=2 OR Logon_Type=10) NOT Account_name IN ("*$","SYSTEM","-")
| dedup _time host NOMEUTENTE
| table _time Account_name Domain_name Computername 

Ciao.

Giuseppe

 

 

DanAlexander
Communicator

Hi,

Thanks for the reply @gcusello 

I have index=windows_server sourcetype=XmlWinEventLog

I need the output for the following:

1. Account Granted (Account Added to Group)

2. Account Revoked (Account Removed from Group)

1. Account Deleted (Group Deleted)

Cheers

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

DanAlexander
Communicator

Thanks for the guidance, @gcusello 

Much appreciated!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...