Reporting

How to create a report that shows Active Directory activity carried out?

DanAlexander
Communicator

Hi all,

I need some assistance please,

I am trying to create a report which shows all Active Directory activities carried out. Should contain columns as follows: Login, Account, Domain, Group, iHost and Date. The Group column shows the name of the Add group which has been added or removed and the Host is the Domain Controler. The Account column is the asset number of the machine.

 

Thanks in advance!

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

View solution in original post

DanAlexander
Communicator

Sorry, never used it before... 🙂 will know from now on. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

some little question to better understand your needs?

  • did you already ingested logs from your Domain Controllers?
  • do you know that in Windows each login activity generates more than 10 login events?
  • you want to register each login event log or only the real accesses?

the first question is the most important, if you didn't  do it, see at:

https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/HowtogetWindowsdataintoSplunk

https://www.splunk.com/en_us/resources/videos/getting-data-in-to-splunk-enterprise-windows.html

If you already have them in you Splunk pass to the other question.

The second question is related to the target of your question: do need to gegister each login event for compliance scopes or you want the real accesses to you systems?

If you need to register all events, it's easy, you have to run a simple search like the following:

index=wineventlog EventCode=4624
| table _time Account_name Domain_name Computername

check if the field names are correct on your windows.

If instead you want the real accesses to your systems, you have to filter your results excluding many events:

  • Account_name="*$"
  • Account_name="SYSTEM"
  • Account_name="-"

than you have top dedup your events using something like this:

index=wineventlog EventCode=4624 (Logon_Type=2 OR Logon_Type=10) NOT Account_name IN ("*$","SYSTEM","-")
| dedup _time host NOMEUTENTE
| table _time Account_name Domain_name Computername 

Ciao.

Giuseppe

 

 

DanAlexander
Communicator

Hi,

Thanks for the reply @gcusello 

I have index=windows_server sourcetype=XmlWinEventLog

I need the output for the following:

1. Account Granted (Account Added to Group)

2. Account Revoked (Account Removed from Group)

1. Account Deleted (Group Deleted)

Cheers

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

DanAlexander
Communicator

Thanks for the guidance, @gcusello 

Much appreciated!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @DanAlexander ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...