Reporting

How to create a report that shows Active Directory activity carried out?

DanAlexander
Path Finder

Hi all,

I need some assistance please,

I am trying to create a report which shows all Active Directory activities carried out. Should contain columns as follows: Login, Account, Domain, Group, iHost and Date. The Group column shows the name of the Add group which has been added or removed and the Host is the Domain Controler. The Account column is the asset number of the machine.

 

Thanks in advance!

Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

View solution in original post

DanAlexander
Path Finder

Sorry, never used it before... 🙂 will know from now on. 

0 Karma

gcusello
Esteemed Legend

Hi @DanAlexander,

some little question to better understand your needs?

  • did you already ingested logs from your Domain Controllers?
  • do you know that in Windows each login activity generates more than 10 login events?
  • you want to register each login event log or only the real accesses?

the first question is the most important, if you didn't  do it, see at:

https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/HowtogetWindowsdataintoSplunk

https://www.splunk.com/en_us/resources/videos/getting-data-in-to-splunk-enterprise-windows.html

If you already have them in you Splunk pass to the other question.

The second question is related to the target of your question: do need to gegister each login event for compliance scopes or you want the real accesses to you systems?

If you need to register all events, it's easy, you have to run a simple search like the following:

index=wineventlog EventCode=4624
| table _time Account_name Domain_name Computername

check if the field names are correct on your windows.

If instead you want the real accesses to your systems, you have to filter your results excluding many events:

  • Account_name="*$"
  • Account_name="SYSTEM"
  • Account_name="-"

than you have top dedup your events using something like this:

index=wineventlog EventCode=4624 (Logon_Type=2 OR Logon_Type=10) NOT Account_name IN ("*$","SYSTEM","-")
| dedup _time host NOMEUTENTE
| table _time Account_name Domain_name Computername 

Ciao.

Giuseppe

 

 

DanAlexander
Path Finder

Hi,

Thanks for the reply @gcusello 

I have index=windows_server sourcetype=XmlWinEventLog

I need the output for the following:

1. Account Granted (Account Added to Group)

2. Account Revoked (Account Removed from Group)

1. Account Deleted (Group Deleted)

Cheers

 

0 Karma

gcusello
Esteemed Legend

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

DanAlexander
Path Finder

Thanks for the guidance, @gcusello 

Much appreciated!

Tags (1)
0 Karma

gcusello
Esteemed Legend

Hi @DanAlexander ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...