Splunk Dev

AD monitoring

SoknySplunk
Loves-to-Learn Lots

I want to collect log from user AD. I have used eventcode 4720 and eventcode 4624. i wonder how to combine these two events together and get table like this: host, RecordNumber, user_id, signature, status, admin_id, src_ip, logonby, logon_time, Create_time, Logon_ID

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi SoknySplunk,
if you're already receiving logs from AD, try something like this

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4720 OR EventCode=4624)
| table _time host RecordNumber user_id signature status admin_id src_ip logonby logon_time Create_time Logon_ID

verify if the field names are correct related to your logs.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...