Splunk Dev

AD monitoring

SoknySplunk
Loves-to-Learn Lots

I want to collect log from user AD. I have used eventcode 4720 and eventcode 4624. i wonder how to combine these two events together and get table like this: host, RecordNumber, user_id, signature, status, admin_id, src_ip, logonby, logon_time, Create_time, Logon_ID

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi SoknySplunk,
if you're already receiving logs from AD, try something like this

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4720 OR EventCode=4624)
| table _time host RecordNumber user_id signature status admin_id src_ip logonby logon_time Create_time Logon_ID

verify if the field names are correct related to your logs.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...