Splunk Enterprise Security

ES - Access Tracker not recording successful AD auth due to lack of dest


The correlation search 'Completely Inactive Accounts' makes use of the Access Tracker lookup, which records the most recent successful auth dates by user and dest.

The search that drives updates to Access Tracker requires that a succesful auth event has a value for dest.

A quick glance at that successful authentication events from our DC security logs show that the majority don't log a dest field.

sourcetype=XmlWinEventLog:Security tag=authentication action=success | fillnull | top EventCode, subject, dest

Those events all match the CIM constraints for a successful auth, but lack a dest. They make up about 95% of all the successful auths from the domain controller logs:

EventCode   subject
4776    The domain controller attempted to validate the credentials for an account
4624    An account was successfully logged on
4672    Special privileges assigned to new logon
4769    A Kerberos service ticket was requested

The only one I'm seeing with a dest is 'A logon was attempted using explicit credentials', which appears to be just that - an attempt to logon to the domain controller, rather than just authenticate.

I'm reluctant to eval dest to be the name of the DC for those event codes just to make the access tracker work - as I'm not sure whether there are other searches I could negatively impact by populating dest here.

Another option that comes to mind is to setup a custom version of access tracker that hard-codes dest to be host (available to tstats) where it's missing.

Also, I realise we could just give up; add LastLogonDate to our LDAP lookup and report on old AD accounts.

Anyone come across this and implemented a practical way of achieving valid results for 'Completely Inactive Accounts'?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...