ES - Completely Inactive Account false positive alerts?

[ikulcsar]

Hi,

I am trying to clean out a little the correlation alerts in ES. Currently focusing on the Completely Inactive Account. Please help me understand the following situation. Why logging Windows this way or why Splunk doesn't recognize this as a false positive, or why am I wrong.

So I found several alerts for inactivity which looks like as badly typed account names but logged as successful login.
A sample edited event.
My problems are:
- bad_usename doesn't exist, cannot log in successfully
- Splunk fetch this event as a successful event, with user: "bad_user"
- and after 90 days ES alert that bad_user inactive...

EventCode=4648
EventType=0
TaskCategory=Logon
OpCode=Info
Keywords=Audit Success
Message=A logon was attempted using explicit credentials. 

Subject: 
    Security ID:    legal_domain\legal_user
    Account Name:   legal_user
    Account Domain: legal_domain 

Account Whose Credentials Were Used: 
    Account Name:   bad_user
    Account Domain: legal_domain

Target Server: 
    Target Server Name: legal_server
    Additional Information: legal_server

Process Information: 
    Process ID: 0x4 
    Process Name:   
    Network Information: 
    Network Address:    - 
    Port:   - 
    This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS comman

And yes, there is a failed login event with bad_user just before this wired event.
Please help me understand this situation and solve somehow.

Regards,
István

[spaceman2_gmx_n]

Hi István,

it seems that you are hitting the same point as me. Splunk records all user names of login events and therefore also catching typos and even passwords entered in the wrong field. As long as splunk is not taking only successful logons into account one should implement a regular report which takes a list of valid users (e.g. fetched with AD_ldapsearch) and drops them out of that table.

Additionally I would suggest to not run that correlation search every 5 minutes (seems like the default) but only weekly. Nobody cares wheter a user has not logged on for 90 days or for 83 days, but this takes load from your splunk.

Please let me know what you think about this.
Best regards
Lutz