Splunk Enterprise Security

How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Tylerdygert
Path Finder

Hello,

Our correlation search for "account deleted" in Splunk is firing for any type of machine deletion detected on our domain controllers.

Here is our correlation search:

| from datamodel:"Change_Analysis"."Account_Management" | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This rule fires for machine deletions such as when our system engineers remove machines after testing. We don't want to see this activity in incident review. We only want to know when someone has removed a user account.

Doing some digging, I can see that there are specific event codes for different types of deletions in wineventlog. For a user account deletion, the eventcode is 4726, but when a machine account is deleted, the eventcode is 4743. So, I made a copy of our correlation rule and added the 4726 event code into the rule like so:

| from datamodel:"Change_Analysis"."Account_Management" | where EventCode=4726 | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This is not working. I tested this search this morning after seeing a user account getting removed. And when I run this version of the search, I get no results.

Am I putting the 'where EventCode=4726' portion in the wrong part of the search string? Will this not work within a data model search?

Thank You,

Tyler Dygert

0 Karma
1 Solution

dherrald_splunk
Splunk Employee
Splunk Employee

Depending on the versions of the CIM and Windows TA, this base search might work for you:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"

View solution in original post

0 Karma

dherrald_splunk
Splunk Employee
Splunk Employee

Depending on the versions of the CIM and Windows TA, this base search might work for you:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"

View solution in original post

0 Karma

Tylerdygert
Path Finder

This worked, thank you. Our final search looks like this now:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"| stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

0 Karma

miwade
Engager
| from datamodel:"Change_Analysis"."Account_Management" | search EventCode=4726 tag=delete 

This should take care of it.

0 Karma

Tylerdygert
Path Finder

This does not work. When I run this for a time frame when we had one of these events we get no results

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!