How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

[Tylerdygert]

Hello,

Our correlation search for "account deleted" in Splunk is firing for any type of machine deletion detected on our domain controllers.

Here is our correlation search:

| from datamodel:"Change_Analysis"."Account_Management" | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This rule fires for machine deletions such as when our system engineers remove machines after testing. We don't want to see this activity in incident review. We only want to know when someone has removed a user account.

Doing some digging, I can see that there are specific event codes for different types of deletions in wineventlog. For a user account deletion, the eventcode is 4726, but when a machine account is deleted, the eventcode is 4743. So, I made a copy of our correlation rule and added the 4726 event code into the rule like so:

| from datamodel:"Change_Analysis"."Account_Management" | where EventCode=4726 | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This is not working. I tested this search this morning after seeing a user account getting removed. And when I run this version of the search, I get no results.

Am I putting the 'where EventCode=4726' portion in the wrong part of the search string? Will this not work within a data model search?

Thank You,

Tyler Dygert

[dherrald_splunk · Accepted solution]

Depending on the versions of the CIM and Windows TA, this base search might work for you:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"

[Tylerdygert]

This worked, thank you. Our final search looks like this now:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"| stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

[miwade]

| from datamodel:"Change_Analysis"."Account_Management" | search EventCode=4726 tag=delete 

This should take care of it.

[Tylerdygert]

This does not work. When I run this for a time frame when we had one of these events we get no results