Splunk Enterprise Security
Highlighted

How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Explorer

Hello,

Our correlation search for "account deleted" in Splunk is firing for any type of machine deletion detected on our domain controllers.

Here is our correlation search:

| from datamodel:"Change_Analysis"."Account_Management" | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This rule fires for machine deletions such as when our system engineers remove machines after testing. We don't want to see this activity in incident review. We only want to know when someone has removed a user account.

Doing some digging, I can see that there are specific event codes for different types of deletions in wineventlog. For a user account deletion, the eventcode is 4726, but when a machine account is deleted, the eventcode is 4743. So, I made a copy of our correlation rule and added the 4726 event code into the rule like so:

| from datamodel:"Change_Analysis"."Account_Management" | where EventCode=4726 | where 'tag'="delete" | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

This is not working. I tested this search this morning after seeing a user account getting removed. And when I run this version of the search, I get no results.

Am I putting the 'where EventCode=4726' portion in the wrong part of the search string? Will this not work within a data model search?

Thank You,

Tyler Dygert

0 Karma
Highlighted

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Engager
| from datamodel:"Change_Analysis"."Account_Management" | search EventCode=4726 tag=delete 

This should take care of it.

0 Karma
Highlighted

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Explorer

This does not work. When I run this for a time frame when we had one of these events we get no results

0 Karma
Highlighted

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Splunk Employee
Splunk Employee

Depending on the versions of the CIM and Windows TA, this base search might work for you:

| from datamodel:"Change_Analysis"."Account_Management" | where result_id="4726" | where tag="delete"

View solution in original post

0 Karma
Highlighted

Re: How do you edit a correlation rule in a datamodel in Splunk Enterprise Security?

Explorer

This worked, thank you. Our final search looks like this now:

| from datamodel:"ChangeAnalysis"."AccountManagement" | where resultid="4726" | where tag="delete"| stats max(time) as "lastTime",latest(raw) as "origraw",values(result) as "signature",values(src) as "src",values(dest) as "dest",count by "src_user","user" | where 'count'>0

0 Karma