Splunk Enterprise Security

How to exclude the events in the default "Anomalous Audit Trail activity detected" search in ES, if its a reboot?


Hello Everyone,

We currently have the below default search from ES to alert for anomalous audit log clearance activities on windows hosts. But what we have observed so far is, these alerts are triggered during a reboot or shutdown procedure as well. Can someone help me on, how do we tweak the below search to exclude the alerting if its because of a reboot/shutdown?

| from datamodel:"Change_Analysis"."Auditing_Changes" | where ('action'="cleared" OR 'action'="stopped") | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",count by "dest","result"

What we do currently is, we investigate each alert and run a new search to check if there's an event code (like below) triggered during the same time-frame and then ignore if its because of a reboot/shutdown. But its getting painful. Hence we wanted to tweak the existing search from ES to exclude from alerting if its due to a reboot/shutdown. Can someone assist on this?

EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076"

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST