Splunk Enterprise Security

How to exclude the events in the default "Anomalous Audit Trail activity detected" search in ES, if its a reboot?


Hello Everyone,

We currently have the below default search from ES to alert for anomalous audit log clearance activities on windows hosts. But what we have observed so far is, these alerts are triggered during a reboot or shutdown procedure as well. Can someone help me on, how do we tweak the below search to exclude the alerting if its because of a reboot/shutdown?

| from datamodel:"Change_Analysis"."Auditing_Changes" | where ('action'="cleared" OR 'action'="stopped") | stats max(_time) as "lastTime",latest(_raw) as "orig_raw",count by "dest","result"

What we do currently is, we investigate each alert and run a new search to check if there's an event code (like below) triggered during the same time-frame and then ignore if its because of a reboot/shutdown. But its getting painful. Hence we wanted to tweak the existing search from ES to exclude from alerting if its due to a reboot/shutdown. Can someone assist on this?

EventCode="1074" OR EventCode="6006" OR EventCode="6008" OR EventCode="6005" OR EventCode="6009" OR EventCode="1076"

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!