Splunk Enterprise Security

Splunk ES Change Analysis - Filtering out False Positive

swright_rl
Explorer

Hi Everyone,

I'm having a little trouble tuning a correlation search which ships with ES.

The rule primarily looks for when event logs have been cleared or the logging has been stopped.

| from datamodel:"Change_Analysis"."Auditing_Changes" 
| where ('action'="cleared" OR 'action'="stopped" ) 
| stats max(_time) as "lastTime",latest(_raw) as "orig_raw",count by "dest","result" 
| rename "result" as "signature"

In our environment, all of these alerts (and we get hundreds) are caused by the machine restarting due to a reboot, mainly when a patch is pushed out.

I have found a way of tuning these out so they won't alert but I'm stuck with how to implement it.

What I've found is that there is an eventcode "1074" which occurs before, which is a remote restart command.

Unfortunately, the data model which this is using to alert, doesn't contain that particular eventcode and only looks for "1100" which is the code when a the service is stopped.

I can get this to work mostly while using this command, but it's not 100%.

index=wineventlog sourcetype=WinEventLog*   EventCode=1074 OR EventCode=1100 | transaction startswith=EventCode="1074" endswith=EventCode="1100"
|  stats count by dest

What I'm really looking for is an "alert" which fires if there has been a log cleared without a preceding reboot event. If anyone has got any ideas which would work. If they work within a data model, would be better, but just getting it to work is a higher priority, (even if
this means making a change to the data model itself).

Thanks in advance.

Steve

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...