Splunk Enterprise Security

Want help in creating Splunk Query with specific conditions?

joomla
Engager

Hi Splunk Members,

Good Day!

I am looking for support to create a query with Windows Security Events Logs. Basically the idea is to search for different Windows Security Event IDs events within a short span by Account Name.

Example: To return events if events id: XXXX occurs at 1 PM EST then within 1 min i.e 1:01 PM; Event ID: YYYY occurs and then event id: ZZZZ also occurs for same Account_Name then my query should results all those events.

Kindly note, condition should met if all three event ids trigger within short span that is 1 min here. If for an example Event ID XXXX occurs but Event IDs YYYY and ZZZZ do not for the same Account Name then results should be zero in the ouput.

Many Thanks.

 

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
``` your search ```
| table _time user event 
``` reverse so we can get row number in ascending order ```
| reverse
| streamstats count as row
``` capture time for each event type ```
| eval XXXXTime=if(event="XXXX",_time,null) 
| eval YYYYTime=if(event="YYYY",_time,null)
| eval ZZZZTime=if(event="ZZZZ",_time,null)
``` capture row for each event type ```
| eval XXXXRow=if(event="XXXX",row,null) 
| eval YYYYRow=if(event="YYYY",row,null) 
| eval ZZZZRow=if(event="ZZZZ",row,null) 
``` track latest time and row for each event type by user ```
| streamstats latest(XXXXTime) as lastXXXX latest(YYYYTime) as lastYYYY latest(ZZZZTime) as lastZZZZ max(XXXXRow) as lastXXXXRow max(YYYYRow) as lastYYYYRow max(ZZZZRow) as lastZZZZRow by user
``` filter for events in XXXX, YYYY, ZZZZ order where ZZZZ is within 60 seconds of last XXXX ```
| where lastXXXXRow < lastYYYYRow AND lastYYYYRow < lastZZZZRow AND lastZZZZ < lastXXXX + 60
0 Karma

alonsocaio
Contributor

Hi @joomla 

I guess you could reach this result by using transaction command. I have tried this way and It seems to work for your use case:

...YOUR SEARCH QUERY...
| transaction Account_Name startswith=eval(EventCode=XXXX) endswith=eval(EventCode=ZZZZ) maxspan=1m
| search EventCode=YYYY

 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...