Splunk Search

How do I build correlation rule? "Account was created and deleted"

or1515
Loves-to-Learn Everything

Hi!

 

There is another way to create a query with EventID ("user-created") and then EvendID ("user deleted") in 5 min?

I just want to create a correlation rule with two operations (one after the other) and show display the relevant fields (with the "stats" command).

 

 

Spoiler
index=ph_windows_sec sourcetype=XmlWinEventLog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) earliest=-14d | stats values(TargetUserName) as TargetUserName ,values(signature) as Message, count by Caller_User_Name | eval status=case(EventCode=630, \"Account%20Deletion\", EventCode=4726, \"Account%20Deletion\", EventCode=624, \"Account%20Creation\", EventCode=4720, \"Account%20Creation\") | transaction user startswith=status=\"Account%20Creation\" endswith=status=\"Account%20Deletion\" maxevents=2 | where duration < 3600

 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @or1515,

I usually try to avoid to use transaction command all the times I can, so, please, try something like this:

index=ph_windows_sec sourcetype=XmlWinEventLog (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) earliest=-14d 
| eval status=case(EventCode=630, "Deletion", EventCode=4726, "Deletion", EventCode=624, "Creation", EventCode=4720, "Creation") 
| stats dc(status) AS dc_status earliest(_time) AS earliest latest(_time) AS latest BY user
| eval duration=latest-earliest
| where duration<3600 AND dc_status=2

Anyway, probably there's and error in your search because you want to use in transaction command the field "user" and in eval command the field "EventCode", but you haven't this fields in the stats command, so they aren't available for the following commands.

Ciao.

Giuseppe

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!