I want to find exact events that point to a delete file event in Windows share.
There are two events generated at the same time when you delete a file, with the same "Description code" , but recorded in sequence in +/- 3 sec time range, first 4663, then 4660. However, their "RecordNumbers" differ by one. In 4660 a sequence number one greater than that of 4663.
For instance:
EVENT #2 4660
11/11/2015 03:11:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4660
RecordNumber=6953203
Message=Object deleted.
Субъект:
Security ID: MYDOMAIN\UserTest
User name: UserTest
Domain: MYDOMAIN
Объект:
Object Server: Security
Description code: 0x16c8
EVENT #1 4663
11/11/2015 03:11:31 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4663
RecordNumber=6953202
Message=Access to the object.
Субъект:
Security ID: MYDOMAIN\UserTest
User name: UserTest
Domain: MYDOMAIN
Объект:
Object Server: Security
Object type: File
Object Name: D:\share01\support\MyVideos\Race_the_best.avi
Description code: 0x16c8
Сведения о запросе на доступ:
Операции доступа: DELETE
How do I find and combine in one all these event pairs, that have occurred in 3 sec time range?
Give something like this a try:
sourcetype=WinEventLog:Security EventCode=4660 OR EventCode=4663 | fields EventCode RecordNumber User_Name Object_Name Object_type Description_code | eval RecordNumber = if(EventCode==4660, RecordNumber - 1, RecordNumber) | stats values(Object_Name) as Name Values(Object_type) as Type values(User_Name) as user by RecordNumber Description_code host
The trick here is subtracting one from the second event's recordnumber so it matches exactly. Alternatively you could do a transaction:
sourcetype=WinEventLog:Security EventCode=4660 OR EventCode=4663 | fields EventCode RecordNumber User_Name Object_Name Object_type Description_code | transaction maxspan=3s host Description_code
Give something like this a try:
sourcetype=WinEventLog:Security EventCode=4660 OR EventCode=4663 | fields EventCode RecordNumber User_Name Object_Name Object_type Description_code | eval RecordNumber = if(EventCode==4660, RecordNumber - 1, RecordNumber) | stats values(Object_Name) as Name Values(Object_type) as Type values(User_Name) as user by RecordNumber Description_code host
The trick here is subtracting one from the second event's recordnumber so it matches exactly. Alternatively you could do a transaction:
sourcetype=WinEventLog:Security EventCode=4660 OR EventCode=4663 | fields EventCode RecordNumber User_Name Object_Name Object_type Description_code | transaction maxspan=3s host Description_code
I've got it with additional parameter "endswith"
host=FileSerevr01 sourcetype="WinEventLog:Security" EventCode = 4663 OR 4660 | transaction Handle_ID Object_Name maxpause=1s endswith="An object was deleted" | table _time, Account Name, Object_Name, Accesses
What output do you want to see? A list of deleted files? The actual events?
Yes, I just want to know When-Who-What-Deleted? I want to find and coalesce two event 4663 and 4660 to one IF:
1 - they have identical Description code ("0x16c8" in my example);
2 - in event 4660 a RecordNumber one greater than that of 4663 (4663-6957600 and 4660-6957601);
3 - they occured in +/- 3 sec. time range;
Now I have the table like this:
1 | 11.11.2015 17:46 | TestUser | 0x16c8 | 4660 | 6957601 |
2 | 11.11.2015 17:46 | TestUser | 0x16c8 | 4663 | 6957600 | D:\share01\Race_01.avi | DELETE
And want to get this:
11.11.2015 17:46 | TestUser | 0x16c8 | 4663, 4660 | 6957600, 6957601 | D:\share01\Race_01.avi | DELETE
p.s. Am I the first who want to monitor Windows file shares by Splunk? Because, I didn't find any APPs for it or any info in Splunk wiki...