I would like to create a query (and later a real time alert) that shows when a hostname/workstation in the log files isn't a computer that exists in Active Directory.
I assume I would have to do some sort of look up table and reference it in a query but I have never done that.
Also, can a lookup table be dynamic or does it have to be a static csv file? I don't really want to maintain a csv file if I don't have to.
to reach your goal, the best way is to install the Splunk App for Windows Infrastructure so you have all the hosts in AD.
If you don't want to install the full app, see in the AD Technical Add-On (TA) which inputs must be enabled to have the hosts list.
When you have this list you can populate a lookup where the host field is called "host" (in Splunk App for Windows Infrastructure this lookup is already present) and use it to filter your search:
index=_internal NOT [ | inputlookup my_lookup.csv | fields host ]
when this search has a result you can generate an alert.
I have the Splunk App for Windows Infrastructure installed already.
I'll provide a little more details:
Here is an example of an event I want to generate an alert on:
SourceName=Microsoft Windows security auditing.
ComputerName= "A valid computer name on our network"
Message=An account failed to log on.
Failure Reason: Unknown user name or bad password.
Sub Status: 0xC0000064
Workstation Name: ETEpFe9v0ZoNUfqk
Source Network Address: "valid internal ip address"
Source Port: 44981
That workstation name is obviously randomly generated.
I want a query to lookup the workstation name within our active directory environment and generate an alert if it doesn't exist.