Splunk Search

How do you compare the hostname in security logs to computers in active directory (AD)?

heathramos
Path Finder

I would like to create a query (and later a real time alert) that shows when a hostname/workstation in the log files isn't a computer that exists in Active Directory.

I assume I would have to do some sort of look up table and reference it in a query but I have never done that.

Also, can a lookup table be dynamic or does it have to be a static csv file? I don't really want to maintain a csv file if I don't have to.

Heath

0 Karma

gcusello
Esteemed Legend

Hi heathramos,
to reach your goal, the best way is to install the Splunk App for Windows Infrastructure so you have all the hosts in AD.
If you don't want to install the full app, see in the AD Technical Add-On (TA) which inputs must be enabled to have the hosts list.
When you have this list you can populate a lookup where the host field is called "host" (in Splunk App for Windows Infrastructure this lookup is already present) and use it to filter your search:

index=_internal NOT [ | inputlookup my_lookup.csv | fields host ]

when this search has a result you can generate an alert.

Bye.
Giuseppe

heathramos
Path Finder

I have the Splunk App for Windows Infrastructure installed already.

I'll provide a little more details:

Here is an example of an event I want to generate an alert on:

LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4625
EventType=0
Type=Information
ComputerName= "A valid computer name on our network"
TaskCategory=Logon
OpCode=Info
RecordNumber=2335755
Keywords=Audit Failure
Message=An account failed to log on.
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Network Information:
Workstation Name: ETEpFe9v0ZoNUfqk
Source Network Address: "valid internal ip address"
Source Port: 44981

That workstation name is obviously randomly generated.

I want a query to lookup the workstation name within our active directory environment and generate an alert if it doesn't exist.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...