How do you compare the hostname in security logs to computers in active directory (AD)?

[heathramos]

I would like to create a query (and later a real time alert) that shows when a hostname/workstation in the log files isn't a computer that exists in Active Directory.

I assume I would have to do some sort of look up table and reference it in a query but I have never done that.

Also, can a lookup table be dynamic or does it have to be a static csv file? I don't really want to maintain a csv file if I don't have to.

Heath

[gcusello]

Hi heathramos,
to reach your goal, the best way is to install the Splunk App for Windows Infrastructure so you have all the hosts in AD.
If you don't want to install the full app, see in the AD Technical Add-On (TA) which inputs must be enabled to have the hosts list.
When you have this list you can populate a lookup where the host field is called "host" (in Splunk App for Windows Infrastructure this lookup is already present) and use it to filter your search:

index=_internal NOT [ | inputlookup my_lookup.csv | fields host ]

when this search has a result you can generate an alert.

Bye.
Giuseppe

[heathramos]

I have the Splunk App for Windows Infrastructure installed already.

I'll provide a little more details:

Here is an example of an event I want to generate an alert on:

LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4625
EventType=0
Type=Information
ComputerName= "A valid computer name on our network"
TaskCategory=Logon
OpCode=Info
RecordNumber=2335755
Keywords=Audit Failure
Message=An account failed to log on.
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC0000064
Network Information:
Workstation Name: ETEpFe9v0ZoNUfqk
Source Network Address: "valid internal ip address"
Source Port: 44981

That workstation name is obviously randomly generated.

I want a query to lookup the workstation name within our active directory environment and generate an alert if it doesn't exist.