How to generate a search to pull Active Directory logons for a specific user and include source IP address?

[mattj81]

Hi, I'm struggling with a search string to pull back Active Directory logon times for a specific user and to include the source IP address. is this possible please? thanks!

[javiergn]

Assuming you have the Windows TA deployed you can simply do:

index=YOURWINDOWSINDEX eventtype=windows_logon_success user=YOURUSERNAME
| table _time, user, src_ip

Alternatively, look for the specific EventCode used by logon events:

index=YOURWINDOWSINDEX EventCode=4624 user=YOURUSERNAME
| table _time, user, src_ip

[mattj81]

Hi, sorry for the lack of response! Ive opened a support ticket now as its not right our DC doesn't appear to be sending events via snare so something isn't right 😞

[mattj81]

Thanks for the reply! what is windows ta?

What do I use for "Yourwindowsindex" too? Can I search all indexes?

[javiergn]

Hi, you can search all the indexes but that would be slower than just searching the one containing your windows logs. If you are not sure it might be because you are only using one default index called "main".

Alternatively you can search for your index name first and then refine your query to use that index name instead of all. There are several ways to do this (assuming your sourcetype names are correct too):

| metasearch sourcetype="WinEventLog:Security" index=* | head 1 | table index

index=* EventCode=4624 
| head 1
| table index

etc

Try one of those and see if that helps.

[javiergn]

Hi @mattj81, did this solve your problem?
If yes, please don't forget to mark it as answered so that others can benefit from it.
If not, can you let us know what's going on so that we can try to help?

Thanks,
J

[aaraneta_splunk]

Hi @mattj81 - javiergn is most likely referring to the Splunk Add-on for Microsoft Windows when he mentioned "Windows TA" 🙂