Search to detect auditing service on any disabled critical system that stopped or restarted more than once in the past 7 days.

[swamysanjanaput]

Hello Splunkers,

I'm new to Splunk. I am trying my best to learn Splunk and to write an efficient search. I have come up with the search for the below usecase however I was wondering if anyone could help me the better/efficient search query for the same UC?

Usecase: Splunk search to detect when auditing service on any critical system was disabled, stopped or restarted more than once in the past 7 days.

FYI: I have critical asset list and I will be using the lookup file to get the critical asset details. Below is the search query I have come up with search:

 index=xxxxx source=xxxxxx EventCode= OR EventCode=  OR EventCode= |stats count by ComputerName,Security_ID
|rename Client_User_Name as "Account Name" 

I'm not sure what should be the event code. I searched google and I got different event codes like 7036, 7035, 4608 and 4609.
Could anyone please advise the correct eventcodes?
Also could anyone please help me on how to set the threshold as per the usecase?

[amitm05 · Accepted solution]

@ swamysanjanaputta

You are pretty close with your query. You just need to change it to the following -

earliest=-7d@d index=xxxxx source=xxxxxx EventCode= OR EventCode= OR EventCode= | lookup YourAssetLookup inputField OUTPUT ComputerName |stats count by ComputerName,EventCode | where count > 1

4 things added above:
- Query to run over past 7 days
- Critical Assets Lookup that you have.
- Stats command with group by on ComputerName and EventCode (So that we have counts per computer per eventcode).
- Where condition to check if any eventcode occurs more than once

I'll leave the EventCodes for you to figure out. May be you want to take a look at https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/audit-po...

Hope this helps.
Please accept as answer if this post responds you.

[kmorris_splunk]

I'm not sure on what EventCodes, but a question would be, do you want to count all of the EventCodes together? For example, if you have 1 disabled event and 1 stopped event, do you want that counted as 2 for your threshold?

As for the threshold, simply add the following at the end of your search:

| where count>1

Your search will end up looking something like this:

index=xxxxx source=xxxxxx EventCode= OR EventCode= OR EventCode=
|stats count by ComputerName,Security_ID
|rename Client_User_Name as "Account Name"
| where count > 1

If you want to count by EventCode as well, and threshold on each individually, just add ,EventCode to the end of your stats command line.