Splunk Search

Splunk Search Not Returning Complete Results


The intention of this correlation search is to find all new local admin accounts on end user devices. Problem is, when using WinEventLog:Security EventCode 4732, a good number of the users have "-" as the user name and only provide the SID. We attempted to alleviate the issue by looking up the user name by using WinEventLog:Security EventCodes 4720 and 4738 along side using a index that populates our active directory (MSAD) information. Most of the searches return a user name, but, not all. When I attempt to search for the SID information in the active directory index (MSAD), the search completes successfully, but, the same information is not pulled from the correlation search.

Below is my current search.

index=wineventlog eventtype=wineventlog_security EventCode=4732 Group_Name=Administrators | eval user_sid=mvindex(Security_ID,1) | join type=left user_sid [search index=wineventlog eventtype=wineventlog_security EventCode=4720 OR EventCode=4738 | eval user_sid=mvindex(Security_ID,1)] | join type=left user_sid [search index=msad | eval user_sid=objectSid | rename name as user]

Labels (2)
0 Karma



All searches will run with the same earliest and latest time values. Try manually adding earliest and latest values to your index=msad subsearch to accommodate the frequency of your AD input, e.g. earliest=-24h latest=now.

You may also have more consistent results using the ldapsearch command appropriately configured to query your AD domain. You could try mapping your search results over ldapsearch to look up individual SID values.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...