Splunk Search

Splunk Search Not Returning Complete Results


The intention of this correlation search is to find all new local admin accounts on end user devices. Problem is, when using WinEventLog:Security EventCode 4732, a good number of the users have "-" as the user name and only provide the SID. We attempted to alleviate the issue by looking up the user name by using WinEventLog:Security EventCodes 4720 and 4738 along side using a index that populates our active directory (MSAD) information. Most of the searches return a user name, but, not all. When I attempt to search for the SID information in the active directory index (MSAD), the search completes successfully, but, the same information is not pulled from the correlation search.

Below is my current search.

index=wineventlog eventtype=wineventlog_security EventCode=4732 Group_Name=Administrators | eval user_sid=mvindex(Security_ID,1) | join type=left user_sid [search index=wineventlog eventtype=wineventlog_security EventCode=4720 OR EventCode=4738 | eval user_sid=mvindex(Security_ID,1)] | join type=left user_sid [search index=msad | eval user_sid=objectSid | rename name as user]

Labels (2)
0 Karma



All searches will run with the same earliest and latest time values. Try manually adding earliest and latest values to your index=msad subsearch to accommodate the frequency of your AD input, e.g. earliest=-24h latest=now.

You may also have more consistent results using the ldapsearch command appropriately configured to query your AD domain. You could try mapping your search results over ldapsearch to look up individual SID values.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...