Splunk Search

Using Active Directory group membership as sub search to user logon search

wnyricsplunk
Explorer

I am trying to use an ldapsearch as input to a seach which will list AD user logons. Both parts of the search work independently, but I don't know how to combine them into one search (sub search and main search?). The users returned are all members of one Active Directory group or another and I'd like to be able to use the group name to limit the search.
This search will show me exactly what I want to see, but I have to put in OR statements which doesn't scale very well.

sourcetype="xmlwineventlog" EventCode=4624 (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10) (Target_User_Name=User1 OR Target_User_Name=user2 OR etc...)
This search returns all the sAMAccountNames of the members of a group:

| ldapsearch search="(&(objectclass=group)(distinguishedName=TheDN of the Group))"|ldapgroup|table member_name

Is there a way to combine them into one search without having to go to the trouble of creating a csv lookup? Since ldapsearch finds the correct user names, it seems inefficient to have to use that method.

Tags (1)
0 Karma

wnyricsplunk
Explorer

Figured it out:

[ldapsearch search="(&(objectclass=group)(distinguishedName=Distinguished Name of Group)"|ldapgroup|eval Target_User_Name = member_name | fields Target_User_Name] sourcetype="xmlwineventlog" EventCode=4624 (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10)
| table _time,Target_User_Name,WorkstationName, Logon_Type

Probably a more efficient way to do this but it works for me for now.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...