Splunk Search

Using Active Directory group membership as sub search to user logon search


I am trying to use an ldapsearch as input to a seach which will list AD user logons. Both parts of the search work independently, but I don't know how to combine them into one search (sub search and main search?). The users returned are all members of one Active Directory group or another and I'd like to be able to use the group name to limit the search.
This search will show me exactly what I want to see, but I have to put in OR statements which doesn't scale very well.

sourcetype="xmlwineventlog" EventCode=4624 (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10) (Target_User_Name=User1 OR Target_User_Name=user2 OR etc...)
This search returns all the sAMAccountNames of the members of a group:

| ldapsearch search="(&(objectclass=group)(distinguishedName=TheDN of the Group))"|ldapgroup|table member_name

Is there a way to combine them into one search without having to go to the trouble of creating a csv lookup? Since ldapsearch finds the correct user names, it seems inefficient to have to use that method.

Tags (1)
0 Karma


Figured it out:

[ldapsearch search="(&(objectclass=group)(distinguishedName=Distinguished Name of Group)"|ldapgroup|eval Target_User_Name = member_name | fields Target_User_Name] sourcetype="xmlwineventlog" EventCode=4624 (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10)
| table _time,Target_User_Name,WorkstationName, Logon_Type

Probably a more efficient way to do this but it works for me for now.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!