Splunk Search

What does connected do in transaction command

mohammadsharukh
Path Finder

I am working to create a use case to detect account created and deleted within short period of time

Could you please give a simple example how connected true/false will affect results of transaction command.

I already referred previous answer but didnt understand the explanation.

Addionally also explain what is the affect of connected=true/false in the below query and also what is the best practice.

sourcetype=wineventlog (EventCode=4726 OR EventCode=4720)  | transaction user maxspan=240m startswith="EventCode=4720" endswith="EventCode=4726" connected=false| table Time, dest, EventCode, user, src_user, Account_Domain

@Ledion_Bitincka 

 @richgalloway 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mohammadsharukh,

if I correctly remember, there's a sample of a shourt living account in the Splunk Security Essential App, that I hint.

Anyway, don't use the transaction command because it's very slow, please try this search:

sourcetype=wineventlog (EventCode=4726 OR EventCode=4720)  
| stats 
   earliest(eval(EventCode=4720)) AS earliest
   latest(eval(EventCode=4726)) AS latest
   values(dest) AS dest
   values(src_user) AS src_user
   values(Account_Domain) AS Account_Domain
   BY user 
| eval 
   diff=latest-earliest,
   creation_time=strftime(earliest,"%Y-%m-%d %H:%M:%S"),
   deletion_time=strftime(latest,"%Y-%m-%d %H:%M:%S")
| where diff<240*60
| table 
   creation_time 
   deletion_time 
   dest 
   EventCode 
   user 
   src_user 
   Account_Domain

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...