Splunk Search

What does connected do in transaction command

mohammadsharukh
Path Finder

I am working to create a use case to detect account created and deleted within short period of time

Could you please give a simple example how connected true/false will affect results of transaction command.

I already referred previous answer but didnt understand the explanation.

Addionally also explain what is the affect of connected=true/false in the below query and also what is the best practice.

sourcetype=wineventlog (EventCode=4726 OR EventCode=4720)  | transaction user maxspan=240m startswith="EventCode=4720" endswith="EventCode=4726" connected=false| table Time, dest, EventCode, user, src_user, Account_Domain

@Ledion_Bitincka 

 @richgalloway 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mohammadsharukh,

if I correctly remember, there's a sample of a shourt living account in the Splunk Security Essential App, that I hint.

Anyway, don't use the transaction command because it's very slow, please try this search:

sourcetype=wineventlog (EventCode=4726 OR EventCode=4720)  
| stats 
   earliest(eval(EventCode=4720)) AS earliest
   latest(eval(EventCode=4726)) AS latest
   values(dest) AS dest
   values(src_user) AS src_user
   values(Account_Domain) AS Account_Domain
   BY user 
| eval 
   diff=latest-earliest,
   creation_time=strftime(earliest,"%Y-%m-%d %H:%M:%S"),
   deletion_time=strftime(latest,"%Y-%m-%d %H:%M:%S")
| where diff<240*60
| table 
   creation_time 
   deletion_time 
   dest 
   EventCode 
   user 
   src_user 
   Account_Domain

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...