About soniquella

soniquella · ‎09-13-2018

Got it. My fault. Once renamed "Assignment group" to "Assignment_Group" , I needed to remove the "quotation marks". Now all sorted. Thank you for your help.

soniquella · ‎09-13-2018

Thank you once more for your help. Sadly this is still only showing results for OTHER and none for IDS. index="myindex" sourcetype="csv" "Assignment group"="" | rename "Assignment group" as "Assignment_Group" | eval IDS=if(match("Assignment_Group","ABC"),"IDS","OTHER") | timechart span=1w count by IDS If I count by Assignment_Group then I get full ABC1, ABC2, ABC3, etc assignment groups in results as well as OTHER. My requirement is to have all ABC1, ABC2, ABC3 etc grouped results as one group 'IDS' against the results for all other groups 'OTHER' which do not MATCH ABC* but rather OTHER1, OTHER2. Sorry if this is not clear.

soniquella · ‎09-13-2018

Thanks for your response. In either case, I am only seeing 1 set of results. Ideally I would like to see all ABC groups as IDS against remaining OTHER: index="myindex" sourcetype="csv" "Assignment group"="" | eval Assignment_Grp=if(match("Assignment group","ABC"),"IDS","OTHER") | timechart span=1w count by "Assignment_Grp" I am ONLY seeing results for OTHER and not IDS? I think I am missing something here?

soniquella · ‎09-13-2018

I am attempting to write a search which uses eval show the difference between two assignment groups. A number of assignment groups which all begin with ABC. I want to group all of these as 'IDS'.I then want to show the allocated tickets to IDS and stack against the OTHER assignment group (which does not start with ABC). I then want this to show as a timechart stacked week by week. This is what I have: index="myindex" sourcetype="csv" "Assignment group"="wildcard*" | eval IDS=if(like("Assignment group","ABC*"),"IDS","OTHER") |timechart span=1w count by "Assignment group". Can anyone advise what I am doing wrong here? The timechart shows individual ABC-**** groups in the chart rather than grouped IDS results against OTHER. Thanks in advance for any help. Rob.

soniquella · ‎02-06-2018

I appreciate your help. This was my finished search which seems to be getting the results: index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 | transaction Security_ID startswith=eval(EventCode=4740) maxspan=1h maxevents=10 unifyends=false Again, much appreciated.

soniquella · ‎02-06-2018

Hi. Thanks for your quick response. One thing I was not aware of was the inclusion of the EventCode=4740 within the body of the EventCode=4771 event. I could not understand why I was seeing two EventCode's where I was expecting only 4770 as the most recent event but actually only seeing EventCode=4771 I believe that your suggestion should work perfectly. Thank you.

soniquella · ‎02-06-2018

Good morning. I am looking to generate an alert for when EventCode=4740 (User lockout) is shown in the event logs from my DC. I would like the report of triggered alert to show the previous 60 minutes (or maxevents=15) leading up to the EventCode=4740 lock out (trigger). Ultimately this would create a report we could send to the user to show that they are locked out and how the lock out was generated. index=myindex sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 Account_Name=Username | transaction startswith=EventCode=4771 endswith=EventCode=4740 maxspan=1h This is my current attempt but it is not producing the information that I need in the format that I need. If anyone has any ideas then they would be gratefully appreciated. Thanks, Rob.

soniquella · ‎01-23-2018

Good morning. I hope you can help? I have an existing dashboard which reports on user lock out orientated event codes from our DC's. index=index_name sourcetype="WinEventLog:Security" EventCode=4740 OR EventCode=4771 OR EventCode=4625 |eval Source=case(EventCode==4771,Client_Address,EventCode==4740,Caller_Computer_Name,EventCode==4625,Source_Network_Address) | eval Account_Name=if(EventCode==4771,Account_Name,mvindex(Account_Name,1)) | eval Account_Domain=case(EventCode==4771,Security_ID,EventCode==4740,Account_Domain,EventCode==4625,mvindex(Account_Domain,1)) | table _time, EventCode, Account_Name, Account_Domain, ComputerName, Source Ultimately, I would like to generate a report whereby if a user is locked out (EventCode=4740) the previous 60 minutes log attempts are recorded showing source machine and also the machine which the user is attempting to connect to. I will then go on to generate a script to put this in to e-mail format so that I can automatically e-mail the user with this report when they are locked out. Can anyone help? To clarify, the EventCode=4740 would be the trigger and then I would need the previous 60 minutes log attempts including source machine and destination machine in a report. Would this be a transaction or span command? Any help would be appreciated. Kind regards, Rob.

soniquella · ‎11-20-2017

Thanks for your response. I do not understand - "You can just restrict the Read permission for Application A from User roles to specific roles." I have done this? Users with role B access app B but I do not want them to be able to see app A in the selection menu. If I remove read access to app A for role B then role B users can no longer access KO's with global permissions? In short it seems that even though the KO's have global permissions set, if I remove read permissions to the app that they were created in then this over rules the global permissions settings? I may be wrong so feel free to tell me but this is what I think I have experienced. Thanks again for taking the time to assist.

soniquella · ‎11-20-2017

This is confusing me greatly so forgive me if my explanation is not clear but I will try to explain: I have a dashboard in app A, lets call it dashboard AA, accessible by role A. I had a request from an internal department to create a new app, app B which consisted only of dashboard AA and it's relative drill down dashboards. App B access will be controlled by role B. I cloned dashboard AA from app A (and all required drill down dashboards) i.e. made it global and then cloned within app B, cloning permissions also.I then changed the App A sharing permissions back to role A only. Lets call this new dashboard within app B, BB. However, the searches within dashboard BB failed due to KO's with app A only permissions. When running dashboard BB I saw errors such as 'lookup does not exist' and not found' errors relating to field extractions/lookups/tokens. SO, I located each KO and changed the permissions to global rather than restricted to app A. This worked. I could then run dashboard BB without issue. However, users with role B access to App B could also SEE App A from the app selection menu and I was asked to remove this so that role B users could only see App B and no other app. I then changed read permissions on App A to role A and admin. This obviously removed read permissions to App A for role B. Removing read permissions for role B to the app A meant that even though the KO's within App A had global permissions, users with role B access could no longer run the dashboard BB successfully and the previous reported errors appeared. It did however remove it from the app selection menu as expected. My question: Without cloning the required knowledge objects (one fact, one place), how do I grant access for role B users to access KO's owned by app A BUT with global permissions but remove App A availability for role B users? In hindsight, I would have MOVED the dashboard AA in to App B. I hope the above makes sense? Any help or advice anyone can offer at this point would be greatly appreciated. Kind regards, Rob.

soniquella · ‎11-14-2017

Thank you for your advice. I have taken this onboard. I was looking for further definitive steps on how best to progress with this situation as it stands if possible i.e. Can I now just remove all roles from the indexer? How do I define the missing indexes on the search head? Thank you.

soniquella · ‎11-13-2017

Good morning. I hope someone can advise as to the best practice solution for the below issue: I had previously been using a single system with dual role of indexer and search head. Recently, I created a new SH and copied all apps across to the new SH without issue. I still have roles on the indexer which I am assuming can now be removed (aside from local admin access)? There are some indexes on the indexer which do not seem to be defined on the new search head. i.e. the indexes can be searched when specified but if I am settings the default index for a new role then the indexes do not seem to be available, only internal and summary and a new index which has been created on the search head. What is the best practice to follow here as far as removing any configurations relating to the SH ability on the now sole indexer and also for defining the existing indexes on the new search head? Any help or advice would be greatly appreciated. Kind regards, Rob

soniquella · ‎12-09-2016

All sorted. Added the below to props.conf to remove headers from event and also to recognise .csv file format. The table headers where then showing in 'interesting fields' along with the separated data. Many thanks for your help. Rob. DATETIME_CONFIG = INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true

soniquella · ‎12-07-2016

Will do. Many thanks for your advice. I'll try it now and see how I get on.

soniquella · ‎12-07-2016

Hi - Thanks for your response. I did not create the file server side but rather monitor a set of directories to monitor the .csv files. This is how they appear when indexed. We chose monitoring due to constant changes in files. I have spoken with the team who look after the server on which we are monitoring these files and they have confirmed they are comma separated and the documents are saved as CSV. Why is Splunk not noticing this? I guess it's something I am doing wrong....

soniquella · ‎12-07-2016

Good morning. I hope you can help. I am currently trying to monitor specific files (in .csv format) that are updated every 10 minutes or so on a server. I have changed the inputs.conf file for the App in question and I can get the data in to Splunk. The problem I have is that the headers appear within the raw event data and also it seems that the events are not separating correctly. Here is an example of the raw event data (bold being the headers): TYPE Name.Possible.Management.NameCmdlets.Model.NameName "RequestId","CreatorID","Justification","CreationTime","CreationTimeLocal","CreationMethod","ExpirationTime","ExpirationTimeLocal","RoleId","RequestedTTL","RequestedTime","RequestedTimeLocal","RequestStatus" "564524-0343-4856-97b-6aaeh7244c38","6fk6feac-9i6f-4433-b5a3-9e1cef6jfabf","Checking MAP access/roles after rebuild","21/10/2016 12:40:58","21/10/2016 13:40:58","MAP Web API","21/10/2016 12:47:31","21/10/2016 13:47:31","b0h760c5-dj7c-444-915e-9abbce10000","3600","21/10/2016 12:40:49","21/10/2016 13:40:49","Closed" "6a424414f-d77d-4777-a777-fb7777-7d70d","6f9999-9e0f-4999-b5a3-9e99998c3bf","Testing access to domain and script to install agents","30/11/2016 11:46:21","30/11/2016 11:46:21","MAP Web API","30/11/2016 12:30:57","30/11/2016 12:30:57","b099999-d99c-4299-9999-9ab99999ad7","3600","30/11/2016 11:46:19","30/11/2016 11:46:19", It seems though that after CLOSED, this should be a separated event, beginning again to match header with data. Two questions, (1) how do I sort this so that the headers are removed/split from the event data so that I can normalise and extract fields to present in a table AND (2) how do I separate the attached events? I have spent a huge amount of time with this so far and have not managed to make any progress so any help would be hugely appreciated. Kind regards, Rob.

soniquella · ‎10-25-2016

Good morning. I am currently constructing a number of reports showing information relating to our domain controllers. E.g. host=domaincontrollers* EventCode=>4944 OR EventCode<=4945 OR EventCode=4946 OR EventCode=4947 OR EventCode=4948 OR EventCode=4949 OR EventCode=4950 OR EventCode=4951 OR EventCode=4952 OR EventCode=4953 OR EventCode=4954 OR EventCode=4957 OR EventCode=4958 This report should list MPSSVC Rule-Level Policy Changes for the Windows Firewall on the domain controllers. When there are ranges of event codes available (as above with EventCode 4944-4954) is there a better way to capture all events in a more efficient way? Many thanks in advance for any help you can offer. Kind regards, Rob.

soniquella · ‎09-30-2016

I currently have the following set in the alert settings: Alert type: Scheduled - Run on Cron Sched Earliest -16m@m Latest -1m@m Cron Exp */15 * * * * (may miss the first asterisks on here due to format but it IS there) Trigger alert when number of results is greater than zero. Trigger once. The search itself returns results. This is set to run on cron sched every 15 minutes. I can see results from the search but it seems nothing is triggered by results greater than zero...Argh!!!

soniquella · ‎09-30-2016

Please help!!!!!! tag=taggedservers EventCode=4624 OR EventCode=4634 OR EventCode=4647 OR EventCode=4625 OR EventCode=4778 OR EventCode=4779 OR EventCode=4800 OR EventCode=4801 (user=user1 OR user=user2 OR user=user3 OR user=user4) (Logon_Type=2 OR Logon_Type=10)| table _time src src_ip user host EventCodeDescription I would like to create an alert that triggers when the results are greater than zero whenever user1/2/3/4 attempts to log in to any of the tagged servers using interactive or RDP log in types. I CAN get this to trigger if I add stats count on to the end and by adding the custom trigger of ' search count > 0' BUT this only sends an e-mail with count = * and NOT the information required in a table as shown in the search. This is with Inline table selected also within the e-mail configuration. If I look in the schedule.logs it shows that the scheduled search runs and that results_count = 20 (or whatever) but STILL no e-mail!! If I add the manual e-mail send syntax to the search and run the search then it sends the e-mail fine. Other alerts using the same mail server are working without issue. I just really am at my wits end here trying to figure this out. Any help would be GREATLY appreciated. Thanks in advance, Rob.

soniquella · ‎09-29-2016

To be clear it DOES have the first asterisk before the /15. This is just not showing in our responses or in my initial question.

soniquella · ‎09-29-2016

Thank you. I'll add now to triggered alerts. This should at least give me an indication of where the issue lies.

soniquella · ‎09-29-2016

Thanks Giuseppe. My cron rule is correct /15***. I think my issue is in the alert settings. I appreciate your time though.

soniquella · ‎09-27-2016

Good morning. I can't quite get my head around this...I am trying to create an e-mailed alert for whenever one of my admin priv accounts attempt log on (interactive or remote) to a tagged set of servers. tag=taggedservers EventCode=4624 OR EventCode=4634 OR EventCode=4647 OR EventCode=4625 OR EventCode=4778 OR EventCode=4779 OR EventCode=4800 OR EventCode=4801 (user=user1 OR user=user2 OR user=user3 OR user=user4) (Logon_Type=2 OR Logon_Type=10)| lookup LogonTypeLookups.csv Logon_Type OUTPUT Logon_Desc | table _time src src_ip user host EventCodeDescription - The search is set to run looking at the last 15 minutes events. Initially I set the search to stats count within a 15 minutes time frame and to trigger if the returned results were greater than zero. This was fine and worked but only showed count = * in e-mail to intended recipients. I need to be able to show the tabled information above in the alerting e-mail so I removed the stats count and added | table etc etc... The alert triggers and actions are set as: Alert type: Scheduled Run on Cron Schedule Earliest -15m Latest now Cron Expression /15*** - Trigger when number of results is greater than 0 Action is to e-mail selected recipients. I feel like I am missing something quite simple - but just can't get this to work. In the schedule.log it looks like the alert IS being triggered but still no e-mails. Any help would be appreciated. Kind regards, Rob.

soniquella · ‎09-23-2016

Done 🙂 🙂

soniquella · ‎09-23-2016

Sorted. Changed search to earliest=-15m@m and then scheduled a cron job to run every 15 minutes and alert if stats count > 0. Thank you very much for your help with this.

Posts	38
Solutions	1
Karma Given	4
Karma Received	4
Member Since	‎11-19-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to write a search that uses eval to show the d...

Transaction based alert trigger for EventCode=4740...

Active Directory User Lockout Report

What takes precedence? Global KO permissions or ap...

What's the best practice for removing configuratio...

How to remove CSV headers from raw data in order t...

Is there a better way of searching across a range ...

Help! Alert for 'Results greater than zero' is tri...

Please help: Alerts with cron schedule. Triggers m...

Exponential alerting - How to setup a +1 event ale...

Re: How to write a search that uses eval to show t...

Re: How to write a search that uses eval to show t...

Re: How to write a search that uses eval to show t...

How to write a search that uses eval to show the d...

Re: Transaction based alert trigger for EventCode=...

Re: Transaction based alert trigger for EventCode=...

Transaction based alert trigger for EventCode=4740...

Active Directory User Lockout Report

Re: What takes precedence? Global KO permissions o...

What takes precedence? Global KO permissions or ap...

Re: What's the best practice for removing configur...

What's the best practice for removing configuratio...

Re: How to remove CSV headers from raw data in ord...

Re: How to remove CSV headers from raw data in ord...

Re: How to remove CSV headers from raw data in ord...

How to remove CSV headers from raw data in order t...

Is there a better way of searching across a range ...

Re: Help! Alert for 'Results greater than zero' is...

Help! Alert for 'Results greater than zero' is tri...

Re: Please help: Alerts with cron schedule. Trigge...

Re: Please help: Alerts with cron schedule. Trigge...

Re: Please help: Alerts with cron schedule. Trigge...

Please help: Alerts with cron schedule. Triggers m...

Re: Exponential alerting - How to setup a +1 event...

Re: Exponential alerting - How to setup a +1 event...