yes, i saw it! But is there also a way to do the same directly in SPL? ... View more

thanks, but your query misses the cidrmatch function. I have to match the ip address to the cidr notation! ... View more

Thanks for your answer! Works great! But I would prefer to get it already in props.conf extracted. So, my users do not have to have the query at hand. I took your approach and came up with the following solution in props.conf: [MSAD:NT6:DNS] EVAL-src_domain_punct = trim(replace(src_domain, "\(\d+\)", "."),".") ... View more

First of all it is required to run the Splunk Forwarder Server with a Domain Account and set the correct permissions in Exchange for this account. This was already stated in previous answers. Additionally: I think i've found a workaround for the Search-AdminAuditLog issue. The problem is somehow related to the way the exchange PowerShell snap-ins are loaded. In the Exchange TAs the Snap-Ins are loaded with the -PSConsoleFile "%Exchangepath%\bin\exshell.psc1" Parameter of PowerShell.exe It seems that if you load the exchange cmdlets this way especially the Search-AdminAuditLog cmdlet is not working as expected. The only way I’ve found to mitigate this behaivior is to load the exchange snaps-in the correct way. To do this you have to modify the read-audit-logs_2010_2013.ps1 and the read-mailbox-audit-logs_2010_2013.ps1 in the Exchange TAs. You must add the following lines at the beginning of the script: $CallEMS = ". '$env:ExchangeInstallPath\bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto -ClientApplication:ManagementShell " $null = Invoke-Expression $CallEMS Additionally, to prevent the start-up output of the Exchange Cmdlets are logged to Splunk you have to modify the following files: In the Exchange Installation Directory modify the following files: "C:\Program Files\Microsoft\Exchange Server\V15\Bin\ConnectFunctions.ps1" "C:\Program Files\Microsoft\Exchange Server\V15\Bin\CommonConnectFunctions.ps1" "C:\Program Files\Microsoft\Exchange Server\V15\Bin\RemoteExchange.ps1" Search for lines starting with set-variable VerbosePreference and comment them out! After that you will receive the correct log information. I know that’s a little bit brutal, but it will work. ... View more

Cool! Thats great! ... View more

Thank You! It worked as You descibed. The correct query would be: index="wineventlog" source="WinEventLog:Security" TaskCategory="User Account Management" EventCode=4724 [| ldapsearch search="(&(objectclass=user)(!(objectClass=computer))(userAccountControl:1.2.840.113556.1.4.803:=262144))" | fields sAMAccountName | rename sAMAccountName as Account_Name] ... View more

Yes my user is has the winfra-admin role assigned. I think the Problem is more related to the Splunk Add-on for Microsoft Windows than to the Splunk 5.x App for Microsoft Windows. From my Point of view is the field extraction from the Windows Add-on not working properly. ... View more

For clarification regarding the fields and search here some Screenshots: ... View more

Sure … [WinEventLog://Application] disabled = true start_from = oldest current_only = 0 checkpointInterval = 5 renderXml=false index=wineventlog [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="566" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist3 = EventCode="5136" Message="Class:(?!\s*groupPolicyContainer)" blacklist4 = 4689,4703,4985,4799,5158 blacklist5 = EventCode="4688" Message="(?:Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunk.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkd.exe)|.+(?:Splunk UniversalForwarder\\bin\\btool.exe)" blacklist6 = EventCode="4688" Message="(?:Process Name:).+(?:SplunkUniversalForwarder\\bin\\splunkwinprintmon.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkpowershell.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkregmon.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunk-netmon.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkadmon.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkMonitorNoHandle.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkwinevtlog.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunkperfmon.exe)|.+(?:SplunkUniversalForwarder\\bin\\splunk-wmi.exe)" blacklist7 = EventCode="4688" Message="(?:Process Command Line:).+(?:--scheme)|.+(?:--no-log)|.+(?:-Embedding)" blacklist8 = EventCode="4634" Message="(?:Account Name:).+(?:\$$)|.+(?:SYSTEM)" blacklist9 = EventCode="4624" Message="(?:Account Name:).+(?:\$$)|.+(?:SYSTEM)" renderXml=false index=wineventlog [WinEventLog://System] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist1 = SourceName="Microsoft-Windows-DistributedCOM" blacklist2 = SourceName="Microsoft-Windows-Security-SPP" blacklist3 = SourceName="Microsoft-Windows-LSA" blacklist4 = SourceName="MsiInstaller" renderXml=false index=wineventlog [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Execution] checkpointInterval = 5 current_only = 0 disabled = 0 start_from = oldest evt_resolve_ad_obj = 1 index=wineventlog [WinEventLog://Microsoft-Windows-AppLocker/Packaged app-Deployment] checkpointInterval = 5 current_only = 0 disabled = 0 start_from = oldest evt_resolve_ad_obj = 1 index=wineventlog [WinEventLog://Microsoft-Windows-AppLocker/MSI and Script] checkpointInterval = 5 current_only = 0 disabled = 0 start_from = oldest evt_resolve_ad_obj = 1 index=wineventlog [WinEventLog://Microsoft-Windows-AppLocker/EXE and DLL] checkpointInterval = 5 current_only = 0 disabled = 0 start_from = oldest evt_resolve_ad_obj = 1 index=wineventlog [admon://default] disabled = true monitorSubtree = 1 [WinRegMon://hkcu_run] disabled = 0 hive = \\REGISTRY\\USER\\.*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename index = windows [WinRegMon://hklm_run] disabled = 0 hive = \\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\.* proc = .* type = set|create|delete|rename index = windows But I don't think that the Problem is related to the Inputs.conf. If I check the Windows Events, I see a TaskCategory Field, but i cannot search for it. ... View more