About HannanPervez

HannanPervez · ‎03-08-2019

I am working on a use case which looks for Users who haven't logged into Active Directory in the last 90 days. I have stitched together a few searches I've came across but have had no luck with it. index=wineventlog EventCode=528 OR EventCode=4624 | eval Account_Name=mvindex(Account_Name,1) | eval UserAccount=coalesce(Account_Name,User_Name) | search NOT UserAccount="*$" NOT UserAccount=anonymous NOT UserAccount=system | dedup UserAccount | eval testDate=strptime(lastOccurence,"%Y-%m-%d") | eval lastMo = relative_time(now(),"-90d@d") | where testDate < lastMo | table testDate lastMo lastOccurence I have tried using an LDAP lookup for this however, unfortunately due to the way AD has been set up in our virtualized environment, the time stamps of last logins are way off. Therefore, we have to use Windows event logs. Thanks in advanced.

HannanPervez · ‎02-13-2019

Ah, just had another run through of the search there. The search works fine when setting the where = 1, as expected it displays all the dns queries made which match the alexa domain lookup. However, when setting the where = 0 there are no results found. At first glace I'd thought that maybe it was possible that there no DNS queries made which aren't in the alexa lookup. However, I tested this by doing an nslookup on a domain NOT in the alexa domain lookup and then ran the search and still no results were found. The events for the nslookup are in the index but aren't showing up in the lookup search where alexa = 0. Any thoughts?

HannanPervez · ‎02-13-2019

That's worked perfectly DMohn. Many thanks!

HannanPervez · ‎02-12-2019

Hello, I am trying to create alerts for all outbound DNS queries which do not match the top one million domains as per Alexa top 1 million which comes shipped with ES. I am using the following search which I am fairly certain is correct as per Splunk base and previous examples of creating searches with lookups. 'index=externaldns | rex field=query "(?[A-z0-9]+.[A-z0-9]+$)" | fields domain | search NOT [ | inputlookup alexa_by_str.csv ]| stats count by domain' The result of this search was showing what looked to be the queries which DID match the top 1 million alexa domains. When looking into the job status of the search I saw an error message saying that the results were truncated to maxout 10000 (Splunks default) for searches: https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Limitsconf I then changed both the maxout for the search AND subsearch to 12000000 in the limits.conf local file in my sh_cluster app to override the default and I am now receiving the following error message: '[subsearch]: Search Processor: Subsearch produced 1002192 results, truncating to maxout 50000.' Can someone tell me if I have changed the wrong config or if there is anything more than I should do to increase the maxout?

Posts	4
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎02-12-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to look for users who haven't logged into AD i...

Splunk Enterprise Security Alexa Domain NOT lookup...

How to look for users who haven't logged into AD i...

Re: Splunk Enterprise Security Alexa Domain NOT lo...

Re: Splunk Enterprise Security Alexa Domain NOT lo...

Splunk Enterprise Security Alexa Domain NOT lookup...