Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About samsonusmc
samsonusmc
New Member
Member since:
12-03-2019
06-05-2020
Community Statistics
| Posts | 3 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-03-2019 |
Activity Feed
- Posted AD FS Audit Logs (ADFS Audit) XML issues: Why is the RAW not parsing out the XML? on All Apps and Add-ons. 05-31-2020 01:52 PM
- Tagged AD FS Audit Logs (ADFS Audit) XML issues: Why is the RAW not parsing out the XML? on All Apps and Add-ons. 05-31-2020 01:52 PM
- Tagged AD FS Audit Logs (ADFS Audit) XML issues: Why is the RAW not parsing out the XML? on All Apps and Add-ons. 05-31-2020 01:52 PM
- Tagged AD FS Audit Logs (ADFS Audit) XML issues: Why is the RAW not parsing out the XML? on All Apps and Add-ons. 05-31-2020 01:52 PM
- Tagged AD FS Audit Logs (ADFS Audit) XML issues: Why is the RAW not parsing out the XML? on All Apps and Add-ons. 05-31-2020 01:52 PM
- Tagged AD FS Audit Logs (ADFS Audit) XML issues: Why is the RAW not parsing out the XML? on All Apps and Add-ons. 05-31-2020 01:52 PM
- Posted Re: Splunk 8 - TSTATS WHERE IN () does not work with CIDR on Splunk Search. 12-03-2019 09:40 AM
- Posted Splunk 8 - TSTATS WHERE IN () does not work with CIDR on Splunk Search. 12-03-2019 09:01 AM
- Tagged Splunk 8 - TSTATS WHERE IN () does not work with CIDR on Splunk Search. 12-03-2019 09:01 AM
- Tagged Splunk 8 - TSTATS WHERE IN () does not work with CIDR on Splunk Search. 12-03-2019 09:01 AM
Topics I've Started
05-31-2020
01:52 PM
I am using Splunk TA for Windows infrastructure configured to consume the XML logs. The problem is the RAW doesn't parse out the XML that is contained w/in the XML log very well (see raw output below)
It parses the "Outer" XML fine, but the "Inner" XML, not so much. (See all the lt; and gt;) > and < is just to get through this WYSIWYG editor
Anyone have good advice on how to get splunk to parse and store this properly?
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
<System>
<Provider Name='AD FS Auditing'/>
<EventID Qualifiers='0'>1200</EventID>
<Level>0</Level>
<Task>3</Task>
<Keywords>0x80a0000000000000</Keywords>
<TimeCreated SystemTime='2020-05-31T20:31:28.875321100Z'/>
<EventRecordID>27322577</EventRecordID>
<Channel>Security</Channel>
<Computer>Computer</Computer>
<Security UserID='S-1-5-21----SID'/>
</System>
<EventData>
<Data>3fb4c7cb-865b-4d89-3e02-0080010000b3</Data>
<Data>&lt;?xml version="1.0" encoding="utf-16"?&gt;
&lt;AuditBase xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="AppTokenAudit"&gt;
&lt;AuditType&gt;AppToken&lt;/AuditType&gt;
&lt;AuditResult&gt;Success&lt;/AuditResult&gt;
&lt;FailureType&gt;None&lt;/FailureType&gt;
&lt;ErrorCode&gt;N/A&lt;/ErrorCode&gt;
&lt;ContextComponents&gt;
&lt;Component xsi:type="ResourceAuditComponent"&gt;
&lt;RelyingParty&gt;RelyingParty&lt;/RelyingParty&gt;
&lt;ClaimsProvider&gt;AD AUTHORITY&lt;/ClaimsProvider&gt;
&lt;UserId&gt;UserId&lt;/UserId&gt;
&lt;/Component&gt;
&lt;Component xsi:type="AuthNAuditComponent"&gt;
&lt;PrimaryAuth&gt;http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/windows&lt;/PrimaryAuth&gt;
&lt;DeviceAuth&gt;false&lt;/DeviceAuth&gt;
&lt;DeviceId&gt;N/A&lt;/DeviceId&gt;
&lt;MfaPerformed&gt;false&lt;/MfaPerformed&gt;
&lt;MfaMethod&gt;N/A&lt;/MfaMethod&gt;
&lt;TokenBindingProvidedId&gt;true&lt;/TokenBindingProvidedId&gt;
&lt;TokenBindingReferredId&gt;false&lt;/TokenBindingReferredId&gt;
&lt;SsoBindingValidationLevel&gt;TokenBoundAndValid&lt;/SsoBindingValidationLevel&gt;
&lt;/Component&gt;
&lt;Component xsi:type="ProtocolAuditComponent"&gt;
&lt;OAuthClientId&gt;N/A&lt;/OAuthClientId&gt;
&lt;OAuthGrant&gt;N/A&lt;/OAuthGrant&gt;
&lt;/Component&gt;
&lt;Component xsi:type="RequestAuditComponent"&gt;
&lt;Server&gt;Server&lt;/Server&gt;
&lt;AuthProtocol&gt;SAMLP&lt;/AuthProtocol&gt;
&lt;NetworkLocation&gt;Intranet&lt;/NetworkLocation&gt;
&lt;IpAddress&gt;IpAddress&lt;/IpAddress&gt;
&lt;ForwardedIpAddress /&gt;
&lt;ProxyIpAddress&gt;N/A&lt;/ProxyIpAddress&gt;
&lt;NetworkIpAddress&gt;N/A&lt;/NetworkIpAddress&gt;
&lt;ProxyServer&gt;N/A&lt;/ProxyServer&gt;
&lt;UserAgentString&gt;Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko&lt;/UserAgentString&gt;
&lt;Endpoint&gt;/adfs/ls/wia&lt;/Endpoint&gt;
&lt;/Component&gt;
&lt;/ContextComponents&gt;
&lt;/AuditBase&gt;</Data>
</EventData>
</Event>
... View more
- Tags:
- adfs
- audit-logs
- config
- Splunk App for Windows Infrastructure
- splunk-enterprise
- windows-security-audit
- xml
- xml-kv
Labels
- Labels:
-
configuration
12-03-2019
09:40 AM
Nevermind.. Known issue
https://docs.splunk.com/Documentation/Splunk/8.0.0/ReleaseNotes/KnownIssues
2019-11-11 SPL-179357, SPL-179700 Negated subnet CIDR filter doesn't work in search.
Workaround:
Workaround:
limits.conf: [search] use_search_evaluator_v2=false
Examples searches that don't filter out values: index=_internal (NOT clientip=127.0.0.0/8) | stats count BY clientip
index=_internal (clientip!=127.0.0.0/8) | stats count BY clientip
index=_internal | stats count BY clientip | search (clientip!=127.0.0.0/8) | stats sum(count) BY clientip | noop search_optimization=false
Filtering with | where is OK: index=_internal | where NOT cidrmatch("127.0.0.0/8", clientip) | stats count BY clientip
... View more
12-03-2019
09:01 AM
Providing Splunk 8 the following:
| tstats allow_old_summaries=t count from datamodel=Network_Traffic.All_Traffic where (nodename = All_Traffic.Traffic_By_Action.Allowed_Traffic) (All_Traffic.src_zone="INET") (All_Traffic.dest_ip=172.20.17.119) NOT All_Traffic.src_ip IN (40.96.0.0/13, 40.104.0.0/15, 52.96.0.0/14)by All_Traffic.src_ip, All_Traffic.action | sort - count
It doesn't filter out the subnets we asked to exclude... BUT it works on 7.3
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
