Dear @diogofgm They are already tere in the filter: <QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[( (EventID >= 1100 and EventID <= 1102) or EventID=1104 or EventID=1108 or EventID = 4610 or EventID=4614 or EventID=4622 or EventID=4697 or (EventID >= 4704 and EventID <= 4707) or EventID=4713 or (EventID >= 4716 and EventID <= 4720) or (EventID >= 4725 and EventID <= 4735) )]]</Select>
<Select Path="Security">*[System[( (EventID >= 4737 and EventID <= 4739) or (EventID >= 4754 and EventID <= 4758) or EventID=4764 or EventID=4794 or EventID=4817 or EventID=4819 or (EventID >= 4865 and EventID <= 4867) or EventID=4906 or EventID=4908 or (EventID >= 4911 and EventID <= 4913) or EventID=6145)]]</Select>
<Select Path="Security"> (*[System[EventID=5136]] and *[EventData[ Data[@Name='AttributeLDAPDisplayName'] = 'nTSecurityDescriptor' or Data[@Name='AttributeLDAPDisplayName'] = 'gpOptions' or Data[@Name='AttributeLDAPDisplayName'] = 'gpLink' ]]) or (*[System[EventID=5136 or EventID=5137]] and *[EventData[ Data[@Name='ObjectClass'] = 'groupPolicyContainer' ]]) or (*[System[EventID=5141]] and *[EventData[ Data[@Name='ObjectClass'] = 'groupPolicyContainer' ]]) or (*[System[EventID=4611]] and *[EventData[ Data[@Name='LogonProcessName'] != 'Winlogon' ]]) </Select>
<Select Path="Security">*[System[EventID=4932]] and *[EventData[Data[@Name='Options'] = '2147483733']]</Select>
</Query>
</QueryList> Account Management (Audit Other Account Management Events, Audit Security Group Management, Audit User Account Management) DS Access (Audit Directory Service Changes, Audit Directory Service Replication) Policy Change (Audit Audit Policy Change, Audit Authentication Policy Change, Audit Authorization Policy Change, Audit Other Policy Change Events) System (Audit Security System Extension) It looks like everything is going from AD Server to Splunk server, except these EventCode=5136 AttributeLDAPDisplayName=nTSecurityDescriptor. I have these events in AD but I don't see them in the Splunk server log (supercharger) Thanks Paulo
... View more
