We are having issues with our Splunk datamodel Endpoint Processes.process_name. The current value for Process.process_name is... case(isnotnull(process) AND parent_process!="",replace(process,".*\\\\(.*)","\1"),1=1,"unknown") The regex pulls correct and invalid results as follows... Correct: lsass.exe NmService.exe Microsoft.IdentityServer.ServiceHost.exe Incorrect: AppxData.csv" BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider RuntimeBroker.exe -Embedding The correct results show the actual process name while the incorrect ones may not show the process name or shows the process name with an extra quotation mark or command line arguments. How do we fix the regex to only show process name? ... View more

The intention of this correlation search is to find all new local admin accounts on end user devices. Problem is, when using WinEventLog:Security EventCode 4732, a good number of the users have "-" as the user name and only provide the SID. We attempted to alleviate the issue by looking up the user name by using WinEventLog:Security EventCodes 4720 and 4738 along side using a index that populates our active directory (MSAD) information. Most of the searches return a user name, but, not all. When I attempt to search for the SID information in the active directory index (MSAD), the search completes successfully, but, the same information is not pulled from the correlation search. Below is my current search. index=wineventlog eventtype=wineventlog_security EventCode=4732 Group_Name=Administrators | eval user_sid=mvindex(Security_ID,1) | join type=left user_sid [search index=wineventlog eventtype=wineventlog_security EventCode=4720 OR EventCode=4738 | eval user_sid=mvindex(Security_ID,1)] | join type=left user_sid [search index=msad | eval user_sid=objectSid | rename name as user] ... View more