Getting Data In

Windows Event Log Sub-Search to filter for users RDPing with specific accounts

hubbardw
New Member

So here's the issue... We have an RDS Farm that users login to and from there they RDP to other servers. Right now I have a search that creates a table and shows the users that are logging in with non-domain accounts/service accounts from the jump servers(RDS Farm) to the other servers -

index="wineventlog" source="WinEventLog:Security" EventCode=4624 Process_Name="*winlogon*" NOT (user=Example_AdminAccounts) NOT (Account_Domain=Example_Domains)
| table _time, dst_nt_domain, user, ComputerName, src_ip
| convert timeformat=" %A, %h-%d %Y %H:%M:%S%P" ctime(_time)
| rename user as "User", ComputerName as "FQDN", src_ip as "Source IP", name as "Description", dst_nt_domain as "Domain", _time as "Date and Time"

This search works properly, however I am trying to create a subsearch that would give me the following:

If a user field includes

  • user=svc_account

then search the

  • hosts=RDS Jump Server Farm within

    • WinEventLogs:Application=Microsoft-Windows-TerminalServices-RDPClient/Operational
    • EventCode=1024 for matching
    • ComputerName from previous search results and
    • Output table with fields=_time, SubSearched_User, OriginalSearch_User, OriginalSearch_ComputerName
    • Rename _time as Date and Time, SubSearched_User as User, OriginalSearch_User as Service Account, OriginalSearch_ComputerName as FQDN.

I'm not sure if this is possible or if there's a better method to go about this but hopefully some of you experts can lend a hand.

Any help would be greatly appreciated.

Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...