Reporting

How to create a report that shows Active Directory activity carried out?

DanAlexander
Path Finder

Hi all,

I need some assistance please,

I am trying to create a report which shows all Active Directory activities carried out. Should contain columns as follows: Login, Account, Domain, Group, iHost and Date. The Group column shows the name of the Add group which has been added or removed and the Host is the Domain Controler. The Account column is the asset number of the machine.

 

Thanks in advance!

Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

View solution in original post

DanAlexander
Path Finder

Sorry, never used it before... 🙂 will know from now on. 

0 Karma

gcusello
Legend

Hi @DanAlexander,

some little question to better understand your needs?

  • did you already ingested logs from your Domain Controllers?
  • do you know that in Windows each login activity generates more than 10 login events?
  • you want to register each login event log or only the real accesses?

the first question is the most important, if you didn't  do it, see at:

https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/HowtogetWindowsdataintoSplunk

https://www.splunk.com/en_us/resources/videos/getting-data-in-to-splunk-enterprise-windows.html

If you already have them in you Splunk pass to the other question.

The second question is related to the target of your question: do need to gegister each login event for compliance scopes or you want the real accesses to you systems?

If you need to register all events, it's easy, you have to run a simple search like the following:

index=wineventlog EventCode=4624
| table _time Account_name Domain_name Computername

check if the field names are correct on your windows.

If instead you want the real accesses to your systems, you have to filter your results excluding many events:

  • Account_name="*$"
  • Account_name="SYSTEM"
  • Account_name="-"

than you have top dedup your events using something like this:

index=wineventlog EventCode=4624 (Logon_Type=2 OR Logon_Type=10) NOT Account_name IN ("*$","SYSTEM","-")
| dedup _time host NOMEUTENTE
| table _time Account_name Domain_name Computername 

Ciao.

Giuseppe

 

 

DanAlexander
Path Finder

Hi,

Thanks for the reply @gcusello 

I have index=windows_server sourcetype=XmlWinEventLog

I need the output for the following:

1. Account Granted (Account Added to Group)

2. Account Revoked (Account Removed from Group)

1. Account Deleted (Group Deleted)

Cheers

 

0 Karma

gcusello
Legend

Hi @DanAlexander,

this is a different question and not related to Splunk because you need to know which are the EventCodes related to the events you want to monitor.

Anyway, here you can find all the Windows EventCodes: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/

  • 1. Account Granted (Account Added to Group):

    • 4732
    • 4746
    • 4751
    • 4756
    • 4761
    • 4785
    • 4787
  •  

    2. Account Revoked (Account Removed from Group)

    • 4733
    • 4747
    • 4752
    • 4757
    • 4762
    • 4786
    • 4788
  •  

    1. Account Deleted (Group Deleted)

    • do you mean account Deleted by a Group or Group deletion?

Anyway in the above url you can find all the needed EventCodes.

Ciao.

Giuseppe

DanAlexander
Path Finder

Thanks for the guidance, @gcusello 

Much appreciated!

Tags (1)
0 Karma

gcusello
Legend

Hi @DanAlexander ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...