Splunk Search

How to extract data from Microsoft Event Code 4656 (Failed Object Access) ?

jbala1
Engager

I'm reviewing Microsoft Event Code 4656 (Failed Object Access) but when I try to audit Accesses or Access Reasons, Splunk will only return the first event in that field (In this situation it's DELETE). I'm trying to find a way to table all results to see everything in that field (i.e. Read Control, Write DAC, Synchronize, ReadData, WriteData too) Not just DELETE.

I've tried mvindex, stats list(Accesses), stats values(Accesses)...but the results always return the first result. I was thinking maybe I have to write a regular expression to list everything between Accesses: to Access Reasons:, AND Access Reasons: to Access Masks:

Any information you can provide me would be appreciated because right now I'm stuck.

Index=winevents sourcetype=wineventlog:security EventCode=4656
| "this is where I'm stuck"
| table user, host, Object_Name, Access_Reasons

Accesses: DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
ReadEA
WriteEA
ReadAttributes
WriteAttributes

Access Reasons: DELETE: Unknown or unchecked
READ_CONTROL: Unknown or unchecked
WRITE_DAC: Unknown or unchecked
SYNCHRONIZE: Unknown or unchecked
ReadData (or ListDirectory): Unknown or unchecked
WriteData (or AddFile): Unknown or unchecked
ReadEA: Unknown or unchecked
WriteEA: Unknown or unchecked
ReadAttributes: Unknown or unchecked
WriteAttributes: Unknown or unchecked

Access Mask:

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Using the data that you provided, this is an example of the rex command(s) that will extract the information that you want (I believe):

| makeresults 
|eval raw="Accesses: DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
ReadEA
WriteEA
ReadAttributes
WriteAttributes

Access Reasons: DELETE: Unknown or unchecked
READ_CONTROL: Unknown or unchecked
WRITE_DAC: Unknown or unchecked
SYNCHRONIZE: Unknown or unchecked
ReadData (or ListDirectory): Unknown or unchecked
WriteData (or AddFile): Unknown or unchecked
ReadEA: Unknown or unchecked
WriteEA: Unknown or unchecked
ReadAttributes: Unknown or unchecked
WriteAttributes: Unknown or unchecked

Access Mask:" 
| rex field=raw "Accesses:\s(?P<accesses>[\s\S]*?)\s+Access Reasons:(?P<reasons>[\s\S]*?)\s+Access Mask:" 
| rex field=accesses max_match=0 "(?P<accesseslist>.+)" 
| rex field=reasons max_match=0 "(?P<reasonslist>.+)"

The only lines that you probably need to worry about at the last three rex commands. They extract the data into the fields, which are further separated into a multi-valued set of fields by the last two rex commands.

Hopefully this is what you want, but please comment if there is something else that you need.

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Using the data that you provided, this is an example of the rex command(s) that will extract the information that you want (I believe):

| makeresults 
|eval raw="Accesses: DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
ReadEA
WriteEA
ReadAttributes
WriteAttributes

Access Reasons: DELETE: Unknown or unchecked
READ_CONTROL: Unknown or unchecked
WRITE_DAC: Unknown or unchecked
SYNCHRONIZE: Unknown or unchecked
ReadData (or ListDirectory): Unknown or unchecked
WriteData (or AddFile): Unknown or unchecked
ReadEA: Unknown or unchecked
WriteEA: Unknown or unchecked
ReadAttributes: Unknown or unchecked
WriteAttributes: Unknown or unchecked

Access Mask:" 
| rex field=raw "Accesses:\s(?P<accesses>[\s\S]*?)\s+Access Reasons:(?P<reasons>[\s\S]*?)\s+Access Mask:" 
| rex field=accesses max_match=0 "(?P<accesseslist>.+)" 
| rex field=reasons max_match=0 "(?P<reasonslist>.+)"

The only lines that you probably need to worry about at the last three rex commands. They extract the data into the fields, which are further separated into a multi-valued set of fields by the last two rex commands.

Hopefully this is what you want, but please comment if there is something else that you need.

0 Karma

jbala1
Engager

Thank you for your assistance. It worked!!!!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...