Splunk Search

Searching ranges of event codes from windows event logs

LiquidTension
Path Finder

A user within my organization was attempting to search for various windows events that indicated that somebody modified a user's acccess on a machine or domain controller. Originally the search being used was the following:

(EventCode > 630 AND EventCode < 640) OR EventCode = 641 OR (EventCode > 647 AND EventCode < 668) OR (EventCode > 4726 AND EventCode < 4736) OR EventCode = 4737 OR (EventCode > 4743 AND EventCode < 4763) OR EventCode = 4764 OR (EventCode > 4782 AND EventCode < 4793)

This was not returning the range of event codes properly.

I modified the search accordingly and came up with this:

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

Thought I would share for people.

-Regards

1 Solution

LiquidTension
Path Finder

The following search returned more appropriate results for the user.

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

View solution in original post

splunknewbie81
Engager

Sorry to hijack this thread. 

Can someone please explain to me this string?

 

(EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

I don't quite understand the logic behind the search string.

0 Karma

LiquidTension
Path Finder

The following search returned more appropriate results for the user.

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...