Alerting

How do I parse the three separate values for the Security_ID field in WinEventLogs for accurate alerting?

saulverde
Path Finder

We have winEventLogs feeding into splunk.

I have the following alert setup.

sourcetype="WinEventLog:Security" interesting_event=yes group_type=protected | table Account_Name Group_Name message Security_ID

The problem that I am running into is that a single log contains three different values for the Security_ID field three separate times in the log. The first entry is the account making the change, the second is the account that was changed and the third is the group being modified.

I would like each of these to show up with appropriate labels. What I'm not sure about is how to select the X time the Security_ID field that shows up in a log in order to have it put in the table under a more descriptive label.

0 Karma
1 Solution

sundareshr
Legend

Hopefully, this will give you an idea

* | head 1 | eval x="s=1, s=2, s=3" | rex max_match=0 field=x "s=(?<sids>\d)" | eval sid=mvindex(sids, 1) | table sid

View solution in original post

sundareshr
Legend

Hopefully, this will give you an idea

* | head 1 | eval x="s=1, s=2, s=3" | rex max_match=0 field=x "s=(?<sids>\d)" | eval sid=mvindex(sids, 1) | table sid

saulverde
Path Finder

Thank you! The piece that I was missing was "mvindex". Below is my corrected search string, just in case it will help anyone.

sourcetype="WinEventLog:Security" | eval AdminAccount=mvindex(Security_ID, 0) | eval ModifiedAccount=mvindex(Security_ID, 1)| table ModifiedAccount Group_Name message AdminAccount

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...