Getting Data In

How to tranlate SID from Windows event

evelenke
Contributor

Hi Splunkers,

we need to analyze events with code 4662 that contains accessed AD objects, unfortunately object values are presented as IDs (example - %{bf967a86-0de6-11d0-a285-00aa003049e2}, like it is presented in EventViewer).

  • Will an attribute evt_resolve_ad_obj = 1 translate IDs (Object Name, Object Type) into names? OR it converts only Security ID?
  • Is there any suggestion how to translate those IDs to be presented as readable names in EventViewer directly?
0 Karma
1 Solution

woodcock
Esteemed Legend

You are correct, you need the evt_resolve_ad_obj = 1 setting and it will resolve EVERYTHING.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You are correct, you need the evt_resolve_ad_obj = 1 setting and it will resolve EVERYTHING.

0 Karma

evelenke
Contributor

Thanks,and I've found a new detail in documentation, I'm afraid with our GUIDs will not work, but have to try:

" Splunk software cannot translate SIDs that are not in the format S-1-N-NN-NNNNNNNNNN-NNNNNNNNNN-NNNNNNNNNN-NNNN"

0 Karma

woodcock
Esteemed Legend

I have never seen SIDs that did not get resolved.

0 Karma

evelenke
Contributor

DIdn't get to prove, because we've decided to grab sids and guids via ldapsearch and format lookup.
But thanks, accepting!

0 Karma

woodcock
Esteemed Legend

WAIT! Don't click accept on this answer! We would all like to hear about your clever workaround. That sill surely help somebody else (maybe me) in the future!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...