Monitoring Splunk

How to monitor Windows failed log on

catch_mili
Explorer

How to check Windows failed log on using Splunk.

Tags (1)
0 Karma

mbenwell
Communicator

The Windows and Active Directory apps (NOTE: Choose relevant app based on your requirement) have a heap of field extractions and eventtypes that will be useful to you for this sort of stuff.

Assuming your logs are already in Splunk, your search would be as simple as:

eventtype=windows_logon_failure

If you don't have the apps installed or dont want to install them you could search for the relevant EventCodes instead. Example below, where "source_of_your_logs" = whatever the source is called in your Splunk installation.

source=source_of_your_logs EventCode=529 OR EventCode=4625

0 Karma

catch_mili
Explorer

Further, I would like to monitor files & folders created under C:\ & D:\ drive.

How can I do that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...