Getting Data In

Translate GUID in Windows Event Log during Searchtime?

muebel
SplunkTrust
SplunkTrust

Is there a way to translate any GUID's to their corresponding AD objects as with "evt_resolve_ad_obj," but during Searchtime?

Tags (2)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

I would assume you could do it with a lookup (scripted or CSV) that does an LDAP search against your AD tree. From what I'm seeing here, objectGUID is an operational attribute of each object.

http://msdn.microsoft.com/en-us/library/cc221017%28v=PROT.10%29.aspx

It's not perfect yet, but I got close using just ldapsearch, as follows:

ldapsearch -h my.ad.server -x -D "CN=bindaccount,CN=Users,DC=my,DC=com" -W -b DC=my,DC=com "(objectGuid=*)" distinguishedName objectGuid

This dumps (in ldif format) every object that has a GUID, showing its GUID and its DN. There's some non-entirely-trivial reformatting to turn this into a CSV for lookup purposes. The same thing might be more easily done with the Python LDAP modules:

http://www.packtpub.com/article/installing-and-configuring-the-python-ldap-library-and-binding-to-an...

http://www.packtpub.com/article/python-ldap-applications-ldap-opearations

http://www.packtpub.com/article/python-ldap-applications-more-ldap-operations-and-the-ldap-url-libra...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...