I would like to run a query for any user additions to privileged Active Directory groups. I am storing the AD groups of interest in Lookup file titled DomainPrivilegedGroups.csv. The definition has also been defined with the same name of DomainPrivilegedGroups.csv. At this time, the Lookup file contains 16 rows and this is likely to grow in the future. The Lookup file contains one column titled GroupName.  My eventual search will look for any events where EventID=4728 OR EventID=4732 OR EventID=4756. For now, I'm just trying to get the basic search working and therefore I am running the below:      sourcetype="XmlWinEventLog" [ | inputlookup DomainPrivilegedGroups.csv | rename GroupName as Group_Name ]     I'm performing the rename action because I know that the events store the group name in an attribute titled Group_Name. I know that there are events containing one of the group names so I am expecting results to return.  Is there anything glaringly obvious I'm doing wrong here?  Another consideration is whether or not a Lookup file is the best option. From what I can see, there is no way to update a Lookup file and instead, when wanting to make any additions I would need to delete and re-create the Lookup file & definition. Is this correct?  Thanks in advance! ... View more

We have a requirement to run a Universal Forwarder that will act as an Intermediate Forwarder for our domain controllers & will also run syslog-NG to receive logs from our firewalls before sending them up to Splunk Cloud. We are looking to run this on Linux. The following KB mentions the Linux Kernel versions that are supported: https://docs.splunk.com/Documentation/Splunk/7.3.2/Installation/Systemrequirements#Supported_OSes I'm assuming from that document that Splunk only supports distros with 2.6 kernel version. I've seen a few posts/articles stating that people are running RHEL 6.x. Is anyone running a more recent version? are people running other distributions? Thanks in advance. ... View more

I have recently installed the Okta Identity Cloud App for Splunk. I've noticed that each event is given a field called tag and there is one value in particular that is of interest; Privileged. Naturally, those tagged with a value of Privileged are of interest. However, upon reviewing some of these events they seem to be largely innocuous and are often events relating to signing in. If I look at all events with the 'privileged' tag and view the values for displayMessage I see the following: An identity provider has been chosen to authenticate the user User login to Okta Verify user identity Authenticate user with AD agent Evaluation of sign-on policy User single sign on to app etc... Does anyone know what constitutes an event being tagged with the privileged value? Is it a case of any user that it is assigned to any event initiated by a user with any level of privilege? Thanks in advance. ... View more