I'm reviewing Microsoft Event Code 4656 (Failed Object Access) but when I try to audit Accesses or Access Reasons, Splunk will only return the first event in that field (In this situation it's DELETE). I'm trying to find a way to table all results to see everything in that field (i.e. Read Control, Write DAC, Synchronize, ReadData, WriteData too) Not just DELETE.
I've tried mvindex, stats list(Accesses), stats values(Accesses)...but the results always return the first result. I was thinking maybe I have to write a regular expression to list everything between Accesses: to Access Reasons:, AND Access Reasons: to Access Masks:
Any information you can provide me would be appreciated because right now I'm stuck.
Index=winevents sourcetype=wineventlog:security EventCode=4656
| "this is where I'm stuck"
| table user, host, Object_Name, Access_Reasons
Accesses: DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
ReadEA
WriteEA
ReadAttributes
WriteAttributes
Access Reasons: DELETE: Unknown or unchecked
READ_CONTROL: Unknown or unchecked
WRITE_DAC: Unknown or unchecked
SYNCHRONIZE: Unknown or unchecked
ReadData (or ListDirectory): Unknown or unchecked
WriteData (or AddFile): Unknown or unchecked
ReadEA: Unknown or unchecked
WriteEA: Unknown or unchecked
ReadAttributes: Unknown or unchecked
WriteAttributes: Unknown or unchecked
Access Mask:
↧