Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

I need some searching help for windows event logs. Can anyone tell me the specific search commands?

$
0
0
Hey I'm new to splunk and I'm having problems finding specific events for a local server, I need help to search for the following: i. Successful and unsuccessful access to log files ii. Successful and unsuccessful authentication events iii. Successful and unsuccessful authorization events iv. Successful and unsuccessful resource access events v. Successful and unsuccessful privilege operation vi. Creation modification and deletion of user accounts, group accounts and objects including files, directories and user accounts. vii. Creation, modification and deletion of command line changes, batch file changes and queries made to databases. viii. Creation, modification and deletion of security policy. ix. Changes to logical access control authority (i.e. rights permission). x. System and/or application shutdowns, reboots/restarts, errors. xi. All system changes with the potential to compromise the integrity of the audit policy configurations and audit record generation services.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>