-
Notifications
You must be signed in to change notification settings - Fork 132
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add an Event Log Activity
Class
#1014
Conversation
What about a "set-log" activity id? I'm looking at the various detections written against event log activities and I see the concept of event log configuration setting modification. An entity can modify settings regarding the event log using wevtutil command set-log. |
Another thought...when looking at clear event log it looks like there are return code status values. This list is oddly limited linked below but I see "success" and "privilege missing". Do we want to capture the successful event or get down to this next layer of capturing a failure by adding some kind of status/return code for each activity id? |
That is a good find! Thanks for the suggestion - will take a look at what is possible, it seems like this may be good context to capture. EDIT: After checking this out, I think |
2600e91
to
5c35e95
Compare
Created Issue #1047 to address the discrepancy in validation failure output. |
This is a good suggestion, @jasonbreimer. I took a look at the Microsoft wevtutil documentation, and it notes:
The @floydtree, @pagbabian-splunk, @k2niner any thoughts on whether |
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
…class' into event_log_activity_class
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Event Log Activity
class
Event Log Activity
classEvent Log Activity
Class
If we don't yet know how to address these two activities, we can hold off until we do, and add them later. Unless @jasonbreimer or others have a use case of course. I haven't researched it so I don't have any informed suggestion at the moment. |
Signed-off-by: Michael Radka <mradka@splunk.com>
Signed-off-by: Mike Radka (Splunk) <91983279+mikeradka@users.noreply.github.com>
Signed-off-by: Michael Radka <mradka@splunk.com>
Related Issue:
#839 Event Log Activity eg 'Audit Log Cleared'
Description of changes:
This PR introduces a new class designed for actions related to monitoring the System Event Log Service.