How to parse Vertical/Multiple line logs using SPLUNK for investigations

Problem statement : Finding user who deleted mails from common mailbox such as info@example.com used by a team of people. We have Windows mailbox audit logs to Investigate.

 From the above image you can notice that the each event starts with  the field"RunspaceId"

You need to tell splunk the start of the event line and end of event line and also the timestamp.

Regex for identification of timestamp  field : LastAccessed\s+\D\s
Identifying start of event Pattern: Runspace

Once the data is ingested we need to parse interesting fields.

^FolderPathName\s+\D\s+(?P<path>.??)$

here  ?? is the non-greedy qualifier. If you use +?  instead of ??  there will be inconsistencies in the result if the field is empty it will pick up the next field value.

I am using +? for other fields because these fields cant be empty.



Similarly you can parse other fields

^Operation\s+\D\s+(?P<Action>.+?)$

^FolderPathName\s+\D\s+(?P<path>.??)$

^OperationResult\s+\D\s+(?P<result>.+?)$

^SourceItemSubjectsList\s+\D\s(?P<subject>.*?)$

^LogonUserDisplayName\s+\D\s+(?P<username>.+?)$

When I  was started investigating I used below splunk query which made my investigation easier.

index=test   | timechart cont=false span=1d count(Action) values(Action) values(path) by username

This gave me a beautiful chart to pin point. So this give you the details such as what actions were taken on which folder with the count.

Now you can play with the query at your own convenience and filter out the results.

Note : The action= soft delete doesn't suggest that the user has performed deletion only. Even if you move the email from one folder to another it will create two events action=soft delete & action=create this can be validated by below query and chart.

When you a mail from one folder to another the difference between two events is in seconds.