topic Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query? in Security

user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

vin02 — Sun, 07 Jun 2020 17:13:44 GMT

user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?
after password reset, how can i get failed attempt.

Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

renjith_nair — Thu, 26 Jul 2018 16:06:47 GMT

@vin02,

You could get the failed login by using

index=_audit action="login attempt" info=failed

or even

index=_audit action="login attempt" |stats count by info,user

Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

vin02 — Thu, 26 Jul 2018 16:11:45 GMT

first need to check for password change then successful login with new password

Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

PowerPacked — Thu, 26 Jul 2018 16:30:43 GMT

Hi @vin02

You can find info about password change in,

index=_audit user=username "action=password change"

& after password change, you can see info about login in

index=_audit user=username action="login attempt" info=succeeded

Thanks

Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

renjith_nair — Thu, 26 Jul 2018 16:46:11 GMT

@vin02,

Sample SPL with the data, you can adjust according to your requirement

index=_audit (action="password change" OR action="login attempt")|table _time,user,action,info|sort - _time
|streamstats current=f last(action) as next_action,last(info) as next_info  by user
|eval status=if(action=="password change" AND info="succeeded" AND next_action="login attempt" AND next_info=="succeeded","OK","NOK")
|where action=="password change"

Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

vin02 — Fri, 27 Jul 2018 04:04:17 GMT

thanks @renjith.nair

Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

renjith_nair — Sun, 29 Jul 2018 01:07:17 GMT

@vin02, if it worked for you, please accept as answer

Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query?

vinitpathri — Wed, 30 Sep 2020 05:26:41 GMT

last command is correct with just a small correction

instead of
index=_audit user=username "action=password change"
it should be
index=_audit user=username action="password change"