topic Re: How to write a search query to monitor account for specific duration? in All Apps and Add-ons

How to write a search query to monitor account for specific duration?

nnimbe — Wed, 31 May 2017 14:34:27 GMT

Hello All,

I need to monitor newly created user account for next 15 days.

I need a query where it will look for windows event code 4720, then extract the account name and put it for monitoring for next 15 days. Any activity from that account should logged. After 15 days, that account will be removed from monitoring. Same will repeat for all newly created user accounts.

Thank you.

Re: How to write a search query to monitor account for specific duration?

woodcock — Wed, 31 May 2017 15:18:26 GMT

I would have a search that runs daily like this:

earliest=-25h@h index=YourIndexHere sourcetype=YourSourcetypeHere EventCode=4720 
| dedup Account_Name 
| eval Account_Name = mvindex(Account_Name, 1) 
| table _time Account_Name
| rename _time AS Birthday
| appendpipe [|inputlookup NewUsersLastFifteenDays]
| dedup Account_Name
| where Birthday >= relative_time(now, "-15d@d")
| fieldformat Birthday = strftime(Birthday, "%m/%d/%Y %H:%M:%S")
| outputlookup NewUsersLastFifteenDays

Now you have a lookup that tells you whether the user is under monitoring that you can use at any time in any search like this:

index=YourIndexHere sourcetype=YourSourcetypeHere | lookup NewUsersLastFifteenDays | search Birthday="*"

Or like this:

index=YourIndexHere sourcetype=YourSourcetypeHere [|inputlookup NewUsersLastFifteenDays | fields Account_Name]

Re: How to write a search query to monitor account for specific duration?

adonio — Wed, 31 May 2017 15:22:31 GMT

hello there,
not sure i understand in full, what do you mean by "monitoring the account names for 15 days"? if you collect these logs anyways you have that data.
one approach can be to use a lookup table, something of this sort:

earliest= -15d@d latest=now index = Yourindex sourcetype=YourSourcetpye EventCode=4720 | table _time user | outputlookup new_accounts.csv

save this search to run daily so the lookup updates and you always have a list of 15 days worth of new users
now you can search leveraging the lookup command against your new lookup:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup
hope it helps