topic Account Lockout in Splunk Enterprise

Account Lockout

maxwell2k19 — Sun, 31 Dec 2023 12:21:25 GMT

Hi all

One of my user lets say maxwell is getting locked frequently. i want to check logs for last 7 days. i am using the below query but i am not getting any output.
i have 4 domain controllers(dctr01,dctr02,dctr03,dctr04).

index=winevenlog sourcetype=wineventlog:security Account_Name=maxwell EventCode=4740 earliest=-h (host="dctr01*" OR host="dctr02*" OR host="dctr03*" OR host="dctr04*")
| table _time Caller_Computer_Name Account_Name EventCode Source_Network_Address Workstation_Name

Re: Account Lockout

marnall — Sun, 31 Dec 2023 14:23:53 GMT

If we assume that the Windows Event logs including EventCode 4740 are indeed being indexed into index=winevenlog and sourcetype wineventlog:security (double-check those names!) and that maxwell was indeed locked out within the past 1 hour, then try doing a keyword search for maxwell to see if you can get the raw log:

e.g.

index=wineventlog sourcetype=wineventlog:security maxwell 4740

(Hopefully the logs that match the literal words maxwell and 4740 will be the EventCode=4740 for Maxwell, or at least small enough to comb through)

After that, progressively re-add those search filters until one of them removes the entry for maxwell, then you can troubleshoot why that search filter is not working. (e.g. field extraction error?)

Re: Account Lockout

dtburrows3 — Sun, 31 Dec 2023 20:00:46 GMT

I see in your original post that you mention searching over the last 7 days but your SPL has hardcoded "earliest=-1h" in it. This will override the timerange input into the time selector.
I also have some Windows event logs indexing in my local instance and by default, it looks like it is the source=WinEventLog:Security and sourcetype=WinEventLog

So maybe try updating your search to something like this and see if you get expected results.

index=<your_index> sourcetype=WinEventLog source="WinEventLog:Security" Account_Name=maxwell EventCode=4740 host IN ("dctr01*", "dctr02*", "dctr03*", "dctr04*") earliest=-7d@d latest=now | table _time Caller_Computer_Name Account_Name EventCode Source_Network_Address Workstation_Name